Privacy Policy

> Draft requiring specialist legal review under the Personal Data Protection Law (PDPL) and its implementing regulations before final adoption.

1. Data we collect

| Category | Examples | Purpose | |---|---|---| | Account data | Name, mobile, email, language | Account creation and communication | | Business data | CR, VAT number, addresses and branches | Verification and order fulfilment | | Operational data | Orders, approvals, returns, commissions | Providing the service and records | | Visit data | Visit time, location only with your consent | Documenting representative visits | | Technical data | IP address, device type, session log | Security and fraud prevention |

2. Legal basis

Performance of contract, legal obligations, legitimate interest in platform security, and explicit consent for location and marketing messages.

3. Location

Location is captured only when a representative checks in/out of a visit and grants permission on the device. There is no background tracking. Consent can be withdrawn at any time in browser or device settings.

4. Who sees your data

- Each business sees only its own data and its own transactions; isolation is enforced at database level. - A supplier sees the store data needed to fulfil its orders; a representative sees customers within their authorization. - Service providers (hosting, email, SMS, AI when enabled) under contracts requiring confidentiality and data minimisation. - Authorities when legally required.

5. Transfers outside the Kingdom

Data is hosted in the Kingdom by default. If a provider processes data abroad (e.g. an AI provider), this happens only under the PDPL transfer rules, and administrators can disable such services.

6. Retention

Data is kept for the periods in the Data Retention Policy, then deleted or anonymised.

7. Your rights

To be informed, to access, to obtain a copy, to correct, to request destruction (subject to legal obligations such as keeping financial records), and to withdraw consent — via Settings → Privacy or the contact form.

8. Security

Encrypted transport, Argon2 password hashing, encryption of sensitive fields, two-factor authentication, an append-only audit log, and encrypted backups.

9. Incident notification

If a breach affects your data we will notify the competent authority and affected users within the statutory deadlines.

10. Contact

For privacy questions use the Contact page and choose the "Privacy" topic.