Privacy Policy

1Who we are

Daftarix is a cloud platform that brings a sales CRM, quotations and invoicing, ZATCA e-invoicing and a help desk into one workspace, in Arabic and English, for businesses in Saudi Arabia. Daftarix is the controller of the personal data described in this policy. You can reach us using the details in the "Contact us" section below.

2Data you add to the platform

Our customers use Daftarix to manage their own customers, leads, invoices and support tickets. For that data, the customer (the business that holds the Daftarix account) decides what is collected and why, and Daftarix processes it on the customer’s behalf and on their instructions.

If your details are held in a Daftarix customer’s account, for example as their client or contact, please contact that business directly about your data. We will help our customers respond to such requests.

3Personal data we collect

We collect only the data we need for the purposes described in this policy:

• Contact and enquiry details: your name, mobile number, email address, company name, job title, the service you are interested in and your message, when you fill in a form, call us, message us on WhatsApp or email us.
• Account details: when you or your company sign up: your name, work email, mobile number, login credentials, company name and the users you invite.
• Company and billing details: such as your company’s legal name, commercial registration number, VAT number, address and billing records, which we need to provide the Services and issue invoices.
• Support and communications: the content of support requests, calls, chats and emails with our team, and your feedback.
• Usage and device data: when you visit our website or use the platform: IP address, browser and device type, pages viewed, links clicked, the website that referred you, approximate location (city or country) and the date and time of your visit, collected through cookies and similar technologies.
• Integration data: if you connect Daftarix to the ZATCA Fatoora platform, to an AI agent or to another service, the technical details needed to keep that connection working, such as connection tokens and logs.

We do not ask for sensitive personal data, such as health, religious or biometric data, and we ask you not to send it to us.

4How we use personal data and why

We use personal data for the following purposes. Each is based on one of the legal grounds the PDPL allows: your consent, the performance of a contract with you or your company, compliance with a legal obligation, or our legitimate interests where these do not override your rights.

• To provide the Services: create and manage accounts, run the platform, process invoices and connect to the Fatoora platform when you ask us to (contract).
• To respond to you: answer enquiries, arrange demos and calls, and provide support (contract, or steps you ask us to take before entering into one).
• To bill and keep records: issue invoices, collect payments and keep accounting and tax records (contract and legal obligation).
• To keep the Services secure: detect and prevent fraud, misuse and security incidents (legitimate interests and legal obligation).
• To improve our website and platform: understand how visitors use our pages and features through aggregated analytics (legitimate interests, or consent where required).
• To send you updates: product news, offers and event invitations, where you have agreed to receive them or the law allows it. You can opt out at any time (consent or legitimate interests).
• To meet legal requirements: respond to lawful requests from authorities and enforce our terms (legal obligation and legitimate interests).

5Cookies and analytics

Our website uses cookies and similar technologies to work properly and to help us understand how it is used. We use Google Tag Manager and Google Analytics 4, which set cookies to measure visits and page views. Our website also loads fonts from Google Fonts, so your browser connects to Google’s servers. Google processes this data under its own privacy policy.

You can block or delete cookies in your browser settings, and you can opt out of Google Analytics with Google’s browser add-on. If you block cookies, some parts of the website may not work as intended.

6Who we share personal data with

We do not sell personal data. We share it only as described below, and only as much as is needed:

• Service providers: who host our website and platform, send emails and messages, provide analytics and support tools, or process payments, under contracts that require them to protect the data and use it only to provide their services to us.
• The Zakat, Tax and Customs Authority (ZATCA): when you use e-invoicing features, invoice data, which may include personal data of your customers, is sent to ZATCA through the Fatoora platform, as the e-invoicing regulations require.
• AI providers you choose to connect: if you or your company connect an AI agent or model to Daftarix, for example through our MCP server, the data you allow that agent to access is shared with its provider. That provider’s own terms and privacy policy apply.
• Professional advisers: such as lawyers, auditors and accountants, where needed.
• Authorities: courts, regulators and government bodies, when the law requires it or to protect our rights, our customers or the public.
• Business transfers: a buyer or successor if Daftarix is involved in a merger, acquisition or sale of assets, who must continue to protect the data under this policy.

7Where personal data is stored

Our service providers may store or process personal data inside or outside the Kingdom of Saudi Arabia. When personal data is transferred outside the Kingdom, we do so only as the PDPL and its regulations on transferring personal data outside the Kingdom allow, and with safeguards that keep the data protected.

8How long we keep personal data

We keep personal data only for as long as we need it for the purposes in this policy:

• Account data: for as long as the account is active, and for a limited period after it closes so that you can export your data and we can settle any open matters.
• Invoices, billing and tax records: for the periods Saudi law requires, including the record-keeping rules for VAT and e-invoicing.
• Enquiries that do not lead to an account: for as long as we need to respond and follow up.
• Analytics data: for the retention period set in our analytics tools.

When we no longer need personal data, we delete it or make it anonymous.

9How we protect personal data

We use technical and organizational measures to protect personal data against loss, misuse and unauthorized access, including encrypted connections (HTTPS), access controls and limiting access to the people who need it.

No system is completely secure, so please keep your password confidential and tell us straight away if you suspect unauthorized use of your account. If a data breach affects your personal data, we will notify the competent authority and, where required, you, as the PDPL requires.

10Your rights

Under the PDPL you have the right to:

• Be informed: about how and why we collect and use your personal data, which is the purpose of this policy.
• Access your data: and receive a copy of it in a clear and readable format.
• Correct your data: if it is inaccurate, incomplete or out of date.
• Request destruction: of personal data we no longer need, unless the law requires us to keep it.
• Withdraw your consent: at any time where we rely on consent. This does not affect processing that took place before you withdrew it.

To use any of these rights, contact us using the details below. We may ask you to confirm your identity first. We will respond within 30 days, or tell you if we need more time as the law allows. If you are not satisfied with our response, you can file a complaint with the Saudi Data and AI Authority (SDAIA).

11Marketing messages

If you receive marketing emails or messages from us, you can unsubscribe using the link in the message or by contacting us. We will still send you messages about your account and the Services, such as billing notices and security alerts.

12Children

The Services are meant for businesses and are not directed at anyone under 18. We do not knowingly collect personal data from children. If you believe a child has given us personal data, please contact us and we will delete it.

13Links to other websites

Our website links to other websites and services, such as WhatsApp and ZATCA. We are not responsible for their privacy practices, so please read their privacy policies.

14Changes to this policy

We may update this policy from time to time. We will post the new version on this page and change the "Last updated" date above. If the changes are significant, we will also tell you by email or through the platform.

15Contact us

For questions about this policy or your personal data, contact Daftarix:

• Emailsales@daftarix.com
• Phone+966 55 078 6037
• WhatsApp+966 55 078 6037

This policy is available in Arabic and English. If there is any difference between the two versions, the Arabic version prevails. Please also read our Terms & Conditions.