Privacy Policy

The data controller responsible for your personal data is Zad, operated in the Kingdom of Saudi Arabia.

Contact for data inquiries: privacy@zad.app

When you register, we collect: your name, email address, postal address (country, city, district, street), workspace name, and password (stored as a secure hash).

During use of the app, we collect inventory data, scan activity, expense records, and usage logs that you create.

If you connect a social login (Google, Microsoft), we receive your name, email, and provider user ID.

We collect technical data such as IP address, device type, and browser type for security and service operation.

To create and manage your account and workspace.

To provide the inventory tracking, shopping list, expense, and reporting features.

To send transactional emails (email verification, password reset, system notifications).

To process subscription payments and manage your plan.

To improve and secure our service.

We do not use your data for advertising or sell it to third parties.

We process your personal data on the basis of your explicit consent given at registration (PDPL Article 5), and where necessary for the performance of a contract with you (providing the service you signed up for).

You may withdraw your consent at any time by contacting us. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

We do not sell or rent your personal data.

We share data only with trusted service providers who help us operate the platform (e.g., email delivery, cloud hosting). These providers are bound by data processing agreements and may not use your data for their own purposes.

We may disclose data if required by Saudi law or a lawful order from a competent authority.

Some of our infrastructure and service providers may be located outside the Kingdom of Saudi Arabia. Where data is transferred internationally, we ensure that appropriate safeguards are in place as required by PDPL Article 29.

By using the service, you consent to such transfers subject to those safeguards.

We retain your personal data for as long as your account is active, or as needed to provide the service.

After account deletion, we may retain certain data for up to 12 months for legal compliance, dispute resolution, and fraud prevention, after which it is securely deleted.

You have the right to: access your personal data; correct inaccurate data; request deletion of your data (subject to legal retention obligations); withdraw consent; object to processing; and receive a copy of your data in a portable format.

To exercise any of these rights, contact us at privacy@zad.app. We will respond within 30 days.

We use a secure HTTP-only session cookie to keep you logged in. We also use browser local storage for language and theme preferences.

We do not use advertising or tracking cookies.

We implement technical and organisational measures to protect your data, including password hashing, HTTPS encryption, and access controls.

No system is completely secure. If you believe your account has been compromised, contact us immediately.

Our service is not directed at children under 18. We do not knowingly collect personal data from minors. If you believe a minor has registered, please contact us so we can remove the data.

We may update this Privacy Policy from time to time. When we do, we will notify registered users by email and update the 'Last updated' date above.

Continued use of the service after changes are notified constitutes acceptance of the updated policy.

For any questions or data requests, contact our Privacy Team at: privacy@zad.app