Last updated: 6 November 2026.
This policy covers all of CashHub: the POS app (Android, iPhone, iPad and Windows), the back office, sending invoices by WhatsApp and SMS, and the cashhubapp.com website with its founding-seats form. Device permissions used by the app are detailed in the app privacy policy. The Arabic version is the primary version.
Who is responsible for the data
RKEB OFFICE COMMERCIAL (مكتب آركيبي التجارية), a Saudi establishment and owner of the CashHub brand.
Commercial Registration (Unified National Number): 7039412338 · VAT No.: 300089699700003
Questions about your data: support@cashhubapp.com
National address: 7022 Al Qadisiyah, Al Yasmeen District, Riyadh 13326, Additional No. 3554, Saudi Arabia.
We are the controller for the data of business owners and their staff, which we process to run the account. For the data of a business's customers, the business is the controller, and we process it on its behalf and on its instructions to provide the service.
What we collect from the business
- Business account: legal name, Commercial Registration, VAT number, national address and branches.
- Owner and staff: name and mobile number, optional email, and permissions. Passwords and PINs are stored only as one-way hashes.
- Sign-in: a verification code by SMS to the mobile number; for the back office you can also sign in with Google, from which we take only the account identifier and email.
- Devices: device name, operating system, app version, and a random identifier the app creates.
- Sales and invoices: orders, invoices, credit and debit notes, payments, returns, shifts and inventory, plus the e-invoices (XML) and ZATCA's responses to them.
- Balance and top-ups: the top-up amount, its status and the transaction reference. You enter card details on Moyasar's page directly; they never reach us.
- Server logs: IP addresses, for security.
- The founding-seats form on the website: name, mobile number, business name, business type, city, number of branches and current system, plus the first page you opened on the site during your visit and the page you sent the form from, so we know which pages help visitors. The first page is kept in your browser (sessionStorage) until you close the tab.
- The WhatsApp button on the website: when you tap it, we count the tap with the page name and the first page of your visit only, and store nothing about you with it. Your message reaches us on WhatsApp under Meta's terms.
What we process about the business's customers
- Standard (B2B) tax invoices: the buyer's name, VAT number and address, because the law requires them. Simplified invoices carry no customer data.
- A customer's mobile number: stored only with the customer's consent, for example when they ask for their invoice by WhatsApp, join a loyalty programme, make a booking, or leave feedback and agree to be contacted. Their consent is stored with it.
- Loyalty and bookings: name, mobile number, balance and visits, if the business uses them.
- Each business links its own WhatsApp Business account through Meta, and invoices are sent from its own number over Meta's WhatsApp Business Platform.
- Meta processes the messages under its own terms and policies, including the WhatsApp Business Terms.
- We store the account and phone-number identifiers and the invoice template status; the access token is encrypted (AES-256-GCM).
- The message log holds the customer's number masked (last two digits only) and the delivery status. The full number is stored encrypted only while a retry is pending, and erased once the message settles.
- A business sends an invoice by WhatsApp only to a customer who agreed. A customer can reply STOP to stop messages; we keep a non-reversible code of the number so nothing more is sent to it.
Why we use it
To provide the service to the business: selling, issuing e-invoices and sending them to ZATCA and to the customer, reports, support, security and billing. We do not sell data, use it for advertising or marketing profiles, or share it for any advertising purpose.
Legal basis under the Personal Data Protection Law (PDPL): performing the contract with the business; legal obligations such as invoice retention; the customer's consent for their mobile number and messages; and our legitimate interest in keeping the service secure.
Where it is stored
All account, sales, invoice and customer data is stored on Alibaba Cloud servers in Riyadh (region me-central-1), Saudi Arabia. Backups are encrypted and kept in Riyadh as well.
Service providers that process data with us
Each receives only what the service needs:
- Alibaba Cloud (Riyadh, Saudi Arabia): hosting, database, encrypted backups, and the founding-seats form.
- Zakat, Tax and Customs Authority (Fatoora platform): e-invoices, as the law requires.
- Meta (WhatsApp Business Platform): the customer's number and the invoice message, when a business links its number and sends an invoice.
- Taqnyat (Saudi Arabia): the mobile number and message text, for verification codes and SMS.
- Moyasar (Saudi Arabia): balance top-ups on the website; Moyasar receives the card details.
- Sentry (Germany, EU): technical error reports from the server and the app, filtered of tokens, PINs and customer numbers.
- Google Firebase (Crashlytics and Analytics): crash reports and app usage statistics, under a pseudonymous business identifier, with no advertising signals.
- Google: Google sign-in for the back office, and the QR-code scanning library on Android.
- Shorebird: app updates, using a random install identifier and the app version.
- Apple and Google Play: app distribution, under their own policies.
- Cloudflare: hosting and protecting the cashhubapp.com website.
- Brevo: internal notification emails to our team, with no personal data.
Sentry, Firebase and Cloudflare may process the technical data described above outside Saudi Arabia, limited to what is needed. The legal basis for this transfer is the Personal Data Protection Law (Article 29) and the Regulation on Personal Data Transfer outside the Kingdom: only the minimum necessary is transferred, with appropriate safeguards that preserve the level of protection.
How long we keep it
- Invoices, financial and tax records, and the buyer details they contain: 10 years, as required by ZATCA and applicable regulations, even if the account is closed or the service is no longer used.
- Account and staff data: while the account is active, deleted when the account is deleted. A staff member's name stays on the records they created.
- WhatsApp and SMS message logs: 12 months, then deleted.
- Customer mobile numbers and loyalty data: while consent stands; deleted when it is withdrawn or on a deletion request.
- Feedback contact details: 30 days.
- WhatsApp link: while the number is linked. Unlinking erases the access token.
- Server logs: 14 days.
- Founding-seats form: one year from the date you signed up at most.
Security
- All connections are encrypted (HTTPS/TLS).
- Access tokens, and customer numbers while a message is pending, are encrypted on the server; passwords and PINs are stored only as one-way hashes.
- Each business's data is isolated from every other business at the database level.
- Backups are encrypted and kept in Riyadh.
Children
CashHub is a business tool and is not directed at children.
Your rights
Under the PDPL you can ask what we hold about you, get a copy, correct it, ask for it to be deleted, and withdraw your consent. Write to support@cashhubapp.com.
Business owners: open "Delete account" in the app, or email support@cashhubapp.com from the account's email with the subject "Account deletion request" and your business name. We confirm with you on the registered mobile number, and deletion completes within 30 days: the account, staff data, devices, the WhatsApp link, and everything else that may lawfully be deleted.
WhatsApp: unlink from the back office ("Unlink"), or remove CashHub under Facebook Business Settings → Business Integrations. The access token is erased at once.
A business's customers: contact the business itself, or write to us and we remove your number from its records. To stop WhatsApp messages, reply STOP.
Invoices and records the law requires us to keep cannot be deleted before their statutory period ends; they are deleted after it.
Founding-seats form: enter the mobile number you signed up with. From the same network (the same internet connection) you signed up on, we delete your data at once; from another network, we contact you on that number to confirm it’s yours before deleting.
Changes to this policy
If we change this policy we update the date at the top, and for a significant change we notify account owners before it takes effect.