Privacy Policy

This policy explains how ROZANAH handles personal and business data across our digital contract management and e-signature platform, including user accounts, dashboards, subscriptions, billing, and payment workflows.

Last updated: 2026-06-02

Information We Collect

We collect only the data required to provide, secure, and improve ROZANAH services.

  • •Account data: name, email, phone number, company details, and user role.
  • •Subscription and billing data: plan type, status, renewal dates, and invoice records.
  • •Payment data: transactions are processed by approved providers such as TAP, and full card details are not stored by us.
  • •Top-up transaction data: top-up amount, transaction timestamp, payment status, and provider transaction reference.
  • •Usage data: authentication logs, feature usage events, browser and device metadata.
  • •Support communications: inquiries, support tickets, and service feedback.

How We Use Data

We process data for legitimate business purposes directly connected to service delivery.

  • •Provisioning and managing accounts, permissions, and dashboards.
  • •Delivering platform features, including project workflows, notifications, and analytics.
  • •Managing subscriptions, validating payments, and reducing fraud risk.
  • •Managing account balance top-ups and usage deductions.
  • •Improving performance, reliability, and user experience.
  • •Complying with applicable legal and regulatory obligations in Saudi Arabia.

Data Sharing

We share limited data only with trusted parties when necessary for operations or legal compliance.

  • •Payment gateways: such as TAP for payment processing and transaction validation.
  • •Technology providers: hosting, cloud infrastructure, security, and observability tools.
  • •Communication services: for account alerts, transactional notifications, and support delivery.
  • •Regulatory or law enforcement authorities when legally required.
  • •We do not sell personal data.

Data Protection and Storage

ROZANAH applies reasonable administrative, technical, and organizational safeguards to protect data.

  • •SHA-256 hash chain: any attempt to modify a contract after certification leaves a detectable digital trace that can be verified immediately.
  • •Strict tenant isolation: infrastructure-level isolation controls prevent unauthorized cross-tenant data access.
  • •Certified digital archiving: PDF copies stamped with a unique verification code, stored encrypted in enterprise cloud infrastructure.
  • •Comprehensive, documented audit trail: every action is recorded with timestamp, identity, and actor details across multiple log layers.
  • •Least-privilege access control (RBAC): each user sees only what their role authorizes.
  • •Secure cookie-based authentication (HttpOnly): no access tokens stored in the browser, with CSRF protection.
  • •Enterprise cloud infrastructure: globally distributed hosting with encryption and DDoS protection.

Cookies and Tracking

We use cookies and similar technologies to maintain core platform functionality and improve performance.

  • •Essential cookies: authentication and session continuity.
  • •Preference cookies: language and interface settings.
  • •Analytics cookies: usage insights and service optimization.
  • •You can manage cookies in browser settings; disabling some cookies may affect functionality.

User Rights

Subject to legal and contractual limits, users may request action on their personal data.

  • •Access to personal data we hold.
  • •Correction of inaccurate or incomplete information.
  • •Deletion when legally and operationally feasible.
  • •Restriction or objection in specific processing scenarios.
  • •A usable copy of eligible data.
  • •If you are a Tenant (data controller for your clients): you have full direct rights to access, correct, export, and delete data under applicable regulations.
  • •If you are a Tenant's Client (your data is managed through the platform by a Tenant): your rights are exercised through the Tenant who acts as your data controller.
  • •If you have questions about your personal data or legal rights, you may contact us through official communication channels available on the platform or website.

Data Retention

Data is retained while an account is active and for a reasonable period afterward when required.

  • •Billing, accounting, and regulatory compliance.
  • •Dispute management and contractual enforcement.
  • •Security operations and anti-fraud controls.
  • •Data is securely deleted or anonymized when retention is no longer necessary.

Contact Information

For privacy-related questions or rights requests, you may contact us through official communication channels available on the platform or website.

Regulatory region for this policy: Kingdom of Saudi Arabia.

Data Residency and Regulatory Compliance

Data is processed and stored within a secure global cloud infrastructure.

  • •We comply with the Saudi Personal Data Protection Law (PDPL).
  • •Sensitive data (contract content, signatures) is encrypted before storage.
  • •International data transfers are subject to contractual safeguards and approved security standards.
WhatsApp