Privacy and Data Protection
Last updated: 1 Sep 2026
We respect your privacy and follow the principles of Saudi Arabia's Personal Data Protection Law and its implementing regulations. This policy explains what we collect, why, and how we protect it.
1. Our role
We are a processor for data your organization enters about its customers (your organization is the controller), and a controller for platform account data and enquiries received through this website.
2. What we collect
- Account data: name, work email, mobile, role and organization.
- Operational data: sign-in and action logs (who did what and when) — for security and audit.
- Payment data: we neither collect nor store it. Your card details travel from your browser to the payment processor directly; all we receive is the last four digits, the card type, the amount and the status — for billing and accounting.
- Content you enter: customers, deals, conversations and attachments — belonging to your organization; we access it only at your explicit support request or for a documented operational necessity.
- Contact form data: what you write in the “Contact us” form on this site.
3. Legal basis and purpose
We process data to perform our contract with you, for our legitimate interest in securing the service and preventing abuse, and with your consent where consent is required (such as marketing contact). We do not sell personal data, and we do not use your customers' content to train general AI models.
4. Artificial intelligence
When AI modules are enabled, only what the analysis requires is sent to the model provider your organization selects, and it is not used to train their general models under our agreements. On top of that, your organization controls privacy tokenization levels: at the default level, contact data (email, mobile, IBAN, national ID) is replaced with tokens before leaving our servers; at higher levels, customer and company names are tokenized and financial values become ranges — and the tokens are resolved back inside your organization's system only, so the AI provider never sees your customers' identity. What cannot be tokenized by nature (binary attachments, audio transcription) is blocked entirely at the strictest level rather than sent. You can switch these modules off entirely.
5. Sharing
We share data only with infrastructure and service providers necessary to operate (hosting, email, messaging, and payment processing via Moyasar), under contracts binding them to confidentiality and to processing for our purposes alone. We disclose to no one else except under legal order.
6. Retention and deletion
- What you delete moves to the restore bin for 30 days, then is erased.
- When your subscription ends, your data stays available for export for 60 days, then is deleted.
- You can export all your data at any time, without our permission and at no charge.
- Security audit logs are kept 12 months — they record actions, not content.
7. Security
- Full tenant isolation — each organization's data is its own, and we audit this regularly.
- Secrets (integration keys, mailbox passwords) encrypted per organization.
- Fine-grained permissions and a data scope per role, with a complete audit trail.
- All traffic encrypted in transit (TLS).
8. Your rights
You have the right to know what we process, access it, request correction, request destruction when no longer needed, and receive a readable copy. Contact hello@effistar.net and we respond within the statutory periods.
9. Cookies
We use only cookies necessary for the session and to remember your language preference. We place no advertising trackers on this site.
10. Transfers outside the Kingdom
Where operation requires a provider outside the Kingdom, this is done under the law's controls and with appropriate protection contracts, and is set out in the data-processing agreement with your organization.
11. Where data is stored
Your organization's data — customers, deals, correspondence, attachments — is stored on our servers in the Kingdom of Saudi Arabia. Backups stay in the same geography, encrypted at rest and in transit.
12. Isolation between organizations
Each organization is a separate record. No query in the system reads a record without an explicit constraint on the organization identifier, and no path exposes one organization's data to another's users — not in search, not in reports, not through the API. We audit this isolation on a schedule, not once at build time.
13. External connections
The system contacts no third party on its own. Every connection below does not work until you enable it with your own account and keys, and stops the moment you disconnect it.
| Service | What leaves | When | Whose account |
|---|---|---|---|
| Microsoft 365 / Outlook | Message body, attachments, recipient addresses | When you send mail or sync your mailbox | Yours |
| WhatsApp Business (Meta) | Message text, media, recipient number | When you send a message or an automation you enabled replies | Yours |
| AI assistant (Hibab) | The text you ask it to analyze and the deal fields it needs | When you request analysis or drafting | Ours, unless you connect your own key |
| Tender radar | Your search criteria only — no customer data | When the radar runs on your schedule | Ours |
| E-signature | The document and signer details | When you send a document for signature | Yours |
| Payment gateway | Invoice details — we never store your card number | When you pay a subscription | Ours |
| Your own mail server (SMTP) | Message body and attachments | When you send mail | Yours |
Your responsibility for the calls you enable
When you connect an account on an external service, you issue the instruction and we carry it out. It follows that:
- The third party's terms apply to you. Your use of WhatsApp, Microsoft or any other provider is governed by their terms and policies in addition to ours, and their suspension of your account is outside our control.
- The lawful basis for contact is yours. Having a lawful basis to contact the people you contact — and their consent where the law requires it — is your obligation, not ours.
- What leaves does not come back. A message delivered to a third party is not ours to recall; deleting it here does not delete it there.
- Cost and limits are yours. Your quota consumption and your provider's fees are settled with them, not with us.
We log every external call for you — when it left, where it went, and at which user's instruction — and the log is visible inside the system whenever you want to review it.
14. What we do not do
- We do not sell, rent, or share your data for marketing — not to a third party and not to another organization on the platform.
- We do not train AI models on your organization's content, and we do not use it to improve service for another customer.
- We do not look at your content except in two cases: a support request from you, or an operational necessity to fix a fault. Both are logged with the employee's name, time, and reason, and the log is yours on request. ---
Last updated: August 2026 · Data protection contact: hello@effistar.net