Privacy Policy

Last updated: October 2026

1. Introduction

Tatbiq.store ("Platform," "we," "us," "our") is a multi-tenant Software-as-a-Service booking platform registered in the United States (Delaware). We serve service businesses (salons, clinics, gyms, training centres, home services) across Saudi Arabia, the UAE, and other GCC regions.

This Privacy Policy explains how we collect, use, store, and protect your personal data and your customers' data. By using Tatbiq.store, you agree to this policy.

2. Who we are and data controllers

• Platform operator: Tatbiq.store, a business registered in Delaware, United States, operating from infrastructure hosted on Vercel and a PostgreSQL database and file storage provisioned through Vercel.
• Your business (the data controller): When you use Tatbiq.store to serve your customers, you are the data controller for customer bookings, payments, and contact information. You decide what data to collect and how.
• Tatbiq.store (the data processor): We process that data on your behalf, under your instructions.

For Saudi Arabia operations: Tatbiq.store is not a Saudi entity. We comply with Saudi Arabia's data protection requirements to the extent applicable to non-resident processors.

3. Data we collect and why

3.1 Data you provide

• Business registration: Business name, legal name (Arabic and English), tax registration number (VAT number), commercial registration (CR), business address, contact phone, email.
• Tax invoicing (ZATCA, Saudi Arabia): VAT number, CR, building number, street, district, city, postal code. See Section 6 for what our ZATCA integration does today and what's planned.
• Bank and payment details (if payment collection is enabled): Bank account details or payment-gateway credentials, stored encrypted.
• Bookings and sales: Customer name, phone, email, service selected, date/time, amount paid, payment method.
• Staff: Staff names, phone, email, role, hourly rate (for payroll features).
• Customer accounts: to book, a customer confirms their email address by signing in with Google, with Apple where offered, or with a one-time code we email to them. We keep one Tatbiq account per customer (name, email, phone if given, and the Google or Apple account identifier) so they can see and manage their bookings with every business they have booked on Tatbiq. Each business sees only its own customer records and bookings, never what a customer booked elsewhere.
• Domain purchases: if a business buys a web address through Tatbiq, the registrant contact details it enters (name, address, email, phone) are sent to the domain registrar, as domain registration rules require.

3.2 Data collected automatically

• Login and usage: IP address, device type, browser, login timestamps, pages visited, feature usage.
• Transactional: Invoices generated, payments processed, refunds issued.
• Error monitoring: We log application errors and diagnostic information to help us find and fix bugs. These logs never include your password or full payment card details.
• Cookies and browser storage: we use a small number of functional cookies (to keep you signed in and to remember your language and light/dark preference) and browser storage for interface settings. We do not use advertising or cross-site tracking cookies. See our Cookie Policy for the full list.
• Push notifications: if a staff member turns on notifications in the staff app, we store a notification address for that device so we can send it short alerts (for example, a booking assigned to them). They can turn this off at any time in their browser or device settings.
• Staff clock-in location: when a staff member clocks in or out, the staff app asks the device for its location (the device asks the staff member first). If they allow it, we store the coordinates and the distance from the branch for that moment, so the business can confirm attendance and, if it chose to, require clocking in at the branch. We never track location in the background.
• Activity history: when the owner or a staff member changes something in the dashboard (a booking, a service, a customer, an invoice, a review, a setting), we record who made the change and when. The business owner can see and search this history.

3.3 Why we collect it

• Service delivery: To run your booking system, process bookings, and generate invoices.
• Tax compliance: To generate compliant invoices and, where enabled, the QR codes Saudi Arabia requires on simplified tax invoices.
• Security and fraud prevention: To detect unauthorized access and payment fraud.
• Performance and reliability: To monitor uptime, fix bugs, and improve the platform.

4. How we use your data

• Booking operations: Display available times, confirm bookings, send reminders to customers, process payments.
• Invoicing and tax reporting: Generate invoices, compute VAT, embed the ZATCA-required QR code, and — for a business that has connected its ZATCA account — cryptographically sign and report invoices to ZATCA (see Section 6).
• Analytics: Aggregate, anonymized usage to improve the platform (we do not sell individual usage data).
• Legal compliance: To comply with Saudi Arabia, UAE, United States, and EU (GDPR) legal requirements.
• Communication: To send you service updates, security alerts, and feature announcements (you can opt out of non-critical emails).

5. Data storage and encryption

5.1 Where data is stored

• Application data (bookings, customers, staff): a PostgreSQL database hosted on infrastructure provisioned through Vercel.
• Files and invoices: Vercel Blob storage, kept private and retained for as long as required by Section 10's retention table.
• Backups: encrypted daily backups retained for 30 days.
• Location: the database and the servers that run Tatbiq are in Frankfurt, Germany (European Union). Using Tatbiq therefore means your data is stored outside Saudi Arabia. We rely on this provider's security and contractual safeguards, and we handle these transfers as the Personal Data Protection Law (PDPL) and its regulations require. Pages served from Vercel's global network may be delivered from a location near the visitor.

5.2 Encryption

• Sensitive fields at rest: encrypted with AES-256-GCM. This includes payment-gateway credentials, staff bank details, and two-factor authentication secrets.
• In transit: all data in transit uses TLS encryption (HTTPS).
• Keys: encryption keys are managed as server-side secrets and are not exposed to your browser or embedded in any client-facing code.

5.3 Who has access

• Your team: only team members you invite can access your data, with role-based permissions (owner, staff, and custom roles you define).
• Tatbiq.store engineers: access is limited, logged, and only for debugging with your permission or a legal requirement.
• Third parties: we do not sell your data. We share it only with the service providers in Section 8 that help us run the platform, with systems you connect yourself (Section 8.1), or if required by law.

6. Tax invoicing and Saudi Arabia (ZATCA) compliance

What's live today: Tatbiq.store generates the QR code required on Saudi Arabia's simplified tax invoices (ZATCA Phase 1) for every VAT-registered business. We also offer full ZATCA Phase 2 e-invoicing integration as an opt-in feature: once you connect your business's ZATCA account (using a one-time code from your own ZATCA/Fatoora portal login), we generate a dedicated cryptographic signing key for your business, exchange it with ZATCA for a signing certificate, and from then on automatically sign and report each simplified tax invoice to ZATCA's servers on your behalf, in the background. Your business's private signing key never leaves our servers and is encrypted at rest; it is used only to sign your own business's invoices.

Not yet covered: standard (B2B) tax invoices — those showing a buyer's VAT number — are not yet automatically reported or cleared with ZATCA; that requires ZATCA's separate Clearance process, which we have not built support for yet. Phase 2 reporting also only starts once you've connected your business's own ZATCA account — until then, you remain responsible for any ZATCA obligations that apply to your business through whatever means you currently use. We also track the revenue thresholds and deadlines that determine when a business becomes subject to ZATCA's Phase 2 requirements, so you can plan ahead of your own deadline.

Your VAT number, CR, and address are embedded in every invoice QR code and PDF we generate, as Saudi Arabia's invoicing rules require.

7. Your rights

7.1 Access and portability

You may request a copy of all data we hold about your business at any time. We will provide it within 30 days in a machine-readable format (CSV, JSON).

For customer data: you own it. The business owner can download a complete export at any time from the dashboard under Settings → Export your data — a ZIP of spreadsheet-ready CSV files covering customers, bookings, payments, invoices, staff, expenses, and more. It leaves out passwords, access tokens, and payment credentials. Each download is recorded in your audit log.

7.2 Deletion and retention

• Your data: you may ask us to delete your business account and all associated data at any time by emailing support@tatbiq.store from your account email. We act on verified requests within 30 days, subject to the retention periods in Section 10. You can also delete individual customer records yourself from the dashboard.
• Tax invoices: invoices are retained per the schedule in Section 10 and cannot be deleted on request, as required by Saudi Arabia's VAT record-keeping rules.
• Backups: deleted data may remain in backups for up to 30 days.
• Aggregated analytics: we retain anonymized, aggregated usage data indefinitely (this cannot be traced back to you).

7.3 Data subject requests (GDPR, Saudi Arabia)

If you or a customer are in the EU or otherwise subject to GDPR, you have the right to request access, correction, deletion, or restriction of processing. Contact us at support@tatbiq.store with proof of identity, and we will respond within 30 days.

For Saudi Arabia residents: you have rights under the Kingdom's Personal Data Protection Law (PDPL), including the right to know how your data is used and to request access to it, correction, and deletion. Use the same email address above. If you believe we've violated your data rights, you may also lodge a complaint with the Saudi Data & AI Authority (SDAIA).

8. Third-party services and integrations

• Vercel (hosting): we use Vercel for compute and storage. Vercel's privacy policy: vercel.com/legal/privacy.
• Upstash (rate limiting and caching): upstash.com/privacy.
• Resend (email): we use Resend to send transactional email such as booking confirmations, reminders, receipts, and account emails, and campaign email that a business sends to its own customers. Recipient email addresses and message content pass through Resend. resend.com/legal/privacy-policy.
• Google: (a) if you, or a customer booking with you, choose "Sign in with Google", Google shares the name and email address with us; (b) a business's public booking page can show an embedded Google Map of its address, and loading that map sends your IP address and browser details to Google; and (c) some booking pages load fonts from Google Fonts, which likewise sends your IP address to Google. Google's privacy policy: policies.google.com/privacy.
• Apple: where "Sign in with Apple" is offered and chosen, Apple shares the name and email address (which may be a private relay address) with us. Apple's privacy policy: apple.com/legal/privacy.
• Browser push services: staff notifications are delivered through the push service of the device's browser (for example Google, Apple, or Mozilla). The service receives the encrypted notification and the device's notification address, but cannot read the message.
• Domain registrar: domains bought through Tatbiq are registered through Vercel's domain service, which receives the registrant contact details (Section 3.1).
• OpenStreetMap (maps in the dashboard): when a business picks a location on the map in its settings, map tiles are loaded from OpenStreetMap servers, which receive your IP address.
• Receipt reading: when a business uses "Read receipt" on an expense, the receipt image or PDF is sent through Vercel's AI Gateway to an AI model that reads the vendor, date and amounts. The result is shown to the person for checking before anything is saved. The receipt is not used to train the model.
• Payment providers: if you connect Stripe, Tap Payments, or another payment provider, their privacy policies apply to the payment data they process.
• ZATCA (tax authority): for a business that has connected its ZATCA account (Section 6), invoice submissions go directly to ZATCA's servers. ZATCA's use of that data is governed by Saudi Arabia's tax authority policies.

8.1 Systems you connect (API and webhooks)

A business can create API keys and webhook endpoints in Settings → API and webhooks. An API key lets a system the business chooses read its bookings, customers, services and staff, and update its bookings. A webhook sends booking and customer details (including customer names, emails and phone numbers) to an address the business chooses, whenever a booking is made or changes. We send this data only because the business tells us to. Once it reaches the business's chosen system, that system's owner is responsible for it, and the business should only connect systems it trusts.

We store API keys only as one-way fingerprints, so they can't be read back, and we store webhook signing secrets encrypted. Every webhook delivery is signed so the receiver can check it came from us, and is only sent to public https addresses. A business can revoke a key or remove an endpoint at any time, and it stops working at once.

9. Security measures

• Encryption at rest and in transit (see Section 5).
• Role-based access control: only authorized team members can access data.
• Audit logging: sensitive operations (login, data access, payment processing) are logged.
• Regular security review of the platform.
• Incident response: if we detect a breach, we will notify affected businesses within 24 hours.
• No public database access: our database is not reachable directly from the public internet.

10. Data retention

11. Children

Tatbiq is a tool for businesses and is not directed at children. Business accounts and staff accounts are for adults. A business may take bookings for children (for example a parent booking for their child); in that case the business decides what it collects and is responsible for having the parent's or guardian's permission.

12. Changes to this policy

We may update this Privacy Policy occasionally to reflect changes in law or our practices. We will notify you of material changes by email and, where required by law, ask for your consent.