Privacy Policy — سياسة الخصوصية

1. About SidrFlow

SidrFlow ("we", "us", "our") is a POS settlement and reconciliation platform for merchants in Saudi Arabia. We help merchants automatically reconcile their point-of-sale transactions against bank settlements via WhatsApp and a web dashboard.

2. Information We Collect — المعلومات التي نجمعها

• Account information: Business name, commercial registration number, phone number, and email.
• Transaction data: POS transaction files and bank settlement files you upload for reconciliation.
• Receipt images: Photos of POS receipts you upload or send via WhatsApp. These are processed by AI models to extract transaction details (amount, terminal ID, card network, approval code, etc.).
• WhatsApp messages: Messages sent to our WhatsApp Business bot, including files and images you share for processing.
• Payment information: Plan subscription and invoice data processed through our payment provider. We never store or handle raw credit card numbers.
• Usage data: Log data, IP addresses, device information, and error reports for security, debugging, and service improvement.

3. How We Use Your Information

• To provide and operate the SidrFlow reconciliation service.
• To process POS and bank files and generate reconciliation reports.
• To send automated WhatsApp notifications and reconciliation summaries.
• To improve our platform and customer support.
• To comply with legal obligations under Saudi law.

4. WhatsApp Business Integration

SidrFlow uses the WhatsApp Business API (Meta) to receive and send messages on your behalf. By using our WhatsApp bot, you consent to your messages being processed by SidrFlow and Meta in accordance with WhatsApp's Privacy Policy. We do not sell or share your WhatsApp messages with third parties except as required to operate the service.

5. Data Storage & Security

Your data is stored securely using Supabase (hosted on AWS) with row-level security policies. We use industry-standard encryption (TLS) for all data in transit. Transaction files are stored only as long as needed for reconciliation purposes.

6. Data Sharing

We do not sell your personal data. We use third-party service providers for hosting, payments, messaging, AI processing, and error monitoring — solely to operate and improve SidrFlow. These providers process your data on our behalf and are contractually bound to protect it. We may also disclose data when required by Saudi law (PDPL — نظام حماية البيانات الشخصية).

لا نبيع بياناتك الشخصية. نستخدم مزودي خدمات خارجيين للاستضافة والمدفوعات والرسائل والمعالجة الذكية ومراقبة الأخطاء — فقط لتشغيل وتحسين سدر فلو. قد نفصح عن البيانات عند الطلب بموجب نظام حماية البيانات الشخصية.

7. Your Rights — حقوقك

Under Saudi Arabia's Personal Data Protection Law (PDPL — نظام حماية البيانات الشخصية), you have the right to:

• Access: Request a copy of all personal data we hold about you.
• Correction: Request correction of inaccurate data.
• Deletion: Request permanent deletion of your account and all associated data. You can do this directly from your dashboard settings, or by contacting us.
• Portability: Request an export of your data in a portable format.

To exercise these rights, contact us at support@sidrflow.com.

8. Contact Us — تواصل معنا

SidrFlow — Saudi Arabia
Email: support@sidrflow.com
WhatsApp: Available through the platform