Draft — to be reviewed by legal counsel before commercial launch.
Privacy policy
Last updated: 2026-10-11
1. Who we are
Keerki Finance is an e-invoicing platform provided by Keerki Limited ("we"). We are the controller of account holders' data and a processor of the customer data that subscribing companies enter on their behalf, under the Saudi Personal Data Protection Law (PDPL) and its Implementing Regulations.
2. Data we collect
- Account data: name, email, phone, password (hashed).
- Business data: name, VAT number, CR, national address, logo, bank details.
- Data companies enter about their customers: names, contacts, VAT numbers, addresses, invoices and payments.
- Technical data: IP address, browser, sign-in and activity logs for security.
3. Purposes and legal bases
- Providing the service (contract): creating, sending and collecting invoices and integrating with ZATCA.
- Legal obligations: keeping tax records for the statutory period (6 years).
- Security and fraud prevention (legitimate interest).
- Marketing messages: only with your consent, which you can withdraw anytime.
4. Who we share data with
Only what is necessary with: ZATCA (Fatoora), the payment gateway the company connects, our email provider, Meta (WhatsApp) when used, and our hosting provider. We do not sell personal data.
5. Where data is stored
Data is stored with Hostinger VPS (testing) in Test server — move to Oracle Cloud Riyadh before launch. Any transfer outside the Kingdom follows SDAIA-approved safeguards (standard contractual clauses) after a risk assessment.
6. Retention
Invoices and tax records are kept for 6 years as required by law; account data for the life of the subscription, then deleted or anonymised within 90 days of cancellation unless the law requires otherwise.
7. Your rights
You may be informed, access, obtain a copy in a readable format, correct, request destruction, and withdraw consent. We answer within 30 days. You can export all your data from Settings at any time.
8. Security and incidents
We use encryption, database-level isolation of each company's data and backups. If a breach occurs we notify SDAIA within 72 hours and affected people without undue delay.
9. Contact
Privacy questions or requests: support@keerki.com