Privacy policy

This policy explains what the Albatriq platform collects, why, on what basis, where it is kept, and who can reach it.

1. Who is responsible for which data

The distinction matters because it decides who you should ask:

• Your company and account data (company name, VAT registration number, users, subscription): Albatriq is the controller.
• Your customers' data and their purchases, which you enter into documents: you are the controller, and Albatriq processes it on your behalf and on your instructions. If one of your customers contacts you about their data, you are the one who answers — and we will help where you need it.

2. What we keep

• Company data: name, VAT registration number, activity, branches and their addresses, point-of-sale devices and their serial numbers.
• User data: name, email, phone, permission level and sign-in times. Passwords are stored hashed and cannot be recovered — we never see them.
• Documents: receipts, invoices, credit and debit notes with all their lines and taxes.
• Buyer data as you entered it: name, and the VAT registration number for a business or an identity number for an individual. An identity number is sensitive personal data — do not enter one unless the tax rule that applies to you requires it.
• Technical logs: the user sign-in log, and the change history recording who changed what and when.
• What we do not keep: we store no payment card data — payment is by bank transfer outside the platform — we collect no location data, and we build no interest profile about anybody.

3. The legal basis for processing

We process data on these bases, depending on what it is:

• Performance of the contract: everything needed to run your account, issue your documents and collect your subscription.
• Legal obligation: keeping tax records for the period the laws of the Kingdom of Saudi Arabia requires.
• Legitimate interests: securing the platform, preventing abuse, and diagnosing faults — to the extent this does not override your rights.
• Consent: for messages not required to run the service, which you can withdraw at any time without affecting your service.

4. Signing keys

This is the most important section on this page:

• If your stamp is on a USB token, the private key never leaves your machine. The Albatriq Signer runs on your computer, receives the document's bytes, signs them locally, and returns the signature only. We never receive your key and technically cannot.
• If you upload a certificate file (PKCS#12), it is stored outside the web root so it cannot be reached over HTTP, and its password is encrypted with a key held by the server.

5. Who we share data with

We do not sell your data, do not use it for advertising, and do not share it for marketing — neither yours nor your customers'. Sharing is limited to:

• Our hosting provider and the email provider we send notifications through, only as far as running the service requires, and under a contractual duty of confidentiality.
• A competent judicial or regulatory body, on a legally binding request — and we tell you unless the law forbids it.

6. Where data is kept

The data of this installation is held on its hosting provider's servers. If personal data has to move outside Saudi Arabia for an operational reason, it is done only as far as the Personal Data Protection Law issued by Royal Decree M/19, as amended, and its Implementing Regulations allows and with the safeguards it requires.

7. Keeping subscribers apart

Each subscriber is isolated from every other inside the platform: a user in one company cannot reach any record belonging to another — and this is enforced in the data access layer itself, not only in the interface.

8. How long we keep it

• Tax documents: kept for the period the laws of the Kingdom of Saudi Arabia requires books and records to be kept, which is six years. They cannot be deleted before then even at your request, because they are a tax record.
• Technical logs: trimmed regularly and not kept long; their purpose is diagnosing a live problem.
• The change history: kept while the account exists, because it is what answers "who changed this, and when".
• Account data: deleted within a reasonable time after the account is closed and the legal period has passed.

9. Your rights

Under the Personal Data Protection Law issued by Royal Decree M/19, as amended, and its Implementing Regulations you have the right to be informed about your data, to access it and obtain a copy, to correct it, to ask for its erasure, to object to its processing, and to withdraw consent. These rights are exercised within the legal obligation to retain tax records set out above.

We answer within a reasonable time, not exceeding what the Personal Data Protection Law issued by Royal Decree M/19, as amended, and its Implementing Regulations allows. You can change your company, user and customer data directly from the dashboard, and export your documents at any time. If our answer does not satisfy you, you have the right to complain to the competent supervisory authority in Saudi Arabia.

10. Children's data

The platform is a business tool for companies, is not offered to children, and we do not knowingly collect data from anyone under the legal age. If we learn otherwise the data is deleted.

11. Cookies

We use one session cookie, to keep you signed in, and it ends when the browser closes or you sign out. We use no tracking cookies, no advertising cookies and no third-party analytics. Your language choice is stored on your account so you find it as you left it. On the landing page at the main address, your country choice is stored in one cookie so we do not have to ask on every visit.

12. Security

Connections are encrypted over HTTPS. Passwords are hashed. API keys are stored hashed too, so they cannot be recovered from the database. Signing certificates are outside the web root and their passwords are encrypted. Secret values in the change history are recorded as having changed, without recording what to.

No system is absolutely secure. If a breach affects your personal data we will tell you and the competent supervisory authority without undue delay and within the period the Personal Data Protection Law issued by Royal Decree M/19, as amended, and its Implementing Regulations sets, describing what happened, what we expect the effect to be, and what we have done.

13. Changes to this policy

We may change this policy, and will tell you about material changes at your registered address a reasonable time before they take effect. The date of the last update is shown at the top of this page.

14. Contact

For any request or question about your data: privacy@albatriq.com, or support@albatriq.com.