Privacy policy

Thurwa ("Thurwa", "we", "us") runs the platform at thurwa.io, which helps online stores track their sales and competitors, run ads, talk to their customers and publish on social media. This policy explains what personal data we collect, why, who processes it on our behalf, how long we keep it, and the rights you have under the Saudi Personal Data Protection Law (PDPL).

1. Our two roles

• For your account (you, your team and your company's subscription), Thurwa decides how the data is used. We are the controller.
• For your customers' data (the leads, shoppers and contacts you bring into Thurwa, or that reach you through your store, forms, WhatsApp or email), your company is the controller and Thurwa processes the data on your behalf and on your instructions. You are responsible for having a lawful basis to collect it and to contact those people. If you are one of those customers, contact the store first; we will help it answer your request.

2. What we collect

Your account

• Your name, email address, password (stored only as a one-way hash), preferred language, and the roles and stores your company gives you.
• Your company's name, logo, subscription plan and trial dates.
• Sign-ins and sign-outs, and a record of changes made in the dashboard, so your team can see who did what.

Billing

Payments are handled by Lemon Squeezy, which acts as the merchant of record. We never see or store your card number. We receive your subscription status, plan, invoice amounts and invoice links.

Services you connect

When you connect a service, we store the access keys it gives us (encrypted) and read only what each feature needs:

• Salla and Zid: your products, stock, orders and abandoned carts, including the shopper's name, phone and email on an order or cart.
• Ad platforms (Meta, Google, TikTok, Snapchat, X, LinkedIn): your ad accounts, campaigns, spend and results, and the ability to pause or resume campaigns when you or your rules ask.
• Social accounts (X, LinkedIn, TikTok, Snapchat, Instagram, Facebook): your profile name and the ability to publish the posts you schedule.
• WhatsApp Cloud API and SMS providers (Unifonic, Twilio): the messages you send and receive, with the phone numbers and names involved.
• Google Analytics: traffic and conversion reports for the properties you choose.

Your customers' data (processed for you)

Names, email addresses, phone numbers, city, where each lead came from, notes, conversations, and email activity: opens and clicks (through a tracking pixel and tracked links in campaign emails), unsubscribes, bounces and spam complaints.

Public store data

For competitor tracking we read the public pages of online stores you choose: product names, prices, stock and the sold counts the store shows publicly. This does not include personal data.

Support

The messages and files you send to our support team.

Our website

Basic technical data such as your IP address and browser, kept in server logs, and the cookies described below.

3. How we use it

• To run the features you use: tracking, reports, campaigns, workflows, the WhatsApp inbox, ad and social publishing.
• To send service emails: confirming your email, password resets, alerts (such as competitor price drops), the weekly summary, trial reminders and payment notices. You can stop the weekly summary and price alert emails from the link in each email.
• To bill your subscription, give support, keep the platform secure and prevent abuse.
• To understand how the website is used and improve it.

We do not sell personal data, and we do not use your customers' data for our own marketing.

4. Legal basis

We process your account data to perform our contract with you, to meet legal obligations (such as keeping invoices), and for our legitimate interest in running a secure, reliable service. Where the law requires consent, for example for optional analytics cookies, we ask for it and you can withdraw it at any time.

5. Who we share it with

We share data only with the service providers that run Thurwa for us, under contracts that require them to protect it, and with the services you choose to connect:

Provider	What for	Where
DigitalOcean (managed through Laravel Forge)	Hosting the platform and its database	United States
Amazon Web Services (Amazon SES)	Sending email	Ireland (EU)
Mailgun	Backup email delivery	United States / EU
Lemon Squeezy	Payments and invoices	United States
Cloudflare	Custom domains for your landing pages	Global network
Google Analytics / Tag Manager	Website statistics, when enabled	Global

Services you connect (Salla, Zid, Meta and WhatsApp, Google, TikTok, Snapchat, X, LinkedIn, Unifonic, Twilio) receive what is needed to carry out your instructions, such as a message you send or a campaign you pause, under their own privacy policies. We may also disclose data when the law or a competent authority requires it.

6. Transfers outside Saudi Arabia

Our servers and several providers are outside the Kingdom, as listed above. We transfer data only as the PDPL and its regulations allow, to providers that protect it to an appropriate standard, and only what each service needs.

7. Google user data

When you connect Google Ads, YouTube or Google Analytics, we use the data we receive from Google only to show you your own reports and to carry out the actions you ask for in Thurwa. Thurwa's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use it for advertising, do not sell it, and people at Thurwa do not read it unless you ask us to for support, it is needed for security, or the law requires it.

8. How long we keep it

• Account and company data: for as long as your account is active. When a company is deleted from the dashboard it can be restored; ask us and we delete it permanently within 30 days.
• Your customers' data: until you delete it, or until your company is permanently deleted.
• The log of emails we send: 60 days.
• Backups: daily copies, each kept for 14 days and then overwritten.
• Invoices: for as long as tax and accounting law requires.

9. Security

All traffic uses HTTPS. Passwords are hashed, and the access keys of every connected service are encrypted in our database. Each company sees only its own data, and team members see only the stores they are given. No system is perfectly secure; if a breach affects your personal data, we will notify you and the authorities as the law requires.

10. Your rights

Under the PDPL you can ask to be informed about how your data is used, to get access to it and a copy of it, to have it corrected or completed, and to have it deleted when we no longer need it. You can also withdraw any consent you gave. Email us at [email protected] from the address on your account; we answer within 30 days. If you are not satisfied, you can complain to the Saudi Data and AI Authority (SDAIA).

11. Deleting your data

• Disconnect a service: remove it from its page in the dashboard (stores, ad accounts, social accounts or WhatsApp). We stop using its keys at once. You can also revoke Thurwa's access from that service's own settings, for example Facebook's "Business integrations" or your Google account's "Third-party connections".
• Delete your account or company: email [email protected] from the address on your account. We confirm the request and permanently delete the data within 30 days. Copies in backups disappear within the following 14 days.
• Stop marketing emails from a store: use the unsubscribe link at the bottom of the email.

12. Cookies

• Necessary: a session cookie that keeps you signed in, a security cookie that protects forms, and one that remembers your language.
• Analytics (when enabled): Google Analytics cookies that count visits and sign-ups on our website without identifying you by name.

You can block or delete cookies in your browser; without the necessary ones you cannot sign in.

13. Children

Thurwa is a business service for people aged 18 or over. We do not knowingly collect data from children.

14. Changes and contact

When we change this policy we update the date at the top. If a change is significant, we tell account owners by email before it takes effect.

Questions or requests about your data: [email protected]