Policy
Privacy policy
Last updated 4 October 2026
This describes what we actually collect and what we do with it, on this website and inside the free invoicing and accounting product. It is written to be read, not to be survived.
What we collect, and only when you give it
If you send us an enquiry we collect your name, your company, and a phone or WhatsApp number, which is how we reply. An email address and a short message are optional; give them if you want to. There is no newsletter to join. The only other places that ask for personal information are the compliance map’s optional reminders and an account, both described below.
If you create an account
We store your name, your email address, the language you chose and your password, which the sign-in service keeps only as a one-way hash. If you add a passkey we store its public half. When you set up a company we store its legal name, VAT number, commercial registration and national address, and a contact number for it. The number is seen only by the company’s owners and head-office accountants and by Nizamics, never by your customers or branch staff; we use it to help you set up and use the product. We message you on WhatsApp only if you tick the box that allows it, and we record when you did; you can change the number or untick the box at any time in Company settings. The people you invite are stored by email address and role. We send account emails only: verification, password reset, invitations and security notices. Never marketing.
Your business data, and your customers’ data
When you use the invoicing and accounting product, you put your own records into it: your customers’ and suppliers’ names, VAT numbers and addresses, the contents of every invoice and note, your products and prices, and your ledger. That data is yours. For the personal data inside it, such as a buyer’s name on an invoice, you are the controller and Nizamics is a processor acting on your instructions: we store it, sign it, submit it to ZATCA and show it back to you. We do not use its contents for anything else. We do not sell it or mine it for marketing, and we contact your customers only to deliver a document you send them, as the section on documents sent through Nizamics below describes. It goes to an AI assistant only if you connect one, as the section on AI assistants below describes. Separately, if you allowed analytics, two of the milestones described under Analytics below are facts about your use of our service: that your company connected a ZATCA device to production, and that it issued its first invoice, each with the time it happened. They carry nothing from inside your records: no invoice contents or amounts, and nothing about your customers.
If your name is on an invoice issued through Nizamics
The business that invoiced you decides what is recorded about you and is the one to ask about it. If you write to us instead, we will pass your request to that business and help it respond. Note that a tax invoice is a legal record: Saudi VAT law requires the seller to keep it, so it cannot simply be deleted on request.
Documents a business sends through Nizamics
A business on a paid plan can send its customers a proforma, a quotation or a tax invoice by email through Nizamics. The email comes from documents@nizamics.sa on that business’s behalf, under its name and with its own address to reply to. It carries a private link to an online copy of the document and, if the business chooses, the PDF. For these documents and the people they are sent to, the business is the controller and Nizamics a processor acting on its instructions, as for the rest of its books. We keep the addresses a document was sent to, and the message with it, for ninety days so the business can see where it went; after that only the record that it was sent remains. When you send a document through Nizamics we record when its link is opened (the time, the country, view or download) to show you. We do not store the reader’s IP address or device. Opens by link previews and security scanners are left out where we can recognise them, and the email itself carries no tracking pixel. Anyone who has the link can open the document, so treat it as you would the document itself. The business can turn the link off at any time, and it stops working if the business’s plan no longer includes sending.
Signing keys
Each device you connect to ZATCA has a private key that stamps your invoices. It is generated on our server in Jeddah, stored encrypted, and used only to sign the documents you issue. No staff role and no customer role can read it through our systems, and it is never displayed, exported or sent anywhere.
If you connect an AI assistant
This is the one case in which your business data leaves the Kingdom, and it happens only by your choice. The connection is off for every company by default. We switch it on for a company only when its owner asks us to, and even then nothing is sent until a member of that company connects an assistant from their own account and approves it on a consent screen. From then on, whatever the assistant reads is sent to the vendor of the assistant that member chose, for example Anthropic for Claude or OpenAI for ChatGPT: balances, VAT figures, invoices and ledger entries, and with them your customers’ and suppliers’ names, VAT numbers and addresses. The assistant can reach only what that member’s own permissions allow, and signing keys are never sent. The vendor processes what it receives on its own servers outside Saudi Arabia, under its own terms and privacy policy, which you accept with the vendor and not with us; we do not control what it keeps or for how long. We choose no vendor for you, and we send nothing to any vendor on our own initiative. For your customers’ personal data you are the controller, so it is for you to make sure you have a lawful basis for this transfer before you ask for it to be switched on. To stop it, the member can revoke the connection, from Connected assistants in the dashboard or from the assistant itself, which ends its access within fifteen minutes; or the owner can ask us to switch the company’s setting off, which cuts off every assistant connected to that company. Revoking stops anything further being sent. It does not recall what the vendor has already received. We keep a log of the calls an assistant makes.
What we record about the visit itself
With your enquiry we store the page you sent it from, the site that referred you, and any campaign parameters in the address. That is how we know which advert or search brought you here. None of it identifies you.
Why we collect it
An enquiry: to reply to it. An account: to sign you in and to run the product for you. Business data: to do what you asked, which is issue, sign, submit and keep your invoices and books. The four account milestones described under Analytics, only if you allowed analytics: to measure which pages, searches and links bring businesses that go on to use the product. That is the whole purpose. We do not sell it, and we do not use it for advertising or add you to a marketing list. It is shared only with the parties named under “Who else can see any of it” below, and with an AI assistant only if you connect one.
Where it is stored — and where it is handled
Both are in Saudi Arabia, with one exception that you control: if you choose to connect an AI assistant to your books, what it reads is sent to that assistant’s vendor outside the Kingdom, as the section on AI assistants above describes. Analytics is the other thing that goes abroad, and only if you allow it: on the public pages and, if you then open an account, the four account milestones described under Analytics below. It carries none of the records listed here, only the fact that a milestone was reached and when. Everything else stays. Enquiries, accounts, invoices, ledgers and signing keys are all written to a database running in Oracle Cloud’s Jeddah region, and since September 2026 the software that handles them runs on that same machine in Jeddah. It used to run outside the Kingdom before writing the data back into it; that is no longer the case. We chose this over the more convenient option, which would have placed the data in Europe.
How long we keep it
Enquiries: twenty-four months, after which they are deleted. Every record carries its own deletion date from the moment it arrives, and a scheduled job that runs every week deletes the records whose date has passed, so an enquiry is gone within a week of that date without anyone having to remember. Tax invoices, notes and ledgers are different. Saudi VAT law requires them to be kept for at least six years, so we keep them for as long as the account is open. An owner can download a complete copy of the company’s records at any time from Company settings, and can close the company from the same screen: it becomes read-only at once, and 30 days later we delete every record and every stored document, followed by the copies of those documents in our backups; any owner can cancel during those 30 days, and our encrypted database backups expire on their own within 90 days after the deletion. Keeping tax invoices and ledgers for six years, as Saudi VAT law requires, is the taxpayer’s duty, which is why the download comes first. Account details are kept while the account is open and removed after closure.
Reminder emails from the compliance map
If you turn on reminders in the compliance map, we store three things: your email address, the answers you gave, and the list of obligations the map showed you. They are stored in Saudi Arabia, in the same Jeddah database, and used for one purpose: two reminders before each date, 14 days and 3 days ahead. The messages are sent through Oracle Cloud’s Email Delivery service in its Jeddah region, which relays them and keeps nothing of ours beyond its delivery logs. We keep the record for twenty-four months or until you unsubscribe, whichever comes first, and every message carries a link that stops them with one click.
We do not store your IP address
We record which country a request came from, and nothing more precise. Your IP address is never written to our database.
Analytics
We use Google Analytics through Google Tag Manager on the public pages to count page views and see which pages lead to enquiries, but only if you allow it. On your first visit a banner asks. Until you press Allow, nothing is loaded from Google and nothing is sent to it, and that stays true if you press Don’t allow or ignore the question. If you allow it, what is sent to Google is a pseudonymous visitor identifier, the page you are on and the site that referred you, your browser and device type, and the approximate location Google works out from your connection. Google processes this on its servers outside Saudi Arabia. Your answer covers analytics only: advertising cookies and the use of your data for advertising stay switched off. No contact details are ever sent: when you send an enquiry, Analytics is told that an enquiry happened and is given a random reference, never your name, email, phone number or message. If you allow it and then open an account, our server in Jeddah also tells Google Analytics when you reach four milestones: your account is created, you create your company, your company connects a ZATCA device to production, and it issues its first invoice. Each is sent once, and only within 47 hours of happening; one that is older is never sent. What is sent is the name of the milestone, when it happened and the same pseudonymous identifier, so that Google can link the milestone to the visits it has already measured and we can see which pages and searches bring businesses that go on to use the product. None of your details go with them: not your name, email or phone number, not your company’s name, CR or VAT number, not the contents or amounts of any invoice, and nothing about your customers. Their use for advertising stays switched off too. Your answer is kept in your browser’s local storage, and after a year we ask again. It reaches us in one case only: on the screen where you create your company, if your answer is Allow, it is sent to us with the time you gave it and your Google Analytics identifier, and we keep these with your account so that we know we may send the milestones. A Don’t allow is never sent to us, and for anyone who had not allowed analytics by then we keep no such record and send no milestones. To change your answer at any time, use “Analytics choices” at the foot of any page. Withdrawing deletes Google’s cookies from this site and reloads the page without Analytics, but it does not reach the record we already keep with your account; to stop the milestones after that, ask us to delete that record, as described under “What you can ask us to do”, and nothing more is sent. We also record when someone opens a WhatsApp link, together with any campaign parameters in the address. The site works the same whichever you choose.
No Google script runs in the dashboard
The signed-in pages, where you issue invoices and where we read enquiries, never load Google Analytics, Google Tag Manager or any other Google script. Rather than trusting the tracking not to look at them, we do not load it there. What Google Analytics learns about your use of the product is only the four milestones described above, sent by our own server, and only if you had allowed analytics on the public pages by the time you created your company.
The random reference we keep in your browser
When you first arrive we store a random reference in your browser, together with the advert, search or link that brought you here. It is a random value and nothing else. It is not your name, it is not built from anything you type, and on its own it says nothing about who you are. It has two uses. When an enquiry reaches us, it tells us which advert or search led to it. And when you create an account, two things are recorded with it the moment you send the sign-up form: the advert, search or link it holds (though not the random value itself), and which of our “Create your free account” buttons you pressed. We use them to see which pages and buttons bring people who sign up. That record is first-party: it is ours alone, it is stored with the rest of your account in our database in Jeddah, Saudi Arabia, and it is never sent to Google or anyone else. The reference itself is held in your browser’s local storage rather than a cookie, it lasts ninety days, and, if you allow analytics, it is passed to Google Analytics so an enquiry can be matched to the visit that produced it — never alongside your name, email, phone number or message. We do not sell it, we do not give it to anyone else, and it cannot be used to follow you around other websites.
Who else can see any of it
Oracle Cloud, in its Jeddah region, for three things: hosting the machine and database, relaying email through its Email Delivery service, and producing invoice PDFs through its Document Generator. ZATCA: the invoices and notes you issue are submitted to its Fatoora platform for clearance or reporting, because that is what the law requires of an e-invoicing system, and ZATCA is the recipient of their full contents. Cloudflare, which sits in front of this site, the sign-in service and the document links to protect them from attack and speed them up, and runs the automated-abuse check on sign-up. It carries your request on its way to Jeddah; it is not given your enquiries, invoices or customers’ details to keep. Google, for the analytics described above, only if you allow it: on the public pages and, if you then open an account, the four account milestones our server sends, processed outside the Kingdom. The vendor of an AI assistant, outside the Kingdom, only if your company has had the connection switched on and a member has connected one, and then only for what that assistant reads. Inside Nizamics, access to the production system is limited to the people who operate it. Nobody else, and no advertising network.
What you can ask us to do
Under the Saudi Personal Data Protection Law you can ask what we hold about you, ask us to correct it, ask for a copy, or ask us to delete it. Email hello@nizamics.com and we will act on it within 30 days. We will not ask you to justify the request, though we will confirm it is really you, normally by replying to the address or number we already hold. Two limits, stated plainly: records that VAT law obliges a business to keep cannot be deleted before that period ends, and for data held in a customer’s books the request is answered by that business, with our help. If you are not satisfied with our answer, you may complain to the Saudi Data and AI Authority (SDAIA).
Who to contact
hello@nizamics.com, or the WhatsApp number on this site. Nizamics Solutions Company, Jeddah, Kingdom of Saudi Arabia.