Privacy Policy

1. Information We Collect

• Account Information: When you create an account using email and password, we collect your email address, full name, and a securely hashed version of your password. We never store passwords in plain text.
• Google OAuth Data: When you choose to sign in with Google, we receive your Google account email address, display name, and profile picture URL through Google OAuth 2.0. We do not access your Google Drive, Gmail, Google Contacts, Google Calendar, or any other Google service data. The only Google user data we access is your basic profile information (email, name, and profile picture) needed to create and identify your account.
• Company Information: You provide company details including company name (English and Arabic), Commercial Registration (CR) number, unified number, industry sector, entity size, and total headcount.
• Employee Data: You enter employee records including names, nationalities, employment types, monthly salaries, disability status, dual-employment status, and working hours. This data is used solely for Saudization percentage calculations and Nitaqat band classifications.
• Usage & Analytics Data: If you accept analytics cookies, we collect usage information such as pages visited, features used, browser and device type, and approximate region through Google Analytics. When you are signed in, these events are linked to your internal account ID (never your name or email) so we can understand how the product is used across devices. If you decline, Google Analytics stores nothing on your device and sends only cookieless, aggregate signals.
• Error Diagnostics: When something breaks, we receive an error report through Sentry with technical details (browser, page, the failing code) and your internal account ID. If the error happens in your browser, Sentry may also record a short replay of the screen leading up to it; all text and images in the replay are masked, so names, salaries and other content are not captured. If you choose to send us feedback through the in-app form, it includes the name and email you enter.

2. How We Use Your Information

• Perform Saudization calculations and Nitaqat band classifications based on the employee data you provide.
• Provide, maintain, and improve our services including dashboards, scenario planning, compliance snapshots, and reports.
• Authenticate your identity and manage your account access, team member permissions, and session security.
• Send you service-related communications including compliance alerts, subscription notifications, password reset emails, and important service updates.
• Google User Data: Your Google account information (email, name, profile picture) is used exclusively for creating your account, authenticating your identity, and displaying your profile within the application. We do not use Google user data for advertising, marketing, analytics profiling, or any purpose unrelated to providing our core service.

3. Google OAuth — Limited Use Disclosure

SaudizationMeter's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically: (a) We only request access to basic profile information (email address, display name, and profile picture) through Google OAuth 2.0. (b) We do not request access to any sensitive or restricted Google API scopes. (c) We do not use Google user data to serve advertisements. (d) We do not allow humans to read Google user data unless we have your affirmative agreement, it is necessary for security purposes, or it is required by applicable law. (e) We do not transfer Google user data to third parties except as necessary to provide or improve our service, as required by law, or as part of a merger or acquisition with adequate data protection provisions.

4. Data Sharing & Third Parties

• Google User Data: We do not sell, rent, lease, or trade your Google user data to any third party. Google-sourced profile data (email, name, profile picture) is stored exclusively in our database for account identification and is never shared with advertising networks, data brokers, or information resellers.
• Paddle: Processes subscription payments securely as our authorized payment processor and Merchant of Record. Paddle receives your email address and payment card details to process transactions. Paddle does not have access to your employee data, company information, or calculation results. See Paddle's privacy policy at paddle.com/legal/privacy for details.
• Vercel: Hosts our application infrastructure on a globally distributed edge network. Vercel processes HTTP request metadata (IP addresses, headers) for routing and performance but does not access your stored application data. Vercel maintains SOC 2 Type II compliance.
• Supabase: Provides our database (PostgreSQL) and authentication services. Supabase stores your account data, company data, and employee data with row-level security (RLS) policies. Supabase maintains SOC 2 Type II compliance and encrypts all data at rest and in transit.
• Google Analytics: We use Google Analytics 4 (GA4) to measure how the product is used (page views, feature usage, sign-ups and purchases). Analytics cookies are set only after you accept them; signed-in users are identified to Google Analytics by an internal account ID, never by name or email. Purchases are recorded from Paddle's payment confirmation, including the plan and amount. We never send employee data or company data to Google Analytics. Before consent, Google Analytics operates in a cookieless mode that stores nothing on your device.
• Sentry: Receives error reports and, when an error occurs in your browser, a masked screen replay, so we can find and fix bugs. Reports are linked to your internal account ID only. Sentry does not receive your employee data or calculation inputs in readable form.
• Resend: Delivers our emails — account confirmations, password resets, compliance alerts, monthly reports, and replies to messages you send through our contact forms. Resend receives the recipient's email address and the message content.

5. Data Storage & Security

• Encryption: All data is encrypted at rest using AES-256 encryption and in transit using TLS 1.3. Database backups are encrypted with the same standards.
• Row-Level Security: Our PostgreSQL database enforces row-level security (RLS) policies at the database level, ensuring each user can only access data belonging to companies they are a member of. This isolation is enforced on every database query, not just at the application layer.
• Access Controls: Team members are assigned roles (owner, admin, editor, viewer) with granular permissions. Administrative database access (service-role key) is restricted exclusively to automated webhook processing and is never exposed to client-side code.
• Infrastructure: Our application is hosted on Vercel (SOC 2 Type II). Our database is hosted on Supabase (SOC 2 Type II). All server-side input is validated using Zod schemas to prevent injection attacks. Authentication sessions are managed via secure, HTTP-only cookies.

6. Cookies & Tracking

We use the following categories of cookies and browser storage: (a) Essential: required for signing in, keeping you signed in, and remembering your language. These cannot be disabled because the service does not work without them. (b) Analytics: Google Analytics with Google Consent Mode. Before you accept, Google Analytics sets no cookies and stores no identifiers on your device; it sends only anonymous, cookieless measurement signals (page address, referrer, and an approximate region derived from your IP address, which is not stored). Analytics cookies are set only after you accept them in our consent banner, and declining has no effect on how the service works. We do not use advertising, remarketing, or behavioural tracking cookies. You can change or withdraw your choice at any time via 'Cookie settings' in the footer of any page; withdrawing removes the analytics cookies.

7. Data Retention & Deletion

• Active Accounts: We retain your data for as long as your account is active and you maintain an active subscription or free plan.
• Company Deletion: When you delete a company through the Settings page, all associated employee records, scenarios, scenario changes, snapshots, alerts, and audit logs are permanently and irrecoverably deleted via cascading database deletions.
• Account Deletion: You may request deletion of your entire account by contacting us at admin@saudizationmeter.com. Upon receiving your request, we will delete your account and all associated data within 30 calendar days. After deletion, we retain only anonymized, aggregated usage statistics that cannot be linked back to you.
• Google Data Revocation: You may revoke SaudizationMeter's access to your Google account at any time by visiting your Google Account permissions page at myaccount.google.com/permissions and removing SaudizationMeter. Upon revocation or account deletion, all Google-sourced data (email, name, profile picture) is permanently deleted from our systems within 30 calendar days.
• Deletion Requests: To request data deletion, export your data, or ask about data retention, email admin@saudizationmeter.com. We respond to these requests within 15 business days.

8. Your Rights Under Saudi PDPL

Under the Saudi Personal Data Protection Law (PDPL), you have the following rights regarding your personal data:

• Right of Access: You can view all your stored data (profile, companies, employees, scenarios, snapshots) through the application at any time.
• Right to Correction: You can update your personal information, company details, and employee records at any time through the application.
• Right to Deletion: You can delete individual companies and all associated data from the Settings page. For full account deletion, contact admin@saudizationmeter.com.
• Right to Data Portability: You can download a complete copy of your company data in a machine-readable format (JSON) from the Settings page at any time. Report exports (PDF, Excel, CSV) are available on paid plans.
• Right to Object: You may object to the processing of your personal data for any purpose other than providing the core service. Contact admin@saudizationmeter.com to exercise this right.
• To exercise any of these rights, contact us at admin@saudizationmeter.com. We will process your request in compliance with the Saudi PDPL within the legally required timeframe.

9. Children's Privacy

SaudizationMeter is a business-to-business (B2B) service designed for HR professionals and business owners. Our service is not directed at individuals under the age of 18. We do not knowingly collect personal data from minors. If we become aware that we have collected data from a person under 18, we will promptly delete that data.

10. International Data Transfers

Your data may be processed on servers located outside the Kingdom of Saudi Arabia by the service providers named in this policy — Supabase and Vercel (hosting and database), Sentry (error reports), Resend (email), Google (sign-in and analytics), and Paddle (payments) — which operate data centers in multiple regions. All transfers are protected by encryption in transit (TLS) and are conducted in accordance with the data transfer requirements of the Saudi PDPL.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or service features. We will notify you of material changes via email and/or a prominent in-app notification at least 14 days before the changes take effect. Your continued use of the service after the effective date constitutes acceptance of the updated policy. The "Last updated" date at the top of this page indicates when this policy was last revised.

12. Contact Us

If you have questions about this Privacy Policy, your personal data, Google OAuth data handling, or wish to exercise your data rights, please contact us at admin@saudizationmeter.com. We reply to general questions within 2 business days.