Privacy Policy — Clouds Line

01Who we are

This website and the products described here are operated by Clouds Line for Information Technology (شركة خطوط السحاب لتقنية المعلومات), a company established in Riyadh, Kingdom of Saudi Arabia — “Clouds Line”, “we”, “us”.

We design and build websites and mobile apps, provide hosting and domains, and operate two cloud products: Basmtak HR (basmtak.com) and Basmtak Books (books.basmtak.com), an accounting and e-invoicing system for businesses.

For data we collect for our own purposes — for example when you contact us or open an account — we are the data controller. For data that our business customers enter into our products about their own employees, customers and suppliers, the business is the controller, and we process that data on its behalf and on its instructions.

02What this policy covers

This policy applies to:

the website clouds-line.com;
the services we deliver to clients — websites, apps, hosting, domains, design and marketing;
our products Basmtak HR and Basmtak Books, together with any privacy notice published inside the product itself;
the WhatsApp Business integration in Basmtak Books, including the Meta app that a business authorises when it connects its WhatsApp Business Account.

It does not cover websites or services run by others that we link to or work with, such as Meta, WhatsApp or payment providers. Their own policies apply there.

03Information we collect

We collect only what we need for the purposes described in this policy:

Contact details you give us — your name, phone number, email address and the content of your inquiry when you call, email, fill in a form or message us on WhatsApp.
Account and business details — when you sign up for a product: your name, email and mobile number, your business's name, address, commercial registration and VAT number, and your subscription and billing records.
Content you put into our products — for example, in Basmtak Books: your customers and suppliers and their contact details, invoices, quotes, statements, payments and other accounting records.
WhatsApp Business data — described in full in the next section.
Technical data — IP address, browser and device type, pages requested, dates and times, and security and audit logs of actions taken in an account.

We do not buy personal data from data brokers, and we do not ask for sensitive personal data through this website.

04WhatsApp Business data in Basmtak Books

Basmtak Books lets a business connect its own WhatsApp Business Account through Meta's Embedded Signup and send its own documents — invoices, quotes, credit and debit notes, account statements, payment reminders and payment confirmations — to its own customers, from its own number. We act as a technology provider: the business decides who is messaged and why, and we carry out the sending it asks for.

When a business connects its account, we receive from Meta:

the identifiers of the business portfolio, the WhatsApp Business Account and the phone number;
the number's display phone number, verified name, quality rating and messaging limit;
an access token limited to the permissions the business granted (whatsapp_business_management and whatsapp_business_messaging), which we store encrypted;
the names, languages, categories and review status of the message templates we create in that account.

When messages are sent and received, we process:

the recipient's phone number and the details that fill the message template — the customer's name, the document number, amount and due date, and a link to view the document;
Meta's message identifier, the delivery status it reports (sent, delivered, read or failed), any error, and the pricing category;
what the recipient sends back to the connected number — button replies such as accepting or declining a quote, requests to stop, and the text of the reply;
the record of the recipient's consent: when it was given, who recorded it and how, and when it was withdrawn.

What we do not do:

We do not receive your Facebook password, and we do not access your personal Facebook profile, friends, posts or personal WhatsApp chats.
We do not send marketing or promotional messages, or any message the business did not ask us to send.
We do not sell this data, share it with other businesses, or use it for advertising or profiling.
We do not use message content or recipients' phone numbers to train artificial-intelligence models.
We do not use this data for any purpose other than providing the messaging the business asked for, showing the business its delivery status, and keeping the service secure.

Messages are delivered by WhatsApp, a service of Meta Platforms. Meta processes them under its own terms and privacy policy, and bills the business directly for the messages it sends.

05How we use information

We use personal data to:

answer inquiries, prepare proposals and deliver the services you request;
create and run your account, and provide, maintain and support our products;
send, on a business's instruction, the documents and reminders it chooses to send to its customers, and record whether they were delivered;
keep our systems secure, prevent abuse and investigate faults;
issue invoices, keep our accounts, and meet our legal and tax obligations;
tell you about changes to the service, your subscription or these policies.

We rely on the performance of our contract with you, on your consent where we ask for it, on our legal obligations, and on our legitimate interest in running a secure service. We do not sell personal data and we do not use it for third-party advertising.

06Who we share it with

We never sell personal data. We share it only with:

Meta Platforms (the WhatsApp Business Platform) — to deliver the WhatsApp messages a business sends and to report their status;
hosting, backup, email and SMS delivery providers that run our infrastructure, under contracts that require them to protect the data and to use it only for us;
payment providers — when you pay us, or when a business enables payment links for its own customers;
government authorities — where the law requires it, for example the invoices a business reports to the Zakat, Tax and Customs Authority (ZATCA), or a lawful request from a competent authority;
professional advisers, or a successor to our business in a merger or acquisition, under the same protections as this policy.

07Where data is stored and international transfers

Data is stored on secured cloud servers operated by our hosting providers. Messages sent through WhatsApp are processed on Meta's infrastructure, which may be located outside Saudi Arabia.

Where personal data is transferred outside the Kingdom, we do so in line with the Saudi Personal Data Protection Law and its regulations on transfers, and only to the extent needed to provide the service.

08How long we keep it

We keep personal data only for as long as the purpose it was collected for requires:

Inquiries and correspondence — while we handle your request, and for a reasonable period afterwards in case you come back to us.
Product accounts and their content — for the life of the subscription. When it ends the business can still export its data, and we delete it when the business asks, unless the law requires us to keep it.
WhatsApp access token — deleted immediately when the business disconnects WhatsApp.
WhatsApp message log, recipients' numbers and consent records — kept as part of the business's records while its account exists, and deleted within 30 days of a deletion request.
Invoices, accounting and tax records — for the periods Saudi law requires.
Backups — deleted data leaves our backups as they expire on their normal cycle.

09How to delete your data

You can ask us to delete your data at any time, free of charge. Here is how.

If your business connected WhatsApp to Basmtak Books:

In Basmtak Books, open Settings → WhatsApp Business and press Disconnect. We stop sending immediately, unsubscribe our app from your WhatsApp Business Account and delete the access token at once.
To withdraw our app's access on Meta's side as well, remove it from the business integrations in your Facebook account settings (Settings → Business integrations), or from the connected apps in your Meta Business settings.
To delete the message log, recipients' phone numbers and consent records, email info@clouds-line.com with the subject “Data deletion request” from the address registered on your account, and name your business. We confirm receipt and complete the deletion within 30 days.

If you received a WhatsApp message that a business sent through Basmtak Books:

Reply STOP (or «إيقاف») to that message. The business can then no longer message you through Basmtak Books.
To have your phone number and message records deleted, contact the business that messaged you, or email info@clouds-line.com with your number and the name of the sender. We carry out the deletion with that business within 30 days.

For anything else — a website inquiry, a product account or any other data we hold about you:

Email info@clouds-line.com or call 9200 321 39 and tell us what you want deleted. We may ask for enough information to confirm who you are, and we complete the deletion within 30 days.

We keep only what the law obliges us to keep — such as tax invoices and accounting records — and a minimal record of the request itself. We tell you if anything is kept, and why.

10Your rights

Under the Saudi Personal Data Protection Law, and any other law that applies to you, you have the right to:

be told how your data is used — which is the purpose of this policy;
access your data and receive a copy of it;
have inaccurate or incomplete data corrected;
have your data deleted when it is no longer needed;
withdraw a consent you gave, at any time.

To use any of these rights, write to info@clouds-line.com. We reply within 30 days. If the data belongs to a business that uses our products, we pass your request to that business and help it respond. If you are not satisfied with our answer, you may complain to the Saudi Data and AI Authority (SDAIA).

11Security

We protect data with measures appropriate to its sensitivity:

encryption in transit (HTTPS/TLS) on all our sites and products;
access tokens and other secrets encrypted at rest and never shown on any screen;
access limited to the staff who need it, and recorded in audit logs;
verification of the signature on every notification we receive from Meta;
hardened servers, malware protection and daily backups.

No system is perfectly secure. If a breach affects your personal data, we notify you and the competent authority as the law requires.

12Cookies and similar technologies

This website does not require an account and sets no advertising or tracking cookies. It stores your language choice in your browser's local storage, and loads its typefaces from Google Fonts, which receives your IP address as any web request does.

Our products use a session cookie to keep you signed in, and store preferences such as language. These are essential to the service and are not used for advertising.

13Children

Our website and products are intended for businesses and are not directed at anyone under 18. We do not knowingly collect personal data from children. If you believe a child has given us data, contact us and we will delete it.

14Changes to this policy

We may update this policy as our services or the law change. The current version is always on this page with the date it was last updated, and we notify customers of material changes by email or inside the product.

15Contact us

Clouds Line for Information Technology — King Fahd Road, Riyadh, Saudi Arabia.

For any privacy question or request, write to info@clouds-line.com or call 9200 321 39, Sunday to Thursday, 8:00 AM – 5:00 PM.