Skip to content
العربيةDownload
العربية

Legal

Privacy Policy

Rabt (نظام ربط) · rabt.systems · Effective date: 2026-10-26

This policy explains what personal data masarat alibtikar almutaqaddim Company ("we"), the provider and operator of the Rabt (نظام ربط) service ("Rabt"), processes when you visit rabt.systems or use the Rabt service, why, who receives it, how long it is kept, and the rights you have under the Saudi Personal Data Protection Law (PDPL). The Arabic text is the primary text; the English text mirrors it.

1. Who we are and our two roles

Rabt (نظام ربط), at rabt.systems, is an omnichannel customer-service platform for businesses, provided and operated by masarat alibtikar almutaqaddim Company. An organization connects its channels (WhatsApp, Facebook, Instagram, X, TikTok, email, SMS, phone calls, website chat and app and map reviews) and its team answers its customers from one place.

In this policy "we" is that company. We act in two roles:

  • Controller of the data of the people who sign in to Rabt (members), of the billing profile of organizations, and of the technical data we need to run and secure the service.
  • Processor of the data of an organization's customers: the people who write to, call or are contacted by an organization through Rabt. The organization decides why and how that data is used and is its controller. We process it only to provide the service to that organization and on its instructions. If you are a customer of an organization and want to exercise a right over your data, contact that organization; we assist it in answering.

2. Data we process

Members and account holders. Name, email address, optional phone number and photo; one-time sign-in codes (stored hashed, valid for 5 minutes); sessions and sign-in history; the member's role and activity inside the organization; push notification subscriptions and device tokens; the organization's audit log, which records who did what and when, including IP addresses.

Organization and billing data. Organization name and settings; billing profile (legal name, VAT number, commercial registration number, national address, billing email); the prepaid wallet ledger, usage records, invoices, credit and debit notes and receipt vouchers; payment gateway tokens and identifiers. We never receive or store card numbers: the card is entered in the payment provider's own secure form.

Customers' data processed for an organization. Per channel: name, phone number, email address, handle or identifier; message content and attachments; call recordings and voicemail; web chat visitor details given in the chat form; CRM records (contact fields, notes, companies, tags); campaign messages sent. Email replies sent from Rabt include an open indicator (a tiny image) that tells the organization when the customer first opened the email; only that time and a count are kept, never the customer's address or device. Inbound files are scanned for malware on our own servers.

Connected stores and business systems. When you connect your Salla or Zid store, Rabt reads — never changes — your store's customer data (customers' names, phone numbers, email addresses and addresses; their orders, invoices, payments, abandoned carts, product reviews and loyalty points) so your team sees it while replying. It is kept in Rabt in Saudi Arabia until you erase it, and stops showing as soon as you disconnect the store. Customers of marketplace orders whose details the platform hides are never matched to your contacts. When you connect your Shopify store, Rabt reads — never changes — your store's customer data (customers' names, phone numbers, email addresses, addresses, notes and custom fields, store credit balance; their orders, payments, refunds, returns, shipments and abandoned checkouts) so your team sees it while replying. It is kept in Rabt in Saudi Arabia until you erase it, stops showing as soon as you disconnect the store, and a customer's data is erased when Shopify sends us their erasure request. When you connect Wafeq, Zoho Books or Zoho CRM, Rabt reads — never changes — your customers' data there (names, phone numbers, email addresses and addresses; their invoices, payments, credit notes and refunds; in Zoho CRM their companies, deals and notes) so your team sees it while replying. It is kept in Rabt in Saudi Arabia until you erase it, and stops showing as soon as you disconnect.

Facebook, Instagram and WhatsApp. When an organization connects a Facebook Page, an Instagram professional account or a WhatsApp Business number, Rabt reads through Meta's official APIs, only with the permissions the person connecting it grants: the Page's, account's or number's name and identifier; the messages, comments, mentions and reactions customers send to it, with their attachments and the sender's name and identifier (and profile picture where Meta provides it); for WhatsApp, the customer's phone number and the number's message templates and quality rating; and the connecting person's Meta user identifier and name. Rabt uses this data only to show these conversations to the organization's team, send its replies and keep the connection working, in line with Meta's Platform Terms; it never uses it for advertising, never sells it and shares it with no one beyond the providers in section 6.

Technical data. Error events (code, reference, release, place, never message bodies, codes or tokens), service logs redacted of secrets and message bodies, traces, request data such as IP addresses and headers handled by our network provider, and raw provider webhooks stored before they are processed.

Error screen recordings. When an error that our team has not seen before (or one we had fixed and that comes back) happens in the Rabt app, in a browser or in the desktop app, the app sends a recording of the last minute of the screen before the error, so we can see what went wrong and fix it. Only one recording is made per new error, never of normal use. The recording shows the layout of the screen, the pages visited and the clicks, linked to your account and organization; every text, field and image on the screen is hidden before it leaves your device, so it never contains messages, emails, names or contact details. Password, sign-in code, API key, provider secret and payment card fields are never recorded at all. Recordings are used only to fix errors, never for advertising or profiling.

3. Why we use it

  • To provide the service: receiving, routing and answering conversations, calls and campaigns, the CRM, internal team chat and notifications.
  • To authenticate members and secure accounts, prevent abuse and investigate incidents.
  • To bill: seats, the prepaid wallet, invoices and receipt vouchers.
  • To provide support and send service messages (sign-in codes, invitations, notifications, invoices and receipts).
  • To comply with the law, including breach notification, and to protect our rights.

We do not sell personal data and we do not use it for advertising.

4. Artificial intelligence

AI is used only for automatic replies to customers and for answering phone calls, when the organization turns it on (every ticket has an AI on/off switch). The AI agent can only reply, route the conversation to a space or hand it to a human; it does not create tickets or change data. Rabt has no member-facing AI features such as suggested replies, rewriting, translation, classification or summaries.

For these uses, the organization's instructions and knowledge blocks, the messages of the current conversation needed for the reply and, for calls, the call audio are sent to our AI provider, OpenAI, outside the Kingdom of Saudi Arabia. We request that nothing be retained by the provider and the provider does not use the data to train its models. Other conversations, CRM records, members' data and payment data are not sent. We keep usage records (model, quantities, cost), not content.

5. Google user data (Gmail and Google Workspace)

Rabt's use and transfer to any other app of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements. The use of information received from Google Workspace APIs will also adhere to the Google Workspace API User Data and Developer Policy, including the Limited Use requirements.

  • What Rabt accesses. When an organization's admin connects a Gmail or Google Workspace mailbox, Rabt asks Google only for the account's email address and two permissions: reading the mailbox (gmail.readonly) and sending email from it (gmail.send). When the mailbox is connected Rabt imports its email of the last 90 days, then reads every email that arrives, with its attachments, and the mailbox's "Send mail as" addresses. Rabt never labels, moves, changes or deletes email in the mailbox.
  • What it is used for. Only to provide the features the organization sees in Rabt: each email becomes a ticket that the organization's team reads and answers in Rabt, and the replies are sent from the same mailbox and thread. When the organization turns on automatic replies, the AI agent writes a reply to the email in that conversation (section 4).
  • What it is never used for. We do not sell Gmail data, do not use or transfer it for advertising, retargeting or interest-based ads, do not use it to determine credit-worthiness or for lending, and do not use it to create, train or improve any artificial intelligence or machine learning model, ours or anyone else's. The AI provider that writes an automatic reply receives only the conversation needed for that reply; we request that it retain nothing (zero data retention), and it does not use the data to train its models.
  • Who receives it. Gmail data is transferred only as needed to provide these features (our hosting in Saudi Arabia, and OpenAI for an automatic reply the organization turned on), for security purposes such as investigating abuse, to comply with the law, or, with the user's explicit prior consent, as part of a merger, acquisition or sale of our assets.
  • Who reads it. Only the members of the organization that connected the mailbox. Our staff have no access to organizations' messages and do not read Gmail data, unless the organization asks us to for specific messages, it is needed for security purposes such as investigating abuse or a breach, or the law requires it. Error screen recordings never contain email content (section 2).
  • How it is protected. Google's access tokens are encrypted at rest with AES-256-GCM (a separate data key for each value, wrapped by a root key kept outside the database), are used only by our servers to call Google, and are never shown, logged or sent anywhere else. Email is stored in Saudi Arabia, isolated per organization by row-level security, and sent only over encrypted connections.
  • Disconnecting and deletion. An admin can disconnect the mailbox in Rabt at any time, and the mailbox's owner can remove Rabt's access at myaccount.google.com/permissions. Disconnecting destroys the stored tokens and stops the channel at once, so Rabt reads and sends nothing more from the mailbox for that organization; the grant at Google is revoked too, unless another channel connected to Rabt still signs in with the same Google account. Email already received stays in the organization's tickets until the organization erases the contact or deletes the organization (section 8), and is then irreversibly removed. To ask for the deletion of data received from Google, write to [email protected].

6. Who receives data

We use service providers only to the extent needed to provide the service. Depending on what an organization connects and uses:

  • Messaging and channel providers: Meta (WhatsApp, Messenger, Instagram), X, TikTok, Microsoft and Google (email, reviews, push), Apple (app reviews and push), licensed SMS and voice operators in the Kingdom, and the organization's own email server.
  • System email and sign-in SMS: Resend (system email), and licensed SMS providers for sign-in codes.
  • Payments: Tap Payments (card payments).
  • AI: OpenAI (section 4).
  • E-commerce lookups, only if the organization connects them: Salla, Zid, Shopify.
  • Infrastructure and operations: our hosting and object storage, Cloudflare (DNS, TLS and delivery of the website, chat widget and status page), Sentry (processor for error events, service logs, sampled traces and the error screen recordings above, hosted in Sentry's EU region in Frankfurt), and an observability collector.
  • Authorities, when the law requires it.

Several of these providers are outside the Kingdom (for example Meta, X, TikTok, Google, Apple, Resend, OpenAI, Sentry and Cloudflare), so data on those channels or services is transferred abroad as part of providing them. We transfer only the data the service needs, over encrypted connections, and keep a record of these transfers. Production data is hosted in the Kingdom of Saudi Arabia; development and test environments use test data only.

7. Payments

The wallet is prepaid. Top-ups are made by card through Tap Payments, a third-party payment provider, on its secure form; we receive the payment result and a token, not the card details. Tap sends us the organization's name and email for the payment and processes it under its own terms and privacy policy. The wallet is credited only after the payment is confirmed. Invoices and receipt vouchers are kept as financial records.

8. Retention and deletion

  • Customers' data and conversations (tickets, messages, attachments, recordings, contacts), email received from a connected mailbox included, are kept until the organization asks for erasure or deletes the organization. We do not delete them automatically. Disconnecting a channel ends Rabt's access to it and destroys its stored credentials at once (for Google accounts, section 5).
  • Erasure. On an explicit request, a contact's personal data is irreversibly anonymized after the organization's restore window (30 days by default) across the database, search, caches, logs and files. Tickets, ledger and audit rows stay without the erased values. Backups keep erased data only until they age out, at most 35 days. The owner may delete the whole organization the same way.
  • Account self-deletion. You can delete your account once you own no organization. Your email, phone, name and photo are erased, your memberships end and all your sessions are signed out; the organizations keep their records, showing you as a deleted member.
  • Deletion through Meta. The person who connected a Page, account or number can remove Rabt in their Facebook settings (Business integrations) or Instagram settings (Apps and websites) and ask there for their data to be deleted. Meta sends us the request, and we disconnect every channel that person connected, stop reading and sending through it, and erase their Meta identifier and name. Meta shows them a confirmation code: the status of the request can be checked at any time at https://app.rabt.systems/data-deletion/<code>, where <code> is that confirmation code. Conversations between an organization and its own customers belong to that organization (section 1) and are erased through it.
  • Financial and audit records (invoices, wallet ledger, audit and error logs) are kept, because the law and security require it.
  • Technical data is kept for limited periods: processed webhook payloads and delivery logs 90 days by default, system email events 180 days by default, service logs 30 days searchable and then one year archived, sessions up to 14 days after last use, sign-in codes 5 minutes. Error events, logs, traces and error screen recordings in Sentry are deleted by Sentry after its retention period, at most 90 days.

9. Security

Data is encrypted in transit; channel credentials and API keys are additionally encrypted at rest (AES-256-GCM); every organization's data is isolated by row-level security; attachments are served by short-lived signed links; inbound files are malware-scanned; sign-in uses one-time codes with limited attempts; sensitive actions need a recent code; and webhooks are signature-verified. In the event of a personal data breach we notify the competent authority and the affected organizations within the periods set by the law (72 hours for the authority).

10. Your rights

Under the PDPL you have the right to be informed, to access your data, to request a copy, to request correction, and to request destruction of your data, within the limits of the law. For your own account, contact us at [email protected]. If your data is processed for an organization (you are its customer), contact that organization: it can export all the data of a contact in one file and erase it. You may also complain to the Saudi Data and Artificial Intelligence Authority (SDAIA).

11. Cookies

The service uses only the cookies it needs: secure, HTTP-only session cookies that keep you signed in and protect against forged requests. We do not use advertising or cross-site tracking cookies.

12. Children

Rabt is a business service for organizations and their staff. It is not directed to children and we do not knowingly create accounts for them.

13. Changes

We may update this policy. The effective date above shows the current version. For material changes we notify organizations through the service or by email before they take effect.

14. Contact

masarat alibtikar almutaqaddim Company, provider of Rabt (نظام ربط) · [email protected] · rabt.systems

15. Governing law

This policy is governed by the laws of the Kingdom of Saudi Arabia, including the Personal Data Protection Law and its implementing regulations.