Last updated: 23 October 2026
This policy covers the CashHub point-of-sale app (Android, iPhone and iPad) and its linked dashboard. The policy for the founding-seats form on this website is on a separate page. If the Arabic and English versions differ, the Arabic version applies.
Who we are
CashHub is a point-of-sale system for restaurants and cafés, provided by Rkeb Office Commercial (مكتب آركيبي التجارية), a Saudi establishment.
Commercial Registration: 7039412338 · VAT number: 300089699700003
National address: 7022 Al Qadisiyah, Al Yasmin district, Riyadh 13326, additional number 3554, Saudi Arabia.
Privacy and data protection contact: support@cashhubapp.com
Our role
- The app is a business tool used by a business and its staff.
- The business is responsible for its customers' data; we process it on the business's behalf to provide the service.
- We process the account owner's and staff members' data to run the account.
Data the app processes
- Business account: legal name, VAT number, commercial registration, national address, and branches.
- Business owner and staff: name and mobile number; email is optional. Passwords and PINs are stored as one-way hashes (argon2id). The hashed PIN is also kept on the business's devices so staff can sign in offline.
- Phone number for verification codes: at sign-up and sign-in we send a one-time code by SMS to your mobile number.
- Sales and invoices: orders, invoices and payments (payment method, amount, and an optional reference typed by the cashier). The app is not connected to payment terminals or payment gateways and does not ask for card numbers.
- Business-to-business tax invoices: the buyer's name, VAT number and address, as required by the Zakat, Tax and Customs Authority (ZATCA).
- Customer feedback after payment (optional): the rating and a note, plus the customer's mobile number only with their explicit consent; the number is stored encrypted and deleted after 30 days.
- Device information: device name, operating system, app version, and a random identifier generated by the app. We do not read the advertising ID, IMEI, serial number or Android ID.
- Server logs: IP address, kept for 14 days for security.
What we do not collect
- Location, contacts, or photos.
- Advertising identifiers.
No ads, no tracking, no sale of data
The app shows no ads, does not track you across other companies' apps or websites, and and we do not sell data to anyone. We use Google Firebase (Crashlytics and Analytics) only for crash reports and usage statistics, with a pseudonymous business identifier and no advertising signals.
Device permissions
- Camera: only to scan the QR code on an invoice for a return; the image never leaves the device.
- Bluetooth and local network: for printers only.
Where data is stored
Account, staff, sales and invoice data, and their backups, are stored on servers inside Saudi Arabia (Alibaba Cloud, Riyadh).
Who we share it with
Only what the service needs, with:
- ZATCA (Fatoora): e-invoices, as the regulations require.
- Taqnyat: the mobile number and the verification-code text only, to deliver SMS.
- Sentry: filtered technical crash reports without personal data (error type, device model, OS version); its servers are in Germany.
- Google Firebase (Crashlytics and Analytics): crash reports and app usage statistics, using a pseudonymous business identifier instead of a name or phone number, with no advertising signals. May be processed outside Saudi Arabia.
- Meta (WhatsApp): when a business turns on WhatsApp invoices: the customer's mobile number, the message text and the invoice link.
- Shorebird: app update checks, including a random install identifier and the app version.
- Google ML Kit (Android only): the QR-code reading library, which may send technical usage and diagnostic data to Google.
- Alibaba Cloud (Riyadh): hosting and backups inside Saudi Arabia.
Sentry and Firebase may process the technical data described above outside Saudi Arabia, limited to what is needed. The legal basis for this transfer is the Personal Data Protection Law (Article 29) and the Regulation on Personal Data Transfer outside the Kingdom: only the minimum necessary is transferred, with appropriate safeguards that preserve the level of protection.
How long we keep it
- Tax records (invoices): 10 years. This is a legal obligation, so they cannot be deleted on request.
- Account and staff data: while the account is active; deleted when the account is deleted.
- Feedback contact details: 30 days; they remain in unreadable form in backups for up to about two months.
- WhatsApp and SMS message logs: 12 months.
- Server logs: 14 days.
Security
- Connections are encrypted (HTTPS) with certificate pinning.
- Customer contact details are encrypted on the server.
- Automatic on-device app backup is disabled.
Your rights
You can access and correct your data and ask for it to be deleted, under the Saudi Personal Data Protection Law. A restaurant's customer can withdraw consent to be contacted by telling the restaurant.
A business owner can delete the business account and its data from the app (open "Delete account"), or request deletion by emailing support@cashhubapp.com with the subject "Account deletion request", including the business name and the owner's registered mobile number.
- We confirm you own the account by contacting the registered mobile number before acting.
- We complete the request within 30 days: we delete the account, staff data and the business's devices, and delete or anonymise everything that may lawfully be deleted.
- Invoices and tax records are kept only for the legally required period, then deleted.
Changes to this policy
If we change this policy we update the date at the top; for material changes we notify account owners before they take effect.