Privacy Notice
Draft for owner review. This text has not been reviewed by counsel and must be reviewed before it is relied upon.
Draft reviewed:
AI support chat
AI chat is optional and may give inaccurate answers. When you submit a question, the bounded conversation is sent through Replit AI Integrations and OpenRouter to the server-configured model provider for a reply. Do not share passwords, API keys, security codes or sensitive personal information. Chat history is held only in this page’s browser memory and is cleared by clearing the conversation, leaving the page or refreshing. SaudiCRpro does not save chat transcripts, include them in account history, or automatically email them. Separate technical request logs and hashed-IP abuse counters may be processed. Replit, OpenRouter and the model providers process messages under their own applicable policies, including any retention and international processing; we do not promise zero retention, no training or Saudi-only processing. The provider configuration and applicable processing safeguards must be reviewed before external launch. Use support@saudicrpro.com or the separate Contact Us form for human help; that form saves a ticket with a receipt.
Who operates the service
Saudi CR Pro is part of Morouna Business Services Company. Contact support@saudicrpro.com for privacy questions or personal-data requests.
Account and authentication data
We store your name, email, language, verification status, access dates and usage counter. Required account fields enable account creation and access; optional profile and saved-business features can be left unused. Passwords, session tokens, email codes and API secrets are stored as hashes, with expiry and attempt information where applicable. Key names, status, suffixes and usage metadata are retained separately from the secret.
AI quarterly insights
The optional quarterly-insights assistant sends your question and a bounded recent conversation through the same Replit AI Integrations, OpenRouter and configured model-provider processing described for AI support chat. The AI interprets a statistical request; our server calculates answers from reviewed aggregate records. Raw registry rows and account credentials are not sent to the model. We do not store or email transcripts. Separate account-based and global abuse counters are processed. Do not submit confidential information. Provider retention and international-processing limitations described above apply equally to this assistant.
Lookups, support and security
Account lookup history can include the queried business identifier, outcome, source period, time and response duration. Saved businesses include identifiers and names. Support records contain the name, email, message, language, delivery state and ticket status you provide or generate. Security controls process network information and hashed IP-based counters. Administrative audit records identify actions and their actors. Website/server infrastructure may also process technical request logs.
Published Ministry records
Registry information comes from official published Ministry of Commerce releases, rather than from your account. Business records, particularly sole-proprietor information, may identify individuals and are not assumed to be exempt from personal-data protections. Report an accuracy or privacy concern to support; we can review our processing but cannot amend the Ministry’s official records.
Purposes and processing basis
Data is used to provide account and lookup services, administer access, prevent abuse, secure the service and answer requests. Before external launch, the operator must document and approve the applicable legal basis for each purpose, including the public-record processing basis and any required legitimate-interest assessment. Use of the website is not treated as blanket consent for unrelated marketing.
Cookies and browser storage
A session cookie supports sign-in. Language and theme preferences use browser storage. No advertising-cookie consent is inferred from these essential functions. Blocking cookies may prevent sign-in; clearing browser preferences resets your language or theme choice.
Service providers and disclosures
The current application runs on Replit infrastructure and uses database and file-storage services. Transactional account and support emails are sent using Resend. Delivery depends on sender configuration and the receiving mail service. Authorized operators can access records for support and administration. We may need to disclose information where required by applicable law. The production processor list, storage locations, transfer safeguards and contracts remain to be verified before launch; Saudi-only storage is not claimed.
Retention and deletion
Anonymous lookup diagnostics retain valid-format ten-digit business-number inputs, request time, endpoint, outcome, response duration, page-source label, referrer hostname and a site/preview label for troubleshooting and service monitoring. Only authorized administrators can access this history. Free-text searches, IP addresses, API keys and full referrer URLs are not stored in this diagnostic history. At most the latest 10,000 requests within 30 days are available; older details are removed during routine cleanup and are excluded from reports after expiry. Aggregate request counts contain no searched identifiers and are kept for up to 365 days. These are request counts, not verified unique human visitors. Other account history, tickets, security records and audits have separate retention requirements; contact support@saudicrpro.com for deletion requests and backup-handling information.
Retention and deletion
There is not yet an approved category-by-category retention schedule or routine account-history deletion process. Expiry of a session or email code prevents its use but does not itself prove deletion of its stored record. Lookup history, tickets, key security records and audits may remain stored until reviewed. Before external launch, retention periods, deletion procedures, justified legal holds and backup handling must be approved and made operational. The registry release policy protects the active and previous releases; this is separate from customer-data retention.
Your requests and rights
Use the support form or email support@saudicrpro.com to request information, access or a readable copy of your personal data, correction, destruction, or withdrawal of consent where consent is the processing basis, subject to applicable law. Identify the request and account email; do not send passwords, API keys or identity documents with your initial message. We must verify authority proportionately before disclosure or action, protect other people’s data, and explain any applicable refusal or retention requirement. A personal-data request is not a request to export the full registry. You may also raise a complaint with the competent data-protection authority.
Security and notice changes
The application uses access controls, hashed credentials and rate limits; these are safeguards, not a guarantee against every incident or a security certification. Any material change to processing must be reflected in this notice before the new use begins, with any legally required information or consent. The review date below records a draft review, not legal approval.