سياسة الخصوصية

1. Who we are

This Privacy Policy explains how Shifai Global Company, a company registered in the Kingdom of Saudi Arabia under Commercial Registration No. 7051667835, trading as BytesRaw ("BytesRaw", "we", "us" or "our"), collects, uses, shares and protects personal data.

It applies to our websites, including bytesraw.com and fatoora.cloud, to our cloud products and professional services, and to our official accounts and applications on social media platforms.

For the business data that a customer enters into a cloud product such as Fatoora Cloud (for example, the details of that customer's own clients on its invoices), the customer decides how the data is used and we process it on the customer's behalf. If your data was entered by one of our customers, please contact that customer first.

2. Personal data we collect

Data you give us

• Contact and account details: name, email address, phone number, job title, password.
• Business details: company name, address, commercial registration number, VAT number, company logo, and documents you upload when ordering, such as a VAT certificate or commercial registration.
• Order and billing details: the plan, users and add-ons you order, invoices and payment status.
• Communications: messages you send us by email, WhatsApp, phone, contact forms, helpdesk tickets or live chat.

Data we collect automatically

• Technical data: IP address, browser and device type, language, pages visited, and the date and time of access.
• Usage and security logs of our products, such as sign-ins and actions taken in your account.
• Cookies, as described in section 10.

Data we receive from social media platforms

• When you interact with our official accounts (for example by following, commenting, mentioning, reacting or sending a message), we receive the information the platform makes available to the account owner: your public profile name, username or user identifier, profile picture, and the content and time of your interaction.
• Aggregated statistics about the reach of and engagement with our content, which do not identify you.

3. How we use personal data

• To provide, operate, secure and support our products and services.
• To process orders, issue invoices, collect payments and keep accounting records.
• To answer enquiries and support requests, and to respond to comments and messages on our social media accounts.
• To publish and manage content on our official social media accounts and measure how it performs.
• To send service notices, such as renewal, billing and security messages.
• To send marketing communications, where you have agreed to receive them. You can opt out at any time.
• To improve our websites, products and services.
• To prevent fraud and misuse, and to comply with our legal obligations.

4. Legal bases

We process personal data in line with the Saudi Personal Data Protection Law (PDPL) and its regulations, on one or more of these bases: your consent; the performance of a contract with you or steps taken at your request before entering into one; compliance with a legal obligation; and our legitimate interests in running, securing and improving our business, where these are not overridden by your rights.

5. Social media platforms and their APIs

We use applications connected to the official programming interfaces (APIs) of Meta (Facebook and Instagram), LinkedIn, TikTok, X and YouTube to manage our own official accounts: to publish posts and media, read and reply to comments and messages addressed to us, and read performance statistics.

• We access only the data that each platform permits and that is needed for these purposes.
• We do not sell data obtained from these platforms, and we do not share it with third parties except service providers who act on our instructions, or where the law requires it.
• We do not use data obtained from these platforms to build advertising profiles of individuals, or for any purpose unrelated to operating our accounts and answering you.
• We keep this data only for as long as needed for those purposes, and delete it when you ask us to. See Data Deletion.
• You can also remove content you posted, and control what you share with us, directly in each platform's settings.

Each platform also processes your data as an independent controller under its own privacy policy. Where we use YouTube API Services, the YouTube Terms of Service and the Google Privacy Policy apply.

6. Who we share personal data with

We do not sell personal data. We share it only with:

• service providers that host our systems or help us operate them, such as cloud hosting, email, messaging and payment providers, under obligations of confidentiality and security;
• government platforms and authorities where a product is built to send data to them at your instruction, such as invoices submitted to ZATCA through Fatoora Cloud;
• professional advisors, such as auditors and lawyers, where necessary;
• courts, regulators and public authorities, where the law requires it;
• a successor to our business, in the event of a merger, acquisition or reorganization, subject to this policy.

7. International transfers

Some of our service providers and the social media platforms operate outside the Kingdom of Saudi Arabia. Where personal data is transferred outside the Kingdom, we do so in line with the PDPL and its regulations on transfers, and take steps to keep the data protected.

8. How long we keep personal data

• Account and customer data: for the duration of our relationship with you, and afterwards for as long as needed to meet legal, tax and accounting obligations and to resolve disputes.
• Invoices and accounting records: for the period required by tax and commercial law.
• Enquiries and support requests: for as long as needed to handle them and keep a record of the service given.
• Data from social media interactions: for as long as needed to respond and manage our accounts, or until you ask us to delete it.

When data is no longer needed, we delete it or make it anonymous.

9. Security

We apply technical and organizational measures appropriate to the risk, including encryption in transit, access controls, and backups. No system is completely secure, so we cannot guarantee absolute security. If a breach affects your personal data, we will notify you and the competent authority where the law requires it.

10. Cookies

Our websites use cookies that are necessary for them to work, such as keeping you signed in and remembering your language. With your consent, we may also use cookies that measure how the websites are used. You can change your choice in the cookie banner or block cookies in your browser; some features may then not work properly.

11. Your rights

Subject to the conditions set by applicable law, you have the right to:

• be informed about how your personal data is collected and used;
• access your personal data and obtain a copy of it;
• ask us to correct, complete or update it;
• ask us to delete it when it is no longer needed (see Data Deletion);
• withdraw a consent you have given, at any time;
• object to marketing communications.

To exercise these rights, write to [email protected]. We reply within thirty (30) days. If you are not satisfied with our reply, you may complain to the Saudi Data and Artificial Intelligence Authority (SDAIA).

12. Children

Our products and services are intended for businesses. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, contact us and we will delete it.

13. Changes to this policy

We may update this Privacy Policy from time to time. The updated version is posted on this page with a new "Last updated" date, and we will give notice of material changes.

14. Contact us