1. Who we are and our processing roles
The service provider is alraqm alsaabi Establishment For Trading, national number 7012576893, Jeddah, Saudi Arabia, referred to as “NeraPOS”, “we”, “us” or “our”.
We act as controller when we determine the purposes and means of processing registration, subscription, billing, support, website, security and service-usage data. For data a customer enters about its customers, suppliers, employees or other persons, the customer will generally act as controller and NeraPOS processes that data on its behalf to provide the service and follow lawful instructions.
2. Data we collect and its sources
Data may include your name, email, mobile number, business details, address, billing and support information; user and permission data; products, customers, suppliers, employees, transactions, inventory, documents and settings entered by the business; and IP address, device/browser type, security logs, diagnostics and usage data.
We receive data directly from you or an authorized user, automatically through service use, from a business that invites you, and from integrations you choose to connect. Required fields are identified when collected; without them we may be unable to create an account or provide a requested feature.
HyperPay and participating payment providers process card payments. NeraPOS may receive a transaction reference, status, amount, currency and limited billing details, and does not intend to store complete card numbers or card security codes.
3. Purposes and legal bases
We process data to provide and secure the service, perform subscriptions, authenticate users, operate requested features and integrations, provide support, comply with Saudi legal, accounting and tax obligations, prevent misuse and investigate incidents. Where permitted, limited usage and performance data may be processed for legitimate interests in securing and improving the service where those interests do not override the data subject’s rights. We rely on consent where required, including certain marketing activities or optional access to third-party accounts.
5. Google Workspace and Google Sheets data
When a business administrator voluntarily connects Google, NeraPOS accesses the connected email address, OAuth tokens, spreadsheet identifiers/URLs and limited metadata needed for the integration. The integration can create or select a destination spreadsheet and write only the NeraPOS datasets and columns selected by the administrator.
The synchronization is one-way from NeraPOS to Google Sheets. NeraPOS does not import spreadsheet cell contents or user edits, browse unrelated Google files, or use Google user data for advertising, data brokerage, credit decisions or training generalized AI/ML models.
Sensitive OAuth tokens are encrypted at rest. Administrators can disconnect the integration in NeraPOS or revoke access from their Google Account. Use of information received from Google Workspace APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
7. Hosting and international transfers
NeraPOS production hosting and backups are currently located in Germany. The service therefore may involve transfer and processing of personal data outside Saudi Arabia. We limit transfers to what is necessary to provide, secure, support and back up the service and apply the requirements and appropriate safeguards applicable under the Saudi Personal Data Protection Law and the Regulation on Personal Data Transfer Outside the Kingdom, including contractual, technical and organizational safeguards as appropriate.
Optional third-party services that you choose to connect may process data in other countries or regions according to their own infrastructure and policies. Enabling those services is optional and their own terms and privacy notices also apply.
8. Retention and deletion
We retain data while needed to provide the service, perform the contract, support users, maintain security, resolve disputes and meet legal obligations. An account may become inactive after the trial or paid period ends. The system may send inactivity notices at approximately 6, 9 and 11 months; after 12 continuous inactive months some non-regulatory files may be removed. Permanent deletion is not automatic; after at least 24 continuous inactive months an administrator may review the account for deletion.
Transaction, accounting, tax, e-invoicing and other legally protected records are retained for periods required by applicable law. When data is no longer required, it is deleted or anonymized in accordance with applicable procedures, subject to backup cycles and legal preservation requirements.
9. Your rights
Subject to the Saudi Personal Data Protection Law and its exceptions, you may have the right to be informed, access your personal data, obtain a clear and readable copy, request correction/completion/update, request destruction when the data is no longer required, and withdraw consent where consent is the legal basis. We may verify identity and authority before acting on a request.
10. Security
We use reasonable administrative, technical and organizational safeguards including access controls, HTTPS transport, encryption of relevant integration secrets, monitoring and business-scoped access. No electronic transmission or storage method can be guaranteed to be completely secure.
11. Rights requests, complaints and contact
To exercise privacy rights or submit a privacy question or complaint, contact [email protected] or WhatsApp/mobile +966 54 878 6834. We act on data-subject rights requests within no more than 30 days, subject to a permitted extension of up to an additional 30 days where implementation requires unexpected or unusual effort or multiple requests are received, with advance notice and reasons.
If you are dissatisfied with our handling of a request or complaint, you may complain to the competent Saudi authority in accordance with the PDPL, including through the National Data Governance Platform operated by SDAIA.
SDAIA personal-data complaint service ↗
Contact:
NeraPOS — alraqm alsaabi Establishment For Trading
National number: 7012576893
Jeddah, Saudi Arabia
12. Revision record
2 October 2026 — Comprehensive update covering cookie and campaign measurement choices, optional integrations, Google Sheets, international transfers, data-subject rights and complaint handling, with a redesigned layout for easier reading.
13. Changes to this Policy
We may update this policy when the service, data practices or legal requirements change. We will publish the updated version at this URL, update the effective date and provide any additional notice or obtain consent where required by law.