Privacy Policy

1. Introduction

Draft ERP ("we", "our", or "us"), developed by Draft ERP Establishment (Saudi Arabia), is committed to protecting the privacy and security of your personal and business data. This Privacy Policy explains what information we collect, how we use it, and the rights you have over your data when you use the Draft ERP accounting and ERP platform (the "Service"). By accessing or using Draft ERP, you agree to the collection and use of information in accordance with this policy.

2. Information We Collect

2.1 Account Information

When you register, we collect: full name, email address, phone number, username, and a securely hashed password (we never store your plaintext password).

2.2 Company & Business Information

To operate your accounting environment, we collect: company name (Arabic and English), commercial registration number (CR), VAT/tax registration number, business address, phone number, and company logo.

2.3 Financial & Accounting Data

We process the financial data you enter into the system, including: chart of accounts, journal entries, sales invoices, purchase invoices, payment records, VAT returns, financial reports, cost centers, and fixed assets.

2.4 Customer & Supplier Data

Business contact information for your customers and suppliers, including names, tax IDs, addresses, phone numbers, and transaction histories.

2.5 Inventory & Product Data

Product catalog information, SKU codes, stock levels, pricing, warehouse data, and inventory movement records.

2.6 Activity & Audit Logs

For security and compliance purposes, we maintain logs of user actions within the system, including logins, data modifications, approvals, and system events.

2.7 Technical Data

Device information, browser type, IP address, and session tokens (JWT) used for authentication and security.

3. How We Use Your Information

To provide, operate, and maintain the Draft ERP accounting platform
To process your financial transactions and generate compliant invoices
To fulfill ZATCA (Zakat, Tax and Customs Authority) e-invoicing compliance obligations
To authenticate users and maintain account security
To send essential service notifications and updates
To provide customer support and technical assistance
To improve the platform through aggregated, anonymized analytics
To comply with applicable Saudi Arabian laws and regulations

4. Data Sharing & Disclosure

We do not sell, trade, or rent your personal or business data to third parties. We may share data only in the following limited circumstances:

ZATCA (Zakat, Tax and Customs Authority): As required by Saudi law, e-invoice data is transmitted to ZATCA systems for compliance reporting.
Service Providers: Trusted hosting, infrastructure, and security providers who process data on our behalf under strict confidentiality agreements.
Legal Compliance: When required by applicable law, court order, or government authority in the Kingdom of Saudi Arabia.
Business Transfers: In the event of a merger, acquisition, or asset sale, with prior notice provided to users.

5. Data Security

We implement industry-standard security measures to protect your data:

All data in transit is encrypted using HTTPS/TLS
Passwords are hashed using secure cryptographic algorithms (never stored in plaintext)
Authentication uses JWT with short-lived access tokens (15 minutes) and secure refresh tokens (7 days)
Access is controlled through Role-Based Access Control (RBAC) with granular permissions
Multi-tenant architecture ensures complete data isolation between organizations
Redis-based rate limiting protects against brute force attacks
Regular security audits and monitoring of system activity

6. Data Retention

We retain your data for the following periods:

Account and company data: For the duration of your active subscription, plus 5 years after termination
Financial records and invoices: 10 years, as required by ZATCA regulations and Saudi accounting standards
Audit logs: 5 years for compliance purposes
Session tokens: Invalidated upon logout or expiry

7. Your Rights

As a user of Draft ERP, you have the following rights regarding your personal data:

Right to Access: Request a copy of the personal data we hold about you
Right to Rectification: Request correction of inaccurate or incomplete data
Right to Erasure: Request deletion of your account and associated data (subject to legal retention requirements)
Right to Data Portability: Request your data in a structured, machine-readable format
Right to Restrict Processing: Request that we limit how we process your data in certain circumstances

8. Cookies & Local Storage

Draft ERP uses browser localStorage for authentication token storage (JWT access and refresh tokens). No third-party tracking cookies are used. The offline-capable POS feature uses IndexedDB (via Dexie) to store transaction data locally on your device for offline operation.

9. Children's Privacy

Draft ERP is a business accounting platform intended for professional use by organizations and businesses. We do not knowingly collect data from individuals under the age of 18.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users of material changes via email or in-app notification at least 30 days before the changes take effect.

11. Governing Law

This Privacy Policy is governed by the laws of the Kingdom of Saudi Arabia, including the Personal Data Protection Law (PDPL) issued by Royal Decree No. M/19.

12. Contact Us

For any questions, requests, or concerns regarding this Privacy Policy or your data, please contact us:

Company: Draft ERP Establishment
Email: [email protected]
Phone: +966 50 706 0555
Address: Riyadh, Saudi Arabia