Terms of Service

These Terms govern access to and use of Tawthiq, its website, and related digital services available at https://tawthiq.tech, together with any connected channels we use to deliver the service, manage accounts, provide support, handle billing, or communicate with users.

Tawthiq is a privacy compliance platform for businesses in the Kingdom of Saudi Arabia. It provides a consent banner for your website, records the consent your visitors give, scans your website for trackers, receives data subject requests, and generates, publishes and hosts your privacy policy and cookie policy in Arabic and English.

Scope and acceptance

Tawthiq is owned and operated by Moussaab Elouahmani, trading as Tawthiq (“we”, “us”). When you use the service, your agreement is with him.
Creating an account, using the website, starting a subscription, or continuing to use the service means you accept these Terms.
These Terms govern your use of Tawthiq itself. They do not replace the notices that you publish for your own visitors, customers, website, or application through the service.
The data processing agreement in these Terms applies to every plan, free included.

Eligibility and accounts

You must have the legal capacity to use the service, or sufficient authority to act for the organisation, team, or business using it.
You must provide accurate and current information when creating an account or a site profile.
The account holder is responsible for safeguarding credentials and for activity carried out through its account unless unauthorised use happened outside its reasonable control.

Sites and generated documents

The service allows customers to add sites, answer questions about how their business handles personal data, and generate, review, edit, publish, host, or download bilingual documents to the extent available in the product.
The customer remains responsible for reviewing each generated document before relying on it, publishing it, or presenting it to end users. The service is an operational drafting tool, not a law firm, and use of the service alone does not create tailored legal advice.
If you publish a document through a public path from the service, you remain responsible for the accuracy of the inputs you provided, the review of the published version, and linking that document correctly to your website, product, or application.

You install the banner by adding our script to your website. The banner blocks the vendors and scripts you set up in Tawthiq until the visitor consents, and records the visitor’s choice.
Each site has its own monthly page view cap, set by your plan and shown on the pricing page (enterprise by contract). Past the cap, the banner keeps showing and working for that site’s visitors, but their consent events are not recorded until the cap resets the next month.
On the free plan, the banner and hosted documents carry a small Tawthiq logo. Paid plans do not.
We scan your website to detect trackers that load before consent or after a visitor rejects them (“banner leaks”), and we report what we find in the dashboard.
We do not guarantee that your banner blocks every tracker. You control your website’s code: scripts added outside Tawthiq, or changed after a scan, can load before consent. Fixing a reported leak is your responsibility.

Every plan keeps full consent events (a random visitor ID, the choice, its time, the browser, a partly masked IP address, and the banner version shown) for 13 months from the event, then deletes them within the following month.
Before a month of consent events is deleted, we warn you in the dashboard on the starter plan, email the account owner a signed export of that month on the pro plan, and deliver that export to your own storage on the enterprise plan when you have set it up.
An export for a period older than 13 months cannot be generated again once those events are deleted. Bundles you already downloaded stay verifiable.
Every plan keeps the site’s compliance record (daily consent counts, scan results and published document versions) for 5 years. Your plan decides how far back you can see and export it.

Acceptable use and core obligations

The service may not be used unlawfully, in a way that infringes third-party rights, to submit misleading or malicious data, to disrupt the service, or to attempt unauthorised access to accounts or systems.
The service may not be used to imply legal review, approval, or regulatory endorsement that has not actually been obtained.
The customer remains responsible for its own legal compliance, the nature of its business activities, and any additional obligations imposed by sector-specific rules, contracts, or regulators.

Fees, subscriptions, and billing

Some features or usage limits may require a paid subscription under the plan and pricing shown at purchase time or in the account area.
Where a plan is recurring, the subscription continues on the displayed cycle until cancelled through the available account flow or the applicable billing provider.
Our order process is conducted by our online reseller Paddle.com. Paddle.com is the Merchant of Record for all our orders. Paddle provides all customer service inquiries and handles returns. Payments are also subject to Paddle’s own terms.
Refunds follow our Refund Policy: any subscription payment can be refunded in full within 14 days of the charge.
If a renewal payment fails, your plan stays as it is for 14 days so you can update the payment method. If the payment is still unpaid after 14 days, the account moves to the free plan.
Each plan allows a number of sites. When your account moves to a plan that allows fewer sites than it has, the sites beyond the limit are disabled. When you cancel, you choose the sites that stay. When the move follows a failed payment, the oldest sites stay.
On a disabled site the banner, the request form and the hosted documents stop, and nothing new is recorded. Its data stays in the dashboard to read and export, and follows the normal retention periods. Disabled sites come back when you upgrade to a plan that covers all your sites.
We may change plans, pricing, or usage limits in the future, and those changes apply to new periods or renewals after notice or display through the appropriate channels.

Intellectual property and licence

The service, interface, software, templates, methods, marks, and operational content related to it are owned by Tawthiq or its licensors.
We grant you a limited, non-exclusive, revocable licence to use the service for your internal business operations or your own document preparation within the scope allowed by your plan and these Terms.
This licence does not include any right to resell the service, copy it at scale, reverse engineer it, attempt to extract source code, or bypass technical or commercial limits except to the extent the law expressly allows.
Your business information, inputs, and commercial content remain yours or your licensor’s, depending on the relationship that applies to them.

Privacy and third-party services

Our handling of the personal data we need to create accounts, operate the service, handle billing, and provide support is governed by our Privacy Policy and the applicable laws of the Kingdom of Saudi Arabia. For that data we are the controller.
If you rely on an external service connected to your business activity, you remain responsible for that provider’s terms, policies, and suitability for your obligations and use case.

Data processing agreement

This section is the data processing agreement between you (the controller) and Tawthiq (the processor) under the Personal Data Protection Law and its Executive Regulations. It applies to the personal data of your visitors and requesters that we process for you.

What we process and why: consent events recorded by your banner, data subject requests submitted through your request form and the messages sent about them, and the pages and third parties seen when we scan your website. We process them only to provide the service to you.
Whose data: visitors to your website and people who submit data subject requests to you.
Data categories: random visitor IDs, consent choices and their time, browser type, partly masked IP addresses, the name, contact details and request text a requester submits, and a requester’s IP address, kept briefly to limit abuse of the request form.
Your instructions: we process this data only on your documented instructions, which are these Terms and the settings you choose in the dashboard, unless the law requires otherwise. We tell you if we think an instruction breaks the law.
Confidentiality: only people who need access to run the service have it, and they are bound to keep it confidential.
Security: we apply technical and organisational measures suited to the risk, including encryption in transit, access limited to the people who run the service, and partly masking visitors’ IP addresses before consent events are stored.
Sub-processors: we use Cloudflare (banner delivery, consent storage and archives), Convex (the application database) and Amazon Web Services (email). You authorise these. We tell you before we add or replace a sub-processor, and we bind each one to data protection terms no weaker than these.
Transfers outside the Kingdom: some sub-processors may process data outside the Kingdom of Saudi Arabia. We do so only under the transfer conditions of the law and its regulations.
Helping you: the service gives you tools to answer data subject requests and export consent evidence. We help you, as far as we reasonably can, with your requests, impact assessments and questions from the competent authority.
Breaches: we tell you without undue delay after we become aware of a personal data breach affecting your data, with what we know, so you can meet your own duty to notify the competent authority.
Retention: we keep the data for the periods in “Consent evidence and records retention” above, or until you delete it in the dashboard.
End of the service: when you delete a site or your account, we delete all of its data. The application records go at once. Deleting the consent events, compliance record and archived copies starts within hours and, for a site with a large history, can take up to 30 days to finish. Export what you need before you delete.
Information: on request, we give you the information you reasonably need to show that this section is being followed.

An enterprise customer may agree its own data processing terms with us in writing. Where they conflict, the signed terms apply.

Service changes, support, and availability

We may develop the service further, modify features or interfaces, change the available document types, adjust usage limits, or discontinue specific features where operational, technical, or legal needs require it.
Unless we agree in writing to a different service level, support is provided through our published channels based on the plan and the nature of the issue, and these Terms do not create a guaranteed response time or uninterrupted availability commitment.
We use reasonable care to apply appropriate technical and organisational measures to protect accounts and the service against ordinary risks, but we do not promise absolute security or that the service will always be uninterrupted or error-free.

Suspension or termination

We may suspend an account, restrict access, or terminate the service if there is a material breach of these Terms, unlawful use, a security risk, non-payment, or a legal need to protect the service, its users, or compliance obligations.
You may stop using the service or cancel a subscription from the account page at any time. The paid plan stays active until the end of the period already paid for, and refunds follow our Refund Policy.
When a subscription ends or access is terminated, you may lose access to the account, some features, hosted versions, or public paths, so you should take the steps you need before the available access period ends.
Provisions that should survive by nature, including intellectual property, confidentiality, accrued fees, liability limits, data processing, and dispute terms, remain effective to the extent necessary after termination.

Disclaimers and liability limits

The service is provided on an as-available basis, with reasonable professional care in operation and improvement.
We do not promise that every generated document will be sufficient by itself for every business model, sector, contractual relationship, or regulatory requirement without customer review based on the actual facts.
To the extent permitted by law, we are not liable for indirect or consequential loss, lost profits, lost opportunities, or effects resulting from inaccurate customer inputs, publication before review, trackers loaded outside the banner’s control, or use of the service outside its legitimate scope.
These Terms do not limit any mandatory rights or guarantees that apply under Saudi law where they must apply.

Governing law and disputes

These Terms are governed by the laws and regulations of the Kingdom of Saudi Arabia.
The competent courts in the Kingdom of Saudi Arabia have jurisdiction unless mandatory law or a negotiated contract requires a different path.
The Arabic version prevails if there is any conflict.

Notices and contact

Contractual notices, legal notices, and questions about these Terms or the service may be sent to contact@tawthiq.tech.
We may send operational or contractual notices to the email linked to the account or through the in-product interface when appropriate for the nature of the notice.

Updates to these Terms

We may update these Terms from time to time to reflect legal, operational, technical, or commercial changes.
The updated version becomes effective on the date it is published or the date stated in it, and continued use of the service after that effective date means acceptance.

Last updated: 12 October 2026