Privacy Policy

For the data of your own account users — names, emails, phone numbers, sign-in records — we act as the controller.

For the data you enter about your customers, suppliers and employees, you are the controller and we process it on your instructions, as your processor.

Account data: name, email address, mobile number, preferred language, company name and role.

Usage data: pages opened, actions taken, timestamps, and error diagnostics — used to operate, secure and improve the service.

Technical data: IP address, browser and device type, and session identifiers.

Billing data: subscription, invoices and payment status. Full card numbers are handled by the payment provider and are never stored by us.

Support data: the content of tickets and correspondence you send us.

To provide the service you subscribed to, and to perform our contract with you.

To secure the platform, detect abuse and investigate incidents — our legitimate interest in keeping the service safe.

To meet legal obligations, including tax and record-keeping requirements.

To send service messages about your account. Marketing messages are sent only with your consent and you can withdraw it at any time.

Service providers who host, secure, email or bill on our behalf, bound by contract to protect it and to use it only for the service.

Government authorities where a valid legal request or a statutory obligation requires it — for example e-invoice reporting to ZATCA, which is a function of the service you use.

We do not sell personal data, and we do not share it for third-party advertising.

Your data is hosted on infrastructure located in the Kingdom of Saudi Arabia. Where any processing outside the Kingdom is necessary, it is carried out only on the conditions the Personal Data Protection Law permits, with appropriate safeguards.

Account and usage data is kept while your subscription is active and for a limited period afterwards so you can export it.

Accounting records are kept for the period the tax and commercial regulations require, after which they are deleted or anonymised.

Data is encrypted in transit, access is limited to staff who need it, and sensitive values such as integration secrets are encrypted at rest. Each company’s data is isolated from every other company’s.

No system is perfectly secure. If a breach affects your personal data we will notify you and the competent authority as the regulations require.

You have the right to be informed about how your data is used, to access it, to request a copy in a readable format, to have inaccurate data corrected, and to request deletion where we have no lawful basis to keep it.

To exercise any of these, write to privacy@barah.sa. We respond within the period set by the regulations. You may also complain to the competent supervisory authority in the Kingdom.

We use only the cookies and local storage the application needs in order to work: keeping you signed in, and remembering your language and theme. We do not use advertising or cross-site tracking cookies.

On our public pages (the marketing site, sign-in and registration) we additionally use Google Analytics — only if you accept it in the cookie notice, which you may decline. It measures visits in anonymized form, is processed by Google LLC, is never used for advertising, and never runs inside your account.

We may update this policy; material changes will be notified before they take effect.

Privacy enquiries: privacy@barah.sa. Postal address: [Registered address, Kingdom of Saudi Arabia].