Privacy Policy

1. Introduction

Hisaabii is a Saudi Arabia / GCC-focused SaaS platform for ZATCA-oriented invoicing and business management. This Privacy Policy describes how we collect, use, and share information when you use our web and mobile applications and related services (the “Service”).

By creating an account or using the Service, you acknowledge the practices described here. If you do not agree, please do not use the Service.

2. Information we collect

Account and profile data: name, email address, password (stored hashed), language preference, and similar account settings.

Business profile data: company names, VAT/tax identifiers, commercial registration details, addresses, logos, stamps, signatures, bank details you choose to store, and related onboarding information.

Operational and financial records you create in the Service: clients/vendors, products and services, invoices and related documents (quotations, proposals, credit/debit notes, delivery notes, and similar), payments, expenses, HR and project records, uploaded files and OCR/document inputs, and activity logs tied to your workspace.

Technical and usage data: device/browser information, IP address, approximate location derived from IP, cookies or similar technologies, and diagnostic logs needed to operate and secure the Service.

Billing data: subscription plan, billing cycle, and payment status. Card details are collected and processed by Moyasar; Hisaabii does not store full card numbers on its servers.

3. How we use information

We use information to provide and improve the Service: authentication, workspace management, invoicing and document generation, ZATCA-related workflows you initiate, notifications, support, security monitoring, fraud prevention, and billing.

We may use aggregated or de-identified information that cannot reasonably identify you for analytics and product improvement.

4. Third-party processors we use

Moyasar — payment processing and subscription billing (including trials and receipts Moyasar generates for charges).

Hostinger email (SMTP) — transactional email delivery (for example OTP codes, invitations, billing notices, and document emails you send through the Service).

Hosting, database, and infrastructure providers that run the application environment. We require processors to handle data only as needed to provide their services to us.

Where you connect or submit data to ZATCA / Fatoora (or related official systems) through features we provide, those systems are operated by the relevant authorities under their own terms; we facilitate the technical flow you request.

5. Data retention

We retain account and business data while your account and companies remain active, and for a reasonable period afterward to meet legal, accounting, dispute, and security needs.

Invoice and related tax records may be subject to Saudi / ZATCA regulatory retention obligations that apply to your business. Those obligations are yours as the taxpayer; the Service stores records you create so you can operate and demonstrate compliance, but retention requirements for tax documents are not waived by deleting an app account alone. Contact us if you need an export before closing a workspace.

6. Cookies and similar technologies

We use cookies and similar technologies for session authentication, security, locale preferences, and essential product operation. Disabling essential cookies may prevent login or core features from working.

7. Your rights and choices

Depending on applicable law, you may request access, correction, or deletion of personal data we hold about you, or object to certain processing. Workspace owners can also update most business and user data directly in the product.

Some records cannot be fully erased where we must retain them for legal, regulatory, billing, or security reasons. We will explain limitations when you make a request.

8. Security

We implement administrative, technical, and organizational measures designed to protect information (including access controls, encryption in transit, and monitoring). No method of transmission or storage is completely secure; you are responsible for protecting account credentials and limiting access within your organization.

9. Children’s privacy

The Service is intended for business users and is not directed to children. We do not knowingly collect personal information from children.

10. Changes to this policy

We may update this Privacy Policy from time to time. We will revise the “Last updated” date and, when changes are material, provide additional notice through the Service or email where appropriate.

11. Contact

Privacy questions: privacy@hisaabii.com (placeholder — replace with your real contact before publishing as final policy).

If you are in Saudi Arabia or another GCC jurisdiction, include any locally required contact or complaint channels once your counsel finalizes this document.