Privacy Policy

This policy explains how Tawthiq collects, uses, stores, discloses, retains, and deletes personal data, and how data subjects may exercise their rights, in line with the Saudi Personal Data Protection Law and its Executive Regulations.

Tawthiq is a privacy compliance platform for businesses, available at https://tawthiq.tech. It provides a consent banner for a business’s website, records the consent its visitors give, scans the website for trackers, receives data subject requests, and generates and hosts its privacy policy and cookie policy.

Who this policy covers

  • Our customers and the people who use an account: this policy covers you. We decide why and how this data is processed, so we are the controller.
  • Visitors to tawthiq.tech: this policy covers you too.
  • Visitors to a website that uses Tawthiq, and people who send that website a data request: the business that runs the website is the controller, and we process your data for it. Its own privacy policy covers you, and your requests go to that business. See “Data we process for our customers” below.

Controller identity and contact details

  • Entity name: Moussaab Elouahmani, trading as Tawthiq

  • Privacy and rights contact: contact@tawthiq.tech

Personal data we collect

We collect only the personal data we need to provide the service, run it, and meet our legal obligations.

  • Account data: name, email address, profile image when your sign-in provides one, account identifier, language, and the time you last used the service.
  • Business and site data: business names, the website address, the commercial registration number and official address when you enter them, the contact email for data requests, and the answers you give when you create your privacy and cookie policies.
  • Subscription data: your plan, its status and dates, the billing email, and the customer and subscription identifiers Paddle gives us. Paddle holds your card and payment details. We never receive them.
  • API keys: the name you give a key, the time it was last used, and a one-way hash of the key. We do not store the key itself.
  • Technical and security data: IP address, browser and device information, request logs, counters we use to limit abuse, and error reports.
  • Messages: what you send us by email when you ask for support.

How we collect your personal data

1. Direct collection

  • From you, when you create an account, add a site, answer the questions for your privacy and cookie policies, subscribe, or contact us.

2. Indirect collection

  • From Clerk, which handles sign-in, when you sign in with an email or another account you already have.
  • From Paddle, which tells us the status of your subscription.

Whether providing data is mandatory or optional

  • Account data, the website address and the subscription data for a paid plan are mandatory. Without them we cannot open the account or provide the plan.
  • The commercial registration number, official address, profile image and the optional answers to those questions are optional.

Cookies and similar technologies

  • Sign-in and account pages use necessary authentication cookies from Clerk to keep your session and protect your account. Clerk is not loaded on our public pages, hosted legal documents, or public data request forms.
  • The dashboard sets one necessary cookie that remembers the last site you opened. It also keeps display preferences and unsaved drafts in your browser’s own storage, which is not sent to us.
  • We do not use analytics or advertising cookies on tawthiq.tech.

Direct marketing and non-essential messages

  • We send service messages only: sign-in codes, alerts about data requests and their deadlines, and links to your consent exports.
  • We do not use personal data for direct marketing. If that changes, we will update this policy and meet the legal requirements first.

  • Purpose: Creating accounts, providing the service, and managing our relationship with the customer. Related data categories: account data, business and site data, API keys Legal basis: Performance of an agreement to which the data subject is a party, or taking steps requested by the data subject before entering into that agreement. Recipients: Clerk, Convex, Cloudflare, Amazon Web Services. Retention rule: Until you delete the account or the site.

  • Purpose: Handling subscriptions, renewals, cancellations and refunds. Related data categories: subscription data, account email Legal basis: Performance of an agreement to which the data subject is a party, and compliance with legal obligations for financial records. Recipients: Paddle, Convex. Retention rule: Until you delete the account. Paddle keeps payment records for the periods its own legal obligations require.

  • Purpose: Securing the service, limiting abuse, and finding and fixing errors. Related data categories: technical and security data Legal basis: Our legitimate interest in keeping the service secure and working, which does not override the rights and interests of the data subject. No sensitive data is involved. Recipients: Cloudflare, Sentry. Retention rule: Up to 90 days.

  • Purpose: Answering support requests and legal or contractual notices. Related data categories: account data, messages Legal basis: Performance of an agreement to which the data subject is a party, or taking steps requested by the data subject. Recipients: Amazon Web Services. Retention rule: Up to 2 years after the request is closed.

We do not later process personal data in a way that conflicts with the purpose it was collected for, unless a valid legal basis exists and the legal requirements are met.

Disclosure of personal data

We do not sell personal data. We disclose it only to the service providers below, each limited to what its task needs, and to a competent authority where the law requires it.

  • Clerk (United States): sign-in and account identity. It holds your email, name, profile image when provided, and session data, and sends sign-in links and codes.
  • Convex (United States): the application database. It holds account, business, site and subscription data.
  • Cloudflare (global network): hosting, delivery, storage and request logs for the website, the dashboard and the consent banner.
  • Amazon Web Services (United States and Ireland): sending service emails from the United States, and hosting our support mailbox in Ireland.
  • Paddle (United Kingdom): our reseller and Merchant of Record. It takes the payment and holds your payment details as a controller under its own privacy policy.
  • Sentry (Germany): error reports from our servers. A report holds the error, where it happened in our code, and the request method and path. It holds no cookies, headers, request bodies, query strings or user details.

Data we process for our customers

When a business uses Tawthiq on its website, we process personal data for it as a processor, under the data processing agreement in our Terms of Service.

  • Consent events: a random visitor ID, the consent choice and its time, the browser type, a partly masked IP address, and the banner version shown.
  • Data requests: the contact details and the text a person sends through the business’s request form, a verification code sent to their email, the messages sent about the request, and the sender’s IP address, kept briefly to limit abuse of the form.
  • Website scans: the pages and third parties we see when we scan the business’s website. A scan loads the website as a new visitor and does not collect data about real visitors.

We use this data only to provide the service to that business. Requests about it should go to the business. If one reaches us, we pass it on to the business.

Storage, hosting, and transfers outside the Kingdom

Our service providers store and process personal data outside the Kingdom of Saudi Arabia. We transfer only what the service needs, under the transfer conditions of the Law and its regulations.

  • Destination: United States Purpose: Sign-in, the application database, and sending email. Data categories affected: account data, business and site data, subscription data Recipients: Clerk, Convex, Amazon Web Services.

  • Destination: United Kingdom Purpose: Payments, subscriptions and refunds. Data categories affected: subscription data, account email, payment details you give Paddle Recipients: Paddle.

  • Destination: European Union (Germany and Ireland) Purpose: Error reports, and our support mailbox. Data categories affected: technical data with no user details, and the messages you send us Recipients: Sentry, Amazon Web Services.

  • Destination: Cloudflare’s global network Purpose: Hosting, delivery, storage and security of the service. Data categories affected: all categories above, in transit or at rest Recipients: Cloudflare.

Legal basis for transfer: the transfer is necessary to perform the agreement with the data subject and to run the infrastructure the service depends on, subject to the PDPL transfer conditions. Safeguards: contracts with each provider that require confidentiality and security, encryption in transit, and sending each provider only the data its task needs.

Retention and deletion of personal data

  • Account, business and site data: kept while the account exists. When you delete a site or your account, we delete all of its data. Deletion starts within hours and, for a large history, can take up to 30 days to finish.
  • Subscription data: kept while the account exists. Paddle keeps its own payment records for the periods the law requires of it.
  • Technical, security and error data: up to 90 days.
  • Support messages: up to 2 years after the request is closed.
  • Data we process for our customers: kept for the periods in our Terms of Service, or until the customer deletes it.

When a period ends, we delete the data or remove what identifies a person from it.

Protection of personal data

We apply organisational and technical measures suited to the data and its risks.

  • Encryption of data in transit.
  • Access limited to the people who run the service.
  • API keys stored as one-way hashes.
  • Error reports stripped of request and user data before they leave our servers.

Notification of personal data breaches

  • If a personal data breach could harm the data or the data subject, we notify the Saudi Data and AI Authority (SDAIA) within 72 hours of becoming aware of it, and complete any missing details as soon as possible.
  • If the breach could harm the data subject or conflict with their rights or interests, we notify them without undue delay, in clear language, with the risks, the measures taken and how to reach us.
  • For data we process for a customer, we notify that customer without undue delay so it can meet its own duty.
  • The incident contact for Tawthiq is contact@tawthiq.tech.

Children’s data

  • The service is for businesses and is not directed at children. We do not knowingly collect their personal data. If we learn that we have, we delete it.

Rights of the personal data subject

Under the Law and the Executive Regulations, you may have the following rights, depending on the circumstances:

  • The right to know how personal data is collected, the legal basis relied on, and the purposes of processing.

  • The right to access the personal data we hold and review it.

  • The right to request a clear and readable copy of personal data where technically feasible.

  • The right to request correction, completion, or updating of personal data.

  • The right to request deletion of personal data that is no longer needed, within the limits allowed by law.

  • The right to withdraw consent where processing relies on consent, without affecting prior lawful processing or any other valid legal basis.

These rights remain subject to the conditions, limits and exceptions the law sets.

How to exercise your rights

We may ask for more information to verify your identity or the scope of the request before acting on it.

Target period for complete rights requests: 30 days.

Complaints and objections

If you have a complaint about how we handle personal data, contact us first at contact@tawthiq.tech.

Target period for complete complaints: 30 days.

If you are not satisfied with the outcome, you may submit a complaint to the Saudi Data and AI Authority (SDAIA).

  • Saudi Personal Data Protection Law

  • Executive Regulations of the Personal Data Protection Law

  • Regulation on Personal Data Transfer outside the Kingdom

Updates to this policy

We may update this policy to reflect legal, operational, or technical changes. The updated version applies from the date it is published.

Last updated: 12 October 2026