Privacy policy

Who is responsible for your data

Tarsido is responsible for the data about you as a user of the platform: your account, sign-in and usage data, and anything you send us through this website.

The business records a company keeps in Tarsido — its customers, suppliers, invoices, payments and expenses — belong to that company. For those records the company decides what is collected and why, and Tarsido processes them on the company's behalf and only to provide the service.

Data we collect

• Account data: your name, email address, password (stored only as a one-way hash), language, two-factor authentication settings, and the company and role you belong to.
• Company data: legal and trade names, commercial registration and VAT numbers, national address, phone, email, logo, bank account details (such as IBAN) and, when ZATCA e-invoicing is turned on, the company's e-invoicing certificates.
• Business records you enter: customers and suppliers (names, VAT numbers, addresses, contact details and, where Saudi e-invoicing rules require it, a customer's national ID), invoices, credit and debit notes, payments, expenses, receipt photos and attachments, imported bank statements, accounting entries and VAT returns.
• Payment data: when an invoice or a subscription is paid by card, the card details are entered on the page of our payment provider, ClickPay. We receive the result and transaction reference; we do not receive or store full card numbers.
• Technical and security data: IP address, browser or device type, sign-in times, and a log of actions taken in each workspace (the audit log).
• Mobile app data: photos you choose to take or pick to attach as receipts; a notification token for your device when push notifications are enabled; and a local copy of recently viewed data kept on your device so the app works offline. The app does not access your location or contacts, and it does not use advertising identifiers.
• Website forms: when you request a demo or contact us, we collect your name, company, email, phone, company size, message and IP address.

How we use data

• To provide the service: create and send invoices, record payments and expenses, keep the books, prepare VAT returns and produce reports.
• To meet Saudi e-invoicing and tax requirements, including sending invoices to ZATCA when your company turns this on.
• To process payments and subscription billing.
• To keep accounts secure: sign-in, two-factor authentication, permissions, fraud prevention and investigating misuse.
• To send service notifications, such as payments received, overdue invoices or VAT deadlines.
• To answer demo requests and support questions.
• To comply with legal obligations and requests from competent authorities.

What we don't do

We do not sell personal data, use it for advertising, or track you across other companies' apps and websites. This website and the app use only the cookies and local storage needed to sign in, stay secure and remember your language; there are no advertising or analytics cookies.

Who we share data with

We share data only as needed to run the service, with:

• The Zakat, Tax and Customs Authority (ZATCA), for invoices your company reports or clears through Tarsido.
• ClickPay, our payment provider, to process card payments.
• Contabo, which hosts our servers, and Cloudflare, which protects and delivers our website and app traffic.
• Google Firebase Cloud Messaging, to deliver push notifications to your device when they are enabled.
• An email delivery provider, to send account and service emails.
• Other users in your company's workspace, according to the roles and permissions the account owner sets.
• Authorities, when the law requires it.

Where data is stored

Tarsido's servers are hosted by Contabo in France (European Union), and traffic passes through Cloudflare's global network. This means data is transferred outside the Kingdom of Saudi Arabia. We make these transfers in line with the PDPL and its regulations, using providers with appropriate security safeguards.

How we protect data

Connections are encrypted (HTTPS). Passwords are stored as one-way hashes, two-factor authentication is available, each company's data is kept separate from other companies, access follows each user's role and permissions, uploaded files are stored privately, and important actions are recorded in the audit log. We take regular backups. No system is completely secure, and we will notify affected users and the authorities of a data breach as the law requires.

How long we keep data

We keep data while the account is active. Invoices and other tax records are kept for as long as Saudi law requires (for VAT records, at least six years). When an account is closed, we delete or anonymise its data within 90 days, except records we must keep by law. Copies in backups are removed as the backups expire.

Your rights

Under the PDPL you have the right to:

• Be informed about how your data is collected and used.
• Access your data and receive a copy of it.
• Ask us to correct or complete inaccurate data.
• Ask us to delete your data when it is no longer needed, subject to what the law requires us to keep.
• Withdraw consent where we rely on it.
• Complain to the Saudi Data and Artificial Intelligence Authority (SDAIA).

Deleting your account

The account owner can ask us to close the company's account and delete its data by contacting us at the email below from the account's email address. We confirm the request and complete it within 30 days, keeping only what the law requires. Customers and suppliers of a company that uses Tarsido should contact that company first, since it controls their records.

Children

Tarsido is a business service and is not intended for anyone under 18.

Changes to this policy

We may update this policy. We will change the date at the top and, for significant changes, tell account owners by email or in the app.

Contact us

For privacy questions or requests, email [email protected]. For anything else, email [email protected]. We reply within 30 days.