Privacy Policy
1. Who we are
AlSafwa AlArabiya Establishment For IT Systems, at Building 8570, Prince Saud Ibn Faisal Ibn Abdulaziz St, Al Nasiriyah Dist., Riyadh 12732 (short address RBNA8570). We are responsible for the processing described in this document.
For data the Customer enters inside its own account about its customers, suppliers and staff: the Customer is the controller of that data and we process it on the Customer's behalf, solely to operate the Service.
2. Data we collect
2.1 Account data
- Business name, VAT number, commercial registration, logo, branch addresses.
- Account owner's name, email address and mobile number.
- User names, email addresses, roles and permissions.
2.2 Data you enter into the system
- Customer and supplier records: name, address, phone, email, VAT number and commercial registration.
- Financial documents: invoices, returns, receipts and payments, expenses and their attachments, journal entries.
- Item, stock and movement data.
2.3 Data generated automatically
- Login history: time, outcome and IP address of each attempt, for account security.
- Audit log: who changed what and when inside the account — an accounting requirement, and not something that can be switched off.
- Technical operational logs for errors and performance.
2.4 The mobile app (Final Solution ERP)
The app is for the business's owner, users and sales reps, and signs in with the same account as the system. From the device it uses:
- Location: read at the moment a rep records a sale, collection, visit or return, and saved with that record in the business's account so it shows where it happened. Location is never tracked in the background or while the app is closed, and the permission can be refused with the app still working.
- Camera: for scanning barcodes only. Images are processed on the device and are never uploaded or stored.
- Fingerprint or screen lock: to lock the app, if the user turns it on. The device itself checks it; no biometric data ever reaches us.
- Notifications: the app reads the account's alerts from our servers and shows them on the device, with no third-party push service.
- Kept on the device: the sign-in token, and a copy of working data (customers, items, unsent sales) so a rep can work offline. The token is removed on sign-out; the working copy is removed when another business or user signs in on the same device, while unsent sales stay with their owner until sent and are never sent for anyone else. Uninstalling the app removes all of it.
The app contains no ads and no third-party analytics or tracking. All data travels encrypted (HTTPS) to the system's servers. A user's account is deleted by the business owner from the Users screen in the system, or on request to us through the channels in section 11.
2.5 What we do not collect
We do not collect or store any bank card details; payment is by bank transfer outside the system. We use no advertising trackers and we sell data to no one.
3. Why we process it
- Performance of the contract: running the Service, provisioning the account, issuing documents, providing support.
- Legal obligation: submitting invoices to the Zakat, Tax and Customs Authority, and retaining accounting records.
- Legitimate interest: account security, preventing abuse, improving stability.
4. Who the data is shared with
| Recipient | What reaches them | Why |
|---|---|---|
| Zakat, Tax and Customs Authority | Electronically signed invoices and credit/debit notes, containing seller and buyer details | Statutory e-invoicing obligation |
| Email service provider | Email address and message content (registration confirmation, password reset) | Sending service emails |
| Hosting provider | Hosting of the databases and the application | Operating the Service |
We share your data with no one else, save under a binding legal order or with your explicit consent.
5. Where data is stored
Hosting location: within the Kingdom of Saudi Arabia.
6. Isolation between customers
Every business has a completely separate PostgreSQL database with its own database user. There is no shared table whose rows are told apart by a column, and the connection itself is refused if it reaches for another business's database.
7. Retention
We keep your data for the duration of your subscription and for 90 days after it ends, after which it is permanently deleted following notice to your registered email address.
Posted financial documents are not deleted from within the system — they are corrected by a reversing entry, because deleting them would breach accounting and audit rules. This is deliberate, not a technical limitation.
8. Your rights
- Access your data and obtain a copy in a machine-readable format.
- Correct any inaccurate data.
- Request deletion of your data, so far as this does not conflict with statutory retention periods.
- Object to processing based on legitimate interest.
To exercise any of these, contact us through the channels on the Contact page. We respond within a reasonable period not exceeding 30 days.
9. Cookies
We use only cookies necessary to operate the site and the Service: the session cookie, the language preference cookie, and the anti-forgery (CSRF) cookie. We use no tracking, analytics or advertising cookies, which is why the site shows no cookie consent banner.
10. Changes to this policy
On any material change we notify customers at their registered email address before it takes effect, and update the last-updated date at the top of this page.
11. Privacy contact
For any question or complaint about your data, contact us through the channels listed on the Contact page.