Privacy Policy
This policy explains what data ICASH collects, why, where we keep it, who we share it with, and your rights over it. It covers icashpos.com, the ICASH app, the till app and their services. It is written under Saudi Arabia's Personal Data Protection Law and its regulations, and Egypt's Personal Data Protection Law No. 151 of 2020 and its Executive Regulations.
1. Who we are
ICASH is a cloud point of sale offered by subscription to businesses in Saudi Arabia and Egypt. The service is provided by ICASH, commercial registration no. , of ("we").
2. Our role
- We are the controller of your account, subscription, support and website-visit data: we decide why and how it is used.
- We are the processor of the operating data your business enters, such as its customers' and employees' data. The business owner is its controller; we process it on the owner's behalf and instructions only, to provide the service (see section 11).
3. Data we collect
a. Account and subscription
The business's name, field and country; the owner's name, e-mail and mobile; the password (stored as a one-way hash we cannot read); the tax number, commercial registration and address when entered; the plan, subscription dates, payments and invoices.
b. Users
The names, roles and permissions of the business's users; the till PIN (stored hashed); the log of sign-ins and actions (who did what, and when).
c. Business operating data
What your business enters or produces while working: products, prices, stock, purchases and suppliers; sales, invoices, returns and shifts; your customers' data (name, mobile, e-mail, addresses, the VAT number of business customers, and their marketing consent); your employees' data if you use staff features (including national ID or iqama number, pay, and uploaded documents); repair orders where used.
d. Devices and usage
The registered device's identifier and type, IP address, sign-in times, and the error and performance logs needed to run and protect the service.
e. Payments
Card payments are made through Tap Payments. We never receive or store card numbers; we keep only the payment's reference, amount and status.
f. Website visitors and messages
On icashpos.com we use Google Analytics to count visits, their sources, and the buttons clicked (see section 12). If you message us on WhatsApp or by e-mail, we keep the conversation to serve you.
4. Why we use data, and on what basis
| Purpose | Legal basis |
|---|---|
| Creating the account, running the service, syncing devices, support | Performing our contract with you |
| Issuing subscription invoices; issuing your business's e-invoices and reporting them to ZATCA (Fatoora), or to the Egyptian Tax Authority once enabled | Legal obligation; contract |
| Protecting accounts, detecting fraud and misuse, backups | Legitimate interest; legal obligation |
| Service messages: e-mail confirmation, renewal reminders, invoices | Contract |
| Improving the service with aggregated statistics that identify no one | Legitimate interest |
| Marketing messages about ICASH features and offers | Your consent, which you can withdraw at any time |
We do not sell personal data, and we do not use your business's operating data or your customers' data for any purpose of our own other than providing the service to you.
5. The AI assistant
When you use AI features (such as "Ask about your business" or "Products from a photo"), our server sends the model provider, Anthropic, only what the answer needs:
- The sales figures, products, prices and stock the question needs, or the photo you took.
- We do not send your customers' names, mobiles or addresses, or any passwords.
- Under its commercial terms, Anthropic does not use this data to train its models.
- Nothing the AI proposes is saved in your system until a user reviews and accepts it.
These features are optional; the owner may leave them unused or limit them to chosen users.
6. Who we share data with
We share data only with the following, and only as much as each needs:
| Recipient | Purpose | Location |
|---|---|---|
| Oracle Cloud Infrastructure | Hosting the servers, database and backups | Riyadh, Saudi Arabia |
| Tap Payments | Collecting subscription card payments | GCC |
| Brevo | Sending e-mails (confirmation, invoices, reminders) | European Union |
| Anthropic | AI features, as in section 5 | United States |
| Google (Analytics) | Website visit statistics only, no app data | United States |
| ZATCA / Egyptian Tax Authority | E-invoices the law requires to be sent | Saudi Arabia / Egypt |
| Courts and regulators | Only on a binding legal request | — |
Our providers are bound to protect the data and use it only for the stated purpose. If the service changes ownership or merges, the data moves with it under the same safeguards, and we will tell you.
7. Where data is kept, and transfers abroad
- The database and its backups are kept in Oracle's data centre in Riyadh, Saudi Arabia.
- Customers in Saudi Arabia: your data stays in the Kingdom, except what is sent to the providers in section 6 as needed, under the regulation on transferring personal data outside the Kingdom.
- Customers in Egypt: keeping data in Riyadh is a transfer outside the Arab Republic of Egypt. We do so under Article 14 of Law No. 151 of 2020 and its Executive Regulations, and we undertake to obtain the licence or permit the Personal Data Protection Center requires, with a level of protection in the Kingdom no lower than Egypt's.
8. How long we keep data
- Account and operating data are kept for as long as you subscribe.
- If the subscription ends or is cancelled we do not delete your data automatically, so you can return or export it, unless you ask us to delete it (section 10).
- Tax invoices and their records are kept for the period the tax law of the business's country requires, even after a deletion request, then deleted.
- Daily backups are kept 30 days, then deleted automatically.
- Accounts registered but never activated may be deleted after a reasonable time.
9. How we protect data
- Encrypted connections (HTTPS/TLS) between the apps and the server.
- Passwords and PINs stored hashed, with temporary lock-out after repeated failed sign-ins.
- Each business's data fully isolated from every other's in the database.
- E-invoicing keys and tokens on tills kept in the operating system's secure storage.
- Per-user permissions set by the owner, and an audit log that is never changed.
- Daily backups inside the Kingdom.
No system is 100% secure: keep your password and PIN private, and stop any lost device or departed user from the back office.
10. Your rights
Under Saudi and Egyptian law you may ask:
- To be informed of the data we hold about you and how we use it.
- For access to it and a copy in a readable format.
- For correction, completion or update; most of it you can edit yourself in settings.
- For deletion once it is no longer needed, except what the law requires us to keep.
- To withdraw consent to any processing based on consent, such as marketing messages.
- To object to processing where the law allows.
Send your request through the contacts in section 16. We may ask for proof of identity first, and we answer within 30 days at most. If you are not satisfied, you may complain to the Saudi Data & AI Authority (SDAIA) in Saudi Arabia, or to the Personal Data Protection Center in Egypt.
11. Your business's customers and employees
When you enter your customers' or employees' data in ICASH, you (the business owner) are responsible for it as its controller, and you must:
- Collect it lawfully, tell the people concerned, and obtain their consent where needed, especially for marketing.
- Enter only what you actually need. Note that some employee documents, such as health certificates, are sensitive data with stronger protection.
- Pass to us any request from those people that needs our technical help.
We, for our part, process it only to provide the service to you, protect it as in section 9, and tell you without delay of any incident affecting it. Details are in the Terms of Use.
12. Cookies and local storage
- Website: Google Analytics uses cookies to measure visits and events such as clicks on the WhatsApp or free-trial buttons. You can block them in your browser or with the Google Analytics opt-out add-on; the site keeps working.
- App: stores on your device only what it needs to work: the sign-in session, offline working data, and orders waiting to sync. The app uses no advertising cookies.
13. Data incidents
If personal data is leaked or accessed without authorisation, we act at once to contain it, notify the competent authority (SDAIA in Saudi Arabia or the Personal Data Protection Center in Egypt) within 72 hours of becoming aware of it as the law requires, and notify you and the people affected in the manner and time the law sets.
14. Minors
The service is for businesses and is not directed at anyone under 18; we do not knowingly collect their data.
15. Changes to this policy
We may update this policy. We publish the new version here with its date, and for material changes we notify you by e-mail or in the app before they take effect.
16. Contact
For any question or request about your data:
- E-mail:
- WhatsApp: +966 50 846 4416
The Arabic version of this policy prevails over this English translation in case of any difference.