Privacy Policy

1. Introduction

Welcome to Shagaly Cloud ERP ("we", "our", or "us"), operated under the Shagaly platform ecosystem in the Kingdom of Saudi Arabia. We provide cloud-based Point of Sale (POS), inventory management, and enterprise resource planning software to commercial businesses across KSA.

This Privacy Policy explains how we collect, use, disclose, store, and safeguard your personal data and commercial records when you access or use our website (shagaly.com), web application, mobile applications, or connected APIs.

2. Information We Collect

To provide high-performance ERP services and maintain ZATCA compliance, we collect the following types of information:

A. User & Business Identity Data

• Account Registration Details: Full name, commercial business name, Commercial Registration (CR) number, VAT registration number, contact email address, phone number, and physical branch address in Saudi Arabia.
• User Credentials: Passwords, user roles, security authorization tokens, and active session identifiers.

B. Commercial & Operational Data

• Transactional Records: Customer sales invoices, point-of-sale receipt logs, purchase orders, inventory levels, supplier contact details, and price catalog data stored in your tenant database.
• ZATCA E-Invoicing Data: Cryptographic stamps, Phase 1 & Phase 2 QR codes, sequential invoice UUIDs, and tax submission XML files generated for submission to the Fatoora platform.
• Financial & Payment Metadata: Payment processing references (MADA, Visa, Mastercard, Apple Pay, cash register shift totals). We do not store full credit/debit card PINs or CVVs.

C. Technical & Diagnostic Logs

• IP addresses, device type, browser specifications, login timestamps, operating system version, thermal printer hardware IDs, and system performance audit logs.

3. Legal Basis & How We Use Your Data

We process personal and commercial data strictly for legitimate operational and legal purposes under Saudi law:

• Service Delivery: To provision, maintain, and optimize your cloud ERP instance, POS terminals, multi-branch syncing, and store operations.
• Regulatory Compliance: To generate ZATCA-compliant 15% VAT tax invoices and transmit required e-invoicing data to Saudi government portals as mandated by law.
• Account Security: To authenticate users, prevent unauthorized access, detect fraudulent sales activity, and enforce role-based access permissions.
• Customer Support & Training: To respond to technical tickets, troubleshoot POS hardware compatibility (printers/scanners), and perform system updates.
• Payment Processing: To enable smooth subscription renewals and local gateway transactions.

4. Data Sovereignty & Local Hosting

In accordance with Saudi Arabian data localization guidelines and SDAIA standards, all primary customer database records, ZATCA XML files, and transactional logs are hosted on secure, highly available cloud server infrastructure maintained within accredited cloud data centers inside or fully compliant with the Kingdom of Saudi Arabia.

5. Third-Party Data Disclosures

We do not sell, rent, or trade your personal or commercial data. Data is only shared under the following conditions:

• Regulatory & Tax Authorities (ZATCA): Electronic invoice metadata, tax numbers, and transaction summaries are securely transmitted to the Zakat, Tax and Customs Authority (ZATCA) as legally required for Phase 2 Fatoora compliance.
• Authorized Payment Gateways: Transaction amounts and payment tokens are processed via licensed Saudi payment partners (MADA, Apple Pay, acquiring banks) to execute payments.
• Sub-processors & Cloud Partners: Trusted infrastructure providers who host our platform under strict non-disclosure and data protection agreements.
• Legal Enforcement: If required by valid court order, Saudi ministry directive, or law enforcement demand under KSA jurisdiction.

6. Your Data Subject Rights (KSA PDPL)

Under the Saudi Personal Data Protection Law, registered users in Saudi Arabia hold the following rights regarding their personal data:

• Right to Know / Access: You have the right to request a copy of the personal data we hold about you and your registered business account.
• Right to Rectification: You may request the correction or updating of any inaccurate or incomplete personal or commercial records.
• Right to Erasure / Destruction: You may request the deletion of your account personal data, subject to statutory tax retention requirements mandated by Saudi tax laws (e.g., ZATCA mandatory invoice retention periods).
• Right to Withdraw Consent: You may withdraw consent for optional marketing communications at any time.

To exercise any of these rights, please contact our Data Protection Officer at privacy@shagaly.com.

7. Data Security & Retention

We enforce enterprise-grade administrative, technical, and physical security measures, including:

• 256-bit SSL/TLS encryption for all data in transit across web browsers, POS terminals, and servers.
• AES-256 encryption at rest for sensitive database fields.
• Regular automated offsite backups and vulnerability assessments.

Retention Period: Commercial transactional and e-invoicing data is retained for the minimum statutory period required under Saudi Arabian tax and commercial regulations (typically 5 to 6 years), after which data is safely anonymized or permanently destroyed.

8. Cookies & Tracking Technologies

Shagaly Cloud ERP uses essential session cookies and analytical local storage items to maintain active cashier login sessions, save local user interface preferences (Arabic/English toggle), and analyze portal performance. You can control cookie preferences in your web browser settings.

9. Updates to This Policy

We may update this Privacy Policy periodically to reflect technological advancements, updates to Shagaly Cloud ERP features, or new regulatory guidelines issued by SDAIA or ZATCA. Any changes will be posted on this page with an updated "Effective Date".

10. Contact Information

If you have any questions, concerns, or data protection requests regarding this Privacy Policy, please reach out to our legal and technical team: