Privacy Policy

1. Scope & Operator

This Privacy Policy explains how the Vertex suite of applications (“Vertex”, “we”, “us”) collects, uses, discloses, and protects personal data. Vertex is the product suite operated by مؤسسة تيكنومايندز (Technominds Establishment), a business registered in the Kingdom of Saudi Arabia under Unified/Commercial Registration No. 7053119298. It applies across every Vertex application and to everyone who interacts with them — the merchants who install our apps and the merchants' own customers whose data flows through the service. We handle personal data in a manner aligned to the Saudi Personal Data Protection Law (PDPL) and its implementing regulations.

2. Our Two Roles

Vertex acts in two distinct capacities. For a merchant's own account and store-configuration data, we are the controller — we decide how that data is used to run your account. For the personal data of a merchant's customers (names, phone numbers, orders, messages, and so on), we act as a processor on the merchant's behalf. In that relationship the merchant is the controller and is responsible for having a lawful basis and the necessary consent to send WhatsApp messages to those customers. We process customer data only to deliver the service the merchant has configured.

3. Data We Collect

Merchant data. When you create an account and connect a store we collect account and store details (name, email, business and store identifiers), OAuth access tokens for your connected Zid or Salla store — which we encrypt at rest using AES-256-GCM — billing records associated with your subscription (handled through Zid app subscriptions and our payment processor Moyasar), and usage and support information such as the actions you take in the app and the messages you send to our support team.

Customer data. On behalf of the merchant we process their customers' names, phone numbers, email addresses, order and abandoned-cart details, WhatsApp message content and delivery status, opt-out (“STOP”) events, and the segments and analytics derived from that activity.

Technical data. We automatically collect limited technical data such as IP address, session information, and strictly-necessary cookies required to keep you signed in and to operate the service securely.

4. How We Collect Data

We collect data in three ways: directly from you when you register, configure the app, or contact support; through the authorized Zid and Salla APIs and webhooks that deliver order, cart, and store events once you connect your store; and automatically as you use the service, through session cookies and standard server logs.

5. How We Use Data & Legal Basis

We use personal data to provide, secure, and improve the service. Our legal bases, aligned to the PDPL, are: consent as the default basis for marketing messages sent to a merchant's customers; performance of a contract to deliver the service to the merchant; legitimate interests such as securing the platform and preventing abuse; and compliance with legal obligations. We do not sell personal data, and we do not use a merchant's customers' data for our own marketing.

6. WhatsApp & Meta

Vertex sends messages through the WhatsApp Business Platform provided by Meta. Any opt-in a merchant relies on must be affirmative, must name the business collecting it, and must be specific to WhatsApp — consent cannot be implied from a purchase alone or captured through a pre-checked box. Opt-out is always honored: when a customer replies STOP or إلغاء, we automatically suppress further messaging to that contact. Use of WhatsApp is subject to Meta's terms and the WhatsApp Business Messaging Policy, and the merchant remains responsible for holding and evidencing customer consent.

7. Sharing & Sub-processors

We share personal data only with the sub-processors needed to run the service: Meta/WhatsApp (message delivery), Moyasar (payment processing), Zid and Salla (the commerce platforms you connect), our cloud hosting and database provider, and our email provider. We may also disclose data where required to comply with a lawful request from a competent authority. We do not otherwise sell or rent personal data to third parties.

8. International Transfers

Where personal data is transferred outside the Kingdom of Saudi Arabia — for example to a sub-processor operating abroad — we do so only in accordance with the cross-border transfer conditions set out in the PDPL and its regulations, and we apply appropriate safeguards to protect the data.

9. Retention & Destruction

We retain personal data for as long as it is needed to provide the service and to meet our legal and accounting obligations. When data is no longer required, or when a merchant closes their account and requests deletion, we destroy or irreversibly anonymize it within a reasonable period, subject to any retention we are legally required to observe.

10. Security

We apply industry-standard safeguards: OAuth tokens and other secrets are encrypted at rest using AES-256-GCM, data in transit is protected with TLS, and access is restricted through role-appropriate access controls. Each store's data is isolated so that one merchant cannot access another's data. In the event of a personal-data breach, we will notify the Saudi Data & AI Authority (SDAIA) and affected parties as required by the PDPL.

11. Your Rights

Subject to the PDPL, you have the right to be informed about how your data is used, to access it, to have it corrected, to request its deletion, to withdraw consent, and to obtain a portable copy of data you have provided. To exercise these rights, contact us at privacy@tryvertex.io. You also have the right to lodge a complaint with the Saudi Data & AI Authority (SDAIA). Where we act as a processor for customer data, we will direct customer requests to the relevant merchant, who is the controller.

12. Children

Vertex is a business tool and is not directed to children. We do not knowingly collect personal data directly from children.

13. Cookies

We use strictly-necessary cookies only — those required to keep you signed in and to operate the service securely. We do not use advertising or non-essential tracking cookies on the application.

14. Changes to This Policy

We may update this policy from time to time. We will notify you of material changes via email or a notice in the product. Continued use of Vertex after changes take effect constitutes acceptance of the updated policy.

15. Contact

For privacy-related questions or to exercise your rights, contact privacy@tryvertex.io. Vertex is operated by مؤسسة تيكنومايندز (Technominds Establishment), Unified/Commercial Registration No. 7053119298, Jeddah, Makkah Province, Kingdom of Saudi Arabia.