Scope & Regulatory Commitment
Our dedication to data security across the Kingdom and GCC
Welcome to Zaydak, the multi-tenant conversational and social commerce cloud platform. We understand the vital importance of data privacy for both merchants and shoppers, and we protect it using world-class engineering and regulatory standards.
This Privacy Policy applies to all users of our web storefronts, merchant management applications, and connected social and chat channels (Instagram, WhatsApp, and Telegram). It has been prepared in full alignment with the Saudi Personal Data Protection Law (PDPL) and its executive regulations.
Information We Collect
Transparent and purposeful data collection under data minimization
We adhere to the principle of data minimization, collecting only the information strictly required to operate your shop, fulfill orders, and provide responsive conversational commerce:
- Merchant Account Details: Full name, verified mobile phone number, email address, shop name, commercial register (CR) or freelance document, and Saudi bank IBAN for payout settlements.
- Shopper & Customer Data: Shopper full name, contact phone number, Saudi National Address (building, street, postal code, city), and conversation handles to deliver order invoices and tracking links.
- Payment & Billing Data: Transactions via Mada, Apple Pay, Visa, and Mastercard are processed directly by SAMA-authorized payment gateways. Zaydak never stores raw credit card numbers or CVV codes on its servers.
- Conversational Interactions: Customer messages directed to the in-store conversational bot are processed in real time solely to fulfill cart creation, verify inventory, and generate checkout links.
- Technical & Security Telemetry: IP addresses, device identifiers, session cookies, and security event logs to safeguard accounts from fraud and cyber threats.
How We Use Your Data
Lawful, bounded processing for commerce and platform reliability
We process data based on valid legal grounds (such as contract fulfillment, regulatory obligations, or explicit user consent) for the following purposes:
- Provisioning and hosting cloud storefronts, inventory management, and multi-branch catalog operations.
- Powering conversational bots across Instagram, WhatsApp, and Telegram to build instant, secure shopping carts.
- Coordinating logistics and shipping with verified carriers (SMSA, Aramex, SPL, DHL) via integrated gateway OTO.
- Issuing compliant electronic invoices and maintaining immutable ledger balances in halalas.
- Preventing fraudulent activities, maintaining platform uptime, and providing technical support.
AI Privacy & Tenant Data Isolation
Six-layer security framework preserving business confidentiality
As a conversational commerce SaaS, Zaydak employs an enterprise 6-layer security framework ensuring total tenant data isolation. Each store’s catalog, customer inquiries, and orders operate within an isolated context that cannot be accessed by other tenants.
Zero AI Training Guarantee
Zaydak strictly guarantees that your confidential business data, sales numbers, private messages, and customer identities are NEVER used to train public generative AI foundation models.
Data Sharing & Third Parties
Strict non-sale policy and essential operational sharing only
We never sell, rent, or trade personal data to advertisers or third-party data brokers under any circumstances.
Personal data is shared only with vetted operational partners to the minimum extent needed to execute orders:
- Couriers & Delivery Partners: Shipping address, customer name, and contact phone number to deliver shipments.
- Payment Gateways: Invoice amounts and tokenized references to process card and wallet charges securely.
- Secure Cloud Infrastructure: Tier-IV data centers compliant with regional cybersecurity regulations.
- Regulatory & Judicial Authorities: Disclosures strictly mandated by official court orders or Saudi governmental regulations.
Your Rights Under PDPL
Full autonomy over your personal information
Under the Saudi Personal Data Protection Law (PDPL), data subjects are entitled to comprehensive rights:
- Right to be Informed: Understanding how and why your personal data is collected and processed.
- Right of Access: Requesting access to or copies of your personal data stored by Zaydak.
- Right to Rectification: Correcting outdated, inaccurate, or incomplete information in your profile.
- Right to Erasure: Requesting the deletion of personal data when no longer needed, subject to statutory retention mandates.
- Right to Withdraw Consent: Withdrawing consent for optional non-essential processing at any time.
Data Retention & Security Architecture
End-to-end encryption and round-the-clock protection
We retain personal data only for as long as necessary to satisfy the purposes for which it was gathered, or as mandated by Saudi commercial and tax legislation (e.g. keeping electronic invoices for statutory audit periods).
We maintain state-of-the-art protections: TLS 1.3 transit encryption, AES-256 resting storage encryption, automated vulnerability scans, and continuous access monitoring.
Policy Updates & Direct Contact
Continuous refinement and direct communication channels
We may update this Privacy Policy periodically to reflect new features or evolving regulations. Notice of significant amendments will be delivered via email or dashboard notifications.
For any inquiries regarding data protection or to exercise your rights, please contact our Data Protection Office at: info@zaydak.com.