Privacy policy

Syoof Web Cybersecurity Est. is responsible for the personal data that the Syoof Web platform collects about you. Its contact details are at the bottom of this page and on the complaints page.

The data of your store’s customers, who use the app we built for you, is your responsibility, and we process it on your behalf. The details are in the section “Your store customers’ data”.

• Account

  Your name, email, and password. The sign-in service stores your password encrypted in a way that does not let anyone read it. We also keep the version of the terms you accepted and when you accepted it.

• Your project

  Your business name, your idea and your answers in the wizard, your logo and colors, your messages with the AI, and the code files and their versions. If you pick an element in the preview, its description and text are added to your message.

• Delivery form

  Your commercial registration, developer account details, and bank details for payment setup. They are stored encrypted, and only an administrator can view them, for a written reason that is logged.

• Payment

  The amount, its status, and the transaction reference at Moyasar, and a card token issued by Moyasar, which we store encrypted. We never receive your full card number or its security code.

• Support and usage

  Your tickets and their messages, your notifications, and how much AI you have used, to calculate your balance.

• Technical data

  Your network address, to protect the platform and limit the number of requests, and session cookies. In the free trial we store an encrypted fingerprint of your network instead of its address.

We do not sell your data, and we do not send you marketing messages without your consent.

AI on the platform runs through Anthropic. When you ask for a build or an edit, we send it only what is needed to carry out your request:

• Sent: Your message, your idea and business name, and the project files needed for the edit.
• Not sent: Your password, your card details, and the delivery form with its bank details.
• The Syoof Web assistant: Your questions in the assistant window are sent to Anthropic with general platform information only, and the assistant cannot see your account, projects, or tickets. We keep the conversation for a set period and then delete it, unless you turn it into a ticket yourself, in which case it is copied into the ticket.

We do not use your data to train any model. Anthropic processes what we send it, and keeps or deletes it, under the provider’s commercial terms. The activity you see during a build passes through a filter that hides any line that looks like a secret key.

• Platform and sign-in database: Supabase, Central Europe region (Frankfurt, Germany).
• Each project’s database: Supabase, in the same region, with a separate database for each project.
• Project files and their versions: The platform server we operate.
• AI: Anthropic, a US company, outside Saudi Arabia. Where processing happens and how long data is kept follow the provider’s commercial terms.
• Payment: Moyasar. Where processing happens follows the provider’s commercial terms.

We protect data in transit with encryption, and we send each provider the least it needs. The full list, and when each provider is involved, is on the service providers page.

Each project has its own database that no other project shares, governed by access rules applied to every row. You are responsible for your customers’ data in it, and we process it on your behalf to run and deliver your app.

• You must publish a privacy policy for your store, and respond to your customers’ requests about their data.
• Our team accesses it only to deliver your project, to fix a problem you asked us to fix, or under a legal request.
• Google sign-in on your store’s website: When your customer chooses “Continue with Google”, the sign-in goes through Syoof Web, whose name appears on Google’s page, and we ask them before continuing. We share the name and email Google gives us with your store only, and we do not keep them after the sign-in.

Some stores and websites are built with Syoof Web and owned by independent businesses. If you press “Continue with Google” on one, Google’s page shows the Syoof Web name, then a page of ours names the store and its address and asks you before continuing.

• What we share: Your name and email as Google gives them, with that store only, to create or open your account there.
• What we do not keep: We do not keep your name and email after the sign-in, and do not use them for anything else.
• Your data in the store: The store’s owner handles it under the privacy policy published in their store, and you may ask them to delete it.

The periods given in numbers below are the settings in force now, and this page reads them directly. If we change them, the number here changes too.

The Personal Data Protection Law in Saudi Arabia gives you rights over your data, including:

• To be informed: To know what we collect and why, which is what this page explains.
• Access and a copy: To ask to see your data and to receive a copy of it in a readable format.
• Correction: To correct anything that is inaccurate. You can correct most of it directly from your account page.
• Deletion: To ask us to delete your data once it is no longer needed, unless a law requires us to keep it.
• Withdrawing consent: To withdraw your consent where consent was the basis, without affecting what came before.

Make these requests from the My account page or through our contact channels, and we will reply within the period the law sets. You may also file a complaint with the Saudi Data and Artificial Intelligence Authority (SDAIA).

We use essential cookies only:

• Session: Keeps you signed in securely.
• Free trial: Links your browser to your trial, and expires when the trial ends.

We do not use advertising cookies or analytics cookies from third parties.

• A separate database for each project, and row-level access rules on every table.
• Encryption of sensitive data, such as the delivery form, the card token, and service keys, using AES-256-GCM.
• Staff permissions limited by role, and every access to sensitive data logged with the staff member’s name and reason.
• Generated code is scanned for secrets and dangerous commands before it runs.

No system is completely secure. If a breach affects your data, we will notify you and the competent authority as the law requires.

We may update this policy, and the date of the last update appears at the top of this page. We notify you of material changes inside the platform or by email before they take effect.