Privacy Policy

This policy explains how Origami — the data controller and operator of Fahim — collects, uses and protects your personal data when you visit this site, use the system, or contact us.

It is drawn up in accordance with the Personal Data Protection Law issued by Royal Decree No. (M/19) dated 9/2/1443H and its amendments, and its Implementing Regulation issued by the Saudi Data and AI Authority (SDAIA). Where any wording here conflicts with the Law, the Law prevails.

1. Data we collect

We collect the least data each purpose requires, and never collect data for its own sake:

• Data you provide yourself: name, mobile number, email address, company name, commercial register number, city, and anything else you enter in the site's forms, when requesting a subscription, or when applying to the partner programme.
• Correspondence: the content of your messages with us over WhatsApp, email or phone, and the record of that correspondence.
• System operating data: what you or your team enter into Fahim — invoices, customers, inventory, employees and accounting entries. This is your organisation's data, and we process it on your behalf.
• Site usage data: the pages you visited and how long you stayed on them, how you reached the site, and the display language you chose. This is gathered under a random identifier that distinguishes a browser rather than a person, and is not linked to your name, your number or your account.

We use no third-party tracking tools, build no behavioural profile of visitors, and do not follow your activity across other websites.

2. Why we use your data

• To provide and operate the system and fulfil your subscription.
• To answer your enquiries and support requests.
• To improve the site and the system and measure performance statistically.
• To send operational notifications about your account or subscription.
• To comply with applicable Saudi regulations, including e-invoicing requirements and those of the Zakat, Tax and Customs Authority.

Each use rests on a defined lawful basis under the Personal Data Protection Law: performance of our contract with you, your explicit consent, a legitimate interest that does not prejudice your rights, or a legal obligation — as the case may be. We do not process your data for a new purpose inconsistent with the one it was collected for without notifying you and obtaining your consent.

3. Your customers' data inside the system

The data your organisation enters into Fahim remains yours. We process it as an operator on your behalf, and only to the extent needed to run and support the service. We do not sell it, we do not use it for our own marketing, and we do not access it except where technically necessary for support, at your request, or under a legal order.

4. Sharing data

We do not sell or rent your personal data. We may share it — to the narrowest extent necessary — with:

• Technical service providers (hosting, messaging, payment gateways) under agreements that bind them to confidentiality and limit their use of the data to the agreed purpose.
• Competent government or judicial authorities where required by law.
• Any party you designate in writing.

5. Transfers outside the Kingdom

System data is hosted inside the Kingdom of Saudi Arabia by default. Where an operational purpose requires any data to be transferred outside it, that transfer follows the controls of the Personal Data Protection Law and its implementing regulation, and ensures an appropriate level of protection.

6. Retention period

We keep your data for the duration of your subscription or relationship with us, and then for whatever period Saudi regulations require — including the retention of accounting and tax records. Once the purpose and the statutory period have ended, the data is destroyed or stripped of identifying details.

7. Data security

We apply technical and organisational measures to protect your data: encrypted connections, access permissions limited to need, backups, and monitoring of security events.

Should your data suffer a leak, damage or unlawful access, we are committed to notifying the Saudi Data and AI Authority within the period set by the Implementing Regulation, and to notifying you without delay wherever the incident causes harm to you or to your data.

8. Your rights

The Saudi Personal Data Protection Law guarantees you the following rights:

• Right to be informed: to know the legal basis for collecting your data, the purpose of doing so, and who will have access to it.
• Right of access: to reach the data we hold about you.
• Right to obtain a copy: to receive a copy of your data in a clear, readable format, free of charge.
• Right to correction: to request that your data be corrected, updated or completed.
• Right to destruction: to request that your data be destroyed once the purpose for collecting it no longer applies, unless the law requires it to be retained.
• Withdrawal of consent: to withdraw your consent at any time, without retroactive effect on processing carried out beforehand.

To exercise any of these rights, contact us using the details at the end of this page. We respond within thirty days, and charge you nothing for exercising a right. If our response does not satisfy you, you may lodge a complaint with the Saudi Data and AI Authority (SDAIA), the body supervising the application of the Law.

9. Cookies and local storage

This site uses no advertising cookies and no third-party analytics tools. It uses local storage in your own browser for two purposes only:

• To remember your display preferences — language, and light or dark theme.
• A random identifier used to measure site performance statistically. It distinguishes a browser, not a person, is not linked to your name or number, and the measurements go to our own servers rather than to any outside party.

You can clear this storage at any time from your browser settings, without affecting your work in the system.

10. Contact over WhatsApp

Fahim works over WhatsApp, so your messages with it pass through the WhatsApp service operated by Meta and are subject to its privacy policy alongside this one. We retain from that correspondence what is needed to operate the service and reply to you.

11. Children's privacy

The service is aimed at business owners and organisations, and we do not knowingly collect data from anyone under eighteen. If such data reaches us, we destroy it as soon as we become aware of it.

12. Changes to this policy

We may update this policy from time to time, publishing the amended version on this page together with the date it was last updated. Your continued use of the site or the system after publication counts as acceptance of the updated version.

13. Contact us