Version and effective date:
1. Scope and roles
This policy explains how Sary processes personal data when you use the website, merchant dashboard and WhatsApp sales services.
The merchant determines the purposes of processing customer data and remains responsible for a lawful basis and appropriate notice. Sary processes that data to provide the service according to the merchant’s settings and its legal obligations.
2. Data we process
Account and store information: name, email address, phone number, business name, account settings and consent records.
Operational data: products, orders, bookings, campaigns, usage logs, support records and security events.
Conversation and customer data connected by the merchant, which may include phone numbers, message content and media needed for replies and analytics.
Subscription and payment data such as amount, currency, status and reference identifiers. Sary does not store the full card number; the payment gateway processes card information under its own systems.
Technical data such as network address and browser type. We may retain one-way cryptographic fingerprints to evidence consent and limit abuse.
3. Purposes and legal bases
Creating the account, providing the service, subscription and support, processing payments and fulfilling contractual obligations.
Protecting the platform, preventing fraud, improving reliability and measuring performance based on legitimate interests without conflicting with data subjects’ rights.
Meeting accounting and regulatory requirements and responding to lawful requests.
Sending direct marketing only with separate consent, which can be withdrawn at any time through the privacy centre.
Forms identify information required to create an account or provide a service. Not providing it may prevent the relevant part of the service.
4. Providers and transfers outside the Kingdom
We may use providers for WhatsApp, AI, payments, hosting, email and monitoring, including Green API, OpenAI and Tap depending on the integrations the merchant enables.
We share what is necessary for the purpose and restrict access contractually and technically. Some processing may take place outside the Kingdom under applicable requirements and safeguards for personal-data transfers.
We do not sell personal data or share customer conversations with independent advertisers for their own marketing.
5. Protection and security
We use TLS in transit, strong password hashing, access controls, merchant data separation, security logs and secret-management procedures.
Sensitive secrets and financial records retained for legal reasons use authenticated encryption. We do not claim that every field or backup is encrypted in the same way.
No technology guarantees that all risks are eliminated. We review controls and handle incidents according to their nature and applicable notification obligations.
6. Data-subject rights
Applicable rights include being informed, access, receiving a copy in a clear and commonly used format, correction, requesting destruction, withdrawing consent and objection where applicable.
Account holders can download account data, manage marketing consent or submit a deletion request through the privacy centre. Identity verification may be required.
We record requests and work on them within 30 days after receiving a complete request. When necessary, the period may be extended by another 30 days with notice and reasons.
Requests concerning a merchant’s customer data generally start with the merchant as controller. Sary cooperates in carrying out a verified request.
7. Deletion and retention
We retain data for as long as necessary to operate the account or fulfil the purpose of collection, then delete or de-identify it under the retention schedule.
Once account deletion is confirmed, access, automated replies and the WhatsApp connection are stopped, and account and store data removal is scheduled. If automated processing fails, it may move to human review instead of incomplete deletion.
A minimum set of invoice and payment records may be retained in encrypted form for accounting obligations or legal claims and destroyed when the reason for retention ends.
Removal from backups may take until the scheduled replacement cycle. Backup use is restricted to recovery and security.
8. Direct marketing and cookies
Marketing-message consent is separate and optional. Withdrawing it does not affect essential service messages such as security and billing notices.
We use essential cookies for sessions, protection and preferences. If non-essential analytics are enabled, their options are presented as required by law.
9. Complaints and contact
Account requests can be submitted through the privacy centre. Use the contact page for enquiries, objections or complaints.
If a complaint is not resolved, the data subject may contact the competent data-protection authority in Saudi Arabia through its available official channels.
10. Updates
We may update this policy to reflect changes to the service or legal requirements. We display the version and effective date and request fresh consent when a consent-based purpose changes materially.