Privacy policy

Last updated: 4 June 2026

Booksara ("we", "us") provides a cloud accounting platform for businesses in Saudi Arabia. This policy explains what personal data we collect, why we collect it, how we protect it, and the rights you have under the Saudi Personal Data Protection Law (PDPL).

Our role

For your account data (name, email, phone, billing records) we act as the data controller. For the business records you enter into Booksara — customers, invoices, employees, payroll, bank details — you are the controller and we process that data only on your instructions to provide the service.

Data we collect

  • Account data: your name, email address, phone number, password (stored as a one-way hash), and two-factor authentication settings.
  • Business data you enter: company details, VAT registration numbers, customers, suppliers, invoices, estimates, bills, products, employees and payroll records, bank account details, and uploaded files such as logos and attachments.
  • Billing data: your subscription plan, invoices we issue to you, and payment status. Card details are entered directly with our payment provider and never touch our servers.
  • Technical data: IP address, browser and device information, sign-in history, and an audit log of significant actions in your account.

How we use it

  • To provide the service: hosting your books, generating ZATCA-compliant invoices, running payroll, and sending the emails and SMS you trigger (such as invoice delivery).
  • To bill you: processing subscription payments and issuing receipts.
  • To keep the platform secure: detecting fraud and abuse, enforcing two-factor authentication, and maintaining audit logs.
  • To support you: responding to support tickets and service communications.

We do not sell personal data, and we do not use your business records for advertising.

Data residency

Customer data is stored on infrastructure physically located in Saudi Arabia, in line with PDPL requirements on cross-border data transfer. Where a transfer outside the Kingdom is ever required, it is done only as permitted by the PDPL and its implementing regulations.

Who we share data with

  • Payment processing: subscription payments are handled by Moyasar, a Saudi-licensed payment gateway. We receive payment confirmations, not card numbers.
  • ZATCA: when you use Phase 2 e-invoicing, invoice data is submitted to the ZATCA Fatoorah platform as required by the e-invoicing regulations.
  • Delivery providers: email and SMS providers used to deliver the messages you send from the platform.
  • Error monitoring: technical error reports (without your business records) may be processed to keep the service reliable.
  • Authorities: where disclosure is required by Saudi law or a binding order.

Security

All traffic is encrypted in transit with TLS 1.2 or higher. Sensitive fields — SMTP passwords, ZATCA credentials, two-factor secrets — are encrypted at rest. Access to production systems is restricted, actions are audit-logged, and encrypted backups are taken regularly.

Retention

We keep your data for as long as your account is active. After an account is closed we delete or anonymise personal data within a reasonable period, except records we must keep to satisfy Saudi statutory obligations — for example, VAT regulations require invoicing records to be retained for a number of years.

Your rights

Under the PDPL you have the right to know what personal data we hold about you, to access and obtain a copy of it, to request correction of inaccurate data, to request deletion where retention is no longer justified, and to withdraw consent where processing is based on consent. To exercise any of these rights, email us at the address below. You may also lodge a complaint with the competent data protection authority in Saudi Arabia.

Cookies

We use first-party cookies that are necessary for the service to work: keeping you signed in, remembering your language, and protecting forms against cross-site request forgery. We do not use third-party advertising cookies on the platform. See our cookie policy for details.

Changes to this policy

If we make material changes to this policy we will notify account owners by email or an in-app notice before the changes take effect. The date at the top of this page shows when it was last revised.

Contact

Questions about privacy or your data: support@booksara.com