Who we are

Accurate ("Accurate", "we") provides ZATCA e-invoicing software to businesses in Saudi Arabia. We are the data controller for the personal data described in this notice, and we are registered at Dammam, Eastern Province, Saudi Arabia under commercial registration 7023984482.

Two different roles. For your own account data — your name, your login, your billing — we are the controller and this notice applies. For the invoice data you push through the platform, which may contain your customers' personal data, we act as a processor on your instructions; that relationship is governed by the Terms of Service and the data processing terms within them.

What we collect

Category	Examples	Why
Account	Name, work email, phone, role, password hash	To create and secure your account and to support you
Organisation	Company name, CR, VAT number, national address, branch and device identifiers	Required on the invoice itself and to obtain your CSIDs from ZATCA
Invoice content	Buyer name and identifiers, line items, amounts, VAT, and ZATCA's responses	To clear, report and archive invoices on your instruction
Usage and technical	IP address, browser, timestamps, actions taken in the product, error logs	Security, abuse prevention, the audit trail an inspection asks for, and fixing faults
Billing	Plan, invoices, payment status. Card details are handled by our payment processor and never reach our servers.	To charge you and to meet tax obligations
Website enquiries	Name, work email, company, invoice volume and whatever you write in the message box on our contact and free-trial forms	To answer you and to set up a trial. Stored in our own systems, not sent to an advertising or analytics service.

Why we are allowed to

The Personal Data Protection Law requires a lawful basis for each purpose. Ours are:

Performance of a contract — running the service you signed up for, including clearing your invoices.
Compliance with a legal obligation — the invoice retention, reporting and record-keeping duties that Saudi tax law places on both of us.
Legitimate interests — securing the platform, preventing abuse, and improving the product, weighed against your interests each time.
Consent — for marketing email only, and it can be withdrawn at any time without affecting the service.

We do not sell personal data, and we do not share it for anyone else's advertising. It is disclosed only to:

ZATCA — invoice data is transmitted to the Fatoora platform because that is the service. This is a legal obligation, not a choice either of us makes.
Sub-processors we rely on to run the platform — hosting, email delivery, error monitoring and payment processing. Each is bound by contract to process data only on our instructions.
Authorities, where a valid legal request requires it. We tell you unless we are prohibited from doing so.

A current list of sub-processors is available on request from info@accurates.sa. We give customers notice before adding a new one that processes invoice data.

Where it is stored

Invoice data, clearance responses and the audit trail are stored and processed in Saudi Arabia.

Where a supporting service (email delivery or error monitoring, for example) processes limited personal data outside the Kingdom, we do so only under the conditions the Personal Data Protection Law permits for transfers, and only for data that is not invoice content.

How long we keep it

Data	Kept for
Invoices, ZATCA responses, audit trail	Six years from the end of the tax period, as Saudi tax law requires
Account and organisation data	For the life of the account, then deleted within 90 days of closure
Security and access logs	12 months
Billing records	Six years, for our own tax obligations
Marketing consent and preferences	Until withdrawn, then a record that it was

Your rights

Under the Personal Data Protection Law you have the right to be informed, to access your data, to obtain a copy of it in a readable format, to have it corrected, and to have it destroyed where we no longer need it. Where processing rests on consent, you may withdraw it.

One limit worth stating plainly: we cannot delete an invoice you have already cleared with ZATCA. It is a tax record, both of us are legally required to retain it, and its hash is part of a chain that would break. Requests to delete account data are honoured; requests to delete filed invoices are not something either party can grant.

To exercise a right, write to info@accurates.sa. We respond within 30 days. If you are not satisfied with our answer, you may complain to the Saudi Data & AI Authority (SDAIA).

Cookies

This website uses only what it needs to work: a cookie or local-storage entry that remembers whether you are reading in Arabic or English, and — inside the application — a session cookie that keeps you signed in. Neither is used for advertising.

If we later add analytics or advertising cookies, we will ask for your consent before setting them and update this section first.

Children

Accurate is a business tool and is not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe we have, tell us and we will delete it.

Changes to this notice

We update this notice when our practices change. The date at the top of the page is the date of the current version. For a change that materially affects how we handle your data, we notify account holders by email before it takes effect rather than relying on you to re-read the page.