Privacy Policy

1. Who we are

Shamel Hub ("we", "us") provides cloud software for e-invoicing, counter sales, inventory, purchasing and accounting to businesses in the Kingdom of Saudi Arabia. The service is operated by [legal entity name, commercial registration number and registered address].

For any question about personal data, contact us at hello@shamelhub.sa. [Name and contact details of the data protection officer, if one is appointed.]

2. Our two roles

We act in two different roles, and your rights are handled differently in each:

• Controller: for the data of the people who sign up for and use Shamel Hub (account owners and their team members) and of visitors to our website. We decide why and how this data is used.
• Processor: for the business records our customers enter into the service, such as the names and contact details of their own customers, suppliers and staff. The business that enters this data is the controller. It is responsible for having a lawful basis and for informing the people concerned. We process that data only to provide the service, under our Terms of Service and the customer's instructions.

3. The data we collect

• Account and contact data: name, email address, phone number, language, role and permissions. Passwords are stored only as a one-way hash.
• Business identity: company names in Arabic and English, VAT number, commercial registration number, national address and city.
• Records you enter: invoices, quotations, customers, suppliers, products, stock, payments, expenses, bank accounts and accounting entries.
• E-invoicing data: the data required by the Zakat, Tax and Customs Authority (ZATCA), including invoice identifiers, cryptographic stamps and the authority's responses.
• Billing data: your plan, subscription invoices and payment status. Card details are entered on our payment provider's page; we do not store full card numbers.
• Technical and security data: IP address, browser and device type, sign-in times and an audit log of actions taken in your account.
• Messages you send to our support team.

4. Why we use it and our legal basis

• To create your account and provide the service you subscribed to (performance of our contract with you).
• To issue, report and clear e-invoices with ZATCA and to keep tax and accounting records (legal obligations).
• To bill your subscription, send renewal reminders and answer support requests (contract).
• To keep the service secure, prevent fraud and misuse, and keep audit logs (our legitimate interests and legal obligations).
• To improve the product using aggregated statistics that do not identify anyone (legitimate interests).
• To send marketing messages only when you have agreed to receive them. You can stop them at any time.

When you create an account, you confirm that you agree to our Terms of Service and this Privacy Policy. We record the version you accepted and the time you accepted it.

5. Who we share data with

We do not sell personal data. We share it only as follows:

• ZATCA, to clear and report e-invoices as the law requires.
• Service providers who work for us under written contracts and confidentiality duties: hosting [provider and data location to be confirmed], email delivery [provider to be confirmed], online payments (Moyasar, a payment provider licensed in Saudi Arabia) and error monitoring [provider to be confirmed], which receives technical details of errors but not your account details.
• Your own customers and suppliers, when you share an invoice or quotation link with them.
• Public authorities, when the law or a valid order from a competent authority requires it.
• A buyer or successor of our business, if it is reorganised or sold. We will tell you before your data becomes subject to a different privacy policy.

6. Where your data is stored

We aim to store and process your data inside the Kingdom of Saudi Arabia [confirm the hosting region]. If any data is transferred or accessed outside the Kingdom, we will do so only as allowed by the PDPL and the Regulations on Personal Data Transfer outside the Kingdom, with appropriate safeguards.

7. How long we keep data

• Account data: for as long as your account is active.
• After an account is closed, we delete or anonymise its data within [90] days, except records we must keep by law.
• Tax invoices, accounting records and billing records: for the period required by tax and zakat rules (generally at least six years, and longer in some cases).
• Security and audit logs: [12] months, unless they are needed for an investigation.
• Backups: overwritten on a rolling cycle of [35] days.

We recommend that you also keep your own copy of your tax records for the period the law requires. You can download them at any time.

8. How we protect data

We use encryption in transit (TLS), one-way hashing of passwords, separation of each customer's data at the database level, role-based permissions, an audit log of actions, and protected storage of e-invoicing signing keys. Our staff access customer data only when needed to provide support or keep the service running.

If a personal data breach occurs, we will notify the Saudi Data and Artificial Intelligence Authority (SDAIA) within 72 hours of becoming aware of it where the law requires, and inform affected people without undue delay when the breach may harm them.

9. Your rights

Under the PDPL you have the right to:

• be informed about how your personal data is collected and used;
• access your personal data and get a copy in a clear, readable format;
• ask us to correct, complete or update it;
• ask us to destroy it when we no longer need it, subject to records the law requires us to keep;
• withdraw your consent at any time, where we rely on consent.

Account owners can download all of their company's data from Settings → Data and privacy, and can ask to close the account from the same page. Anyone else can write to hello@shamelhub.sa. We will answer within 30 days, or within any longer period the regulations allow, and we may ask you to verify your identity first.

If your data appears in a business's records (for example, your name on an invoice that a business issued to you), please contact that business first. We will help it respond to your request.

If you are not satisfied with our answer, you can file a complaint with the Saudi Data and Artificial Intelligence Authority (SDAIA).

10. Cookies and browser storage

We use only what is needed to run the service. We do not use advertising or analytics cookies, and we do not load third-party trackers.

• mz_session: tells our pages that you are signed in so the right screen loads (30 days).
• mz_platform: the same, for our internal operator console only.
• NEXT_LOCALE: remembers the language you chose.
• Browser storage on your device keeps your sign-in tokens, your theme, which announcements you dismissed, and an unfinished counter-sale cart.

If we ever add non-essential cookies, we will ask for your consent first and update this policy.

11. Children

Shamel Hub is a service for businesses. It is not directed at anyone under 18, and we do not knowingly collect their data.

12. Changes to this policy

We will publish any update on this page and change the date at the top. If a change is material, we will tell account owners by email or in the app before it takes effect, and ask for consent again where the law requires.

13. Contact us

Email: hello@shamelhub.sa. Postal address: [registered address].