Skip to content

Legal

Privacy Policy

This policy explains what personal data Wethaq collects, why we use it, who processes it on our behalf, how long we keep it, and the rights you have under the Saudi Personal Data Protection Law (PDPL).

Last updated:

Who we are

Wethaq ("we", "us") operates the website wethaq.sa and the Wethaq platform from Riyadh, Saudi Arabia. We are the controller of the personal data described in this policy.

For any privacy question or request, write to [email protected]. For security matters, write to [email protected].

The personal data we collect

We collect only what each part of the service needs:

  • Individual report orders: your full name, email address and phone number; an optional referral code; and, where an invoice is issued to a business, the company name, VAT number, commercial registration number and address. We also record the IP address and browser details used to place the order.
  • Individual accounts: your name, email, phone number, preferred language, a hashed password, sign-in times, and your referral code and balance.
  • Organization accounts: each user's name, work email, a hashed password, two-factor authentication and passkey settings if enabled, and their organization and role.
  • The early-access waitlist: your name, email address, organization type and the plan you asked about.
  • The free XBRL tool: the statements and figures you upload or enter and, to unlock a download, the company name, a contact name, a mobile number verified by SMS, and an optional email address.
  • Payments: card details are entered with our payment gateway and never reach Wethaq. We keep the payment reference, amount and status.
  • Technical data: the session and security cookies described in our Cookie Notice, server logs, and rate-limit counters linked to your IP address.

The financial statements you upload

Financial statements describe companies, but they can also contain personal data — for example the names of directors, shareholders or auditors. We use uploaded documents only to produce the analysis, report or XBRL draft you requested, and to keep a verifiable record of what was issued.

You must have the right to share any document you upload. Our Terms of Service set out that commitment.

Why we use your data

We do not sell personal data, we do not use it for advertising, and we do not run third-party analytics or advertising trackers on our site.

  • To provide the service you asked for — your report, your account, your organization's workspace or your XBRL draft (performance of our agreement with you).
  • To take payment and issue a tax invoice that complies with ZATCA rules (legal obligation).
  • To send service emails such as order confirmations, report notifications, receipts and account invitations.
  • To verify your mobile number before an XBRL download, and to keep the service secure — rate limits, fraud prevention and an audit trail of consequential actions (legitimate interest).
  • To contact you about early access when you join the waitlist (your consent).

How AI is used

To read documents and map line items, Wethaq sends uploaded statements to AI models from our configured providers — currently Google (Gemini) by default, with OpenAI configured for some tasks. The figures, ratios and scores themselves are computed by our own deterministic, rules-based engine, not by AI.

We do not use your documents to train AI models. For the free XBRL tool, AI processing happens only after you tick the consent box.

Who processes data for us

We share personal data only with service providers that process it on our instructions, and only as far as each one needs:

  • Our payment gateway, which processes card payments and refunds.
  • AI model providers (Google and OpenAI), which read uploaded documents.
  • An SMS provider, which sends verification codes for the XBRL tool.
  • Our email delivery provider, which sends service emails.
  • Our hosting, database and file-storage providers.

Disclosure and sharing

We disclose personal data to public authorities only where the law requires it. When you choose to share a report through a share link, anyone holding that link can view the report until you revoke it.

Transfers outside the Kingdom

Some of our service providers, including the AI model providers, process data on infrastructure outside the Kingdom of Saudi Arabia. Where personal data is transferred outside the Kingdom, we do so only as the PDPL and its regulations permit, limit the transfer to what the service needs, and record it.

How long we keep data

  • Unpaid report orders, together with their uploaded statements, are deleted after 7 days.
  • XBRL drafts and the files uploaded to the XBRL tool are deleted after 30 days. The contact details used to unlock downloads are kept so you can return to the tool, and are deleted on request.
  • Paid orders, tax invoices and payment records are kept for as long as Saudi tax and accounting law requires.
  • Account data is kept while the account is active and deleted on request, except where the law requires us to keep it.
  • The audit trail is append-only and kept long term for security and dispute resolution.
  • A browser session expires after 120 minutes of inactivity.

How we protect data

Connections are encrypted with TLS, uploaded documents are kept in private storage with no public links, access is limited by organization and role, and consequential actions are recorded in a tamper-evident audit trail. Our Security page describes these measures in more detail.

Your rights

Under the PDPL you have the right to:

  • be informed of how and why your personal data is processed;
  • access your personal data and obtain a copy of it in a readable format;
  • ask us to correct, complete or update inaccurate data;
  • ask us to destroy your personal data when we no longer need it, subject to any legal duty to keep it;
  • withdraw your consent at any time where processing relies on consent;
  • lodge a complaint with the Saudi Data and AI Authority (SDAIA).

Making a request

Send your request to [email protected] from the email address linked to your order or account. We may ask you to confirm your identity before acting on it, and we will respond within the period the PDPL requires.

Children

Wethaq is a professional service and is not directed at anyone under 18. We do not knowingly collect personal data from children.

Changes to this policy

When we change this policy we update this page and the date at the top. If a change materially affects how we use personal data you have already given us, we will tell you before it takes effect.