Privacy Policy

1.Introduction

Welcome to Shahizy.

Shahizy Establishment ("Shahizy," "we," "us," or "our") respects the privacy of users of its platforms and digital services and is committed to handling personal data in accordance with the applicable laws and regulations of the Kingdom of Saudi Arabia, including the Personal Data Protection Law (PDPL) and its Implementing Regulations.

This Privacy Policy explains how we collect, access, use, process, store, share, retain, and delete personal data, as well as the rights available to data subjects and the methods for submitting privacy-related requests.

It also explains how we handle information accessed through Google services, including Google Business Profile, when users choose to use Sanad for review management and AI-assisted responses.

This Privacy Policy applies to Shahizy's websites, applications, dashboards, and related services unless a particular service is subject to an additional privacy notice.

2.About Shahizy

Shahizy is a Saudi-based platform providing digital solutions and operational services to businesses, including electronic menus, mystery shopping, review management, AI-assisted responses, marketing solutions, and other operational services.

Legal Entity: Shahizy Establishment

Commercial Registration Number: 7052854812

Website: https://www.shahizy.com

Email: support@shahizy.com

Shahizy determines the purposes and means of processing personal data relating to its platform operations and users. Depending on the nature of a particular service and the relevant contractual arrangements, Shahizy may also act as a data processor on behalf of its business customers.

3.Information We Collect

We may collect and process the following categories of information depending on the services used and the nature of your interactions with our platform:

• Account Information: Names, phone numbers, email addresses, business information, authorized users, and access permissions.
• Service Information: Orders, subscriptions, branch details, electronic menus, user-submitted content, preferences, and configuration settings.
• Transaction Information: Invoices, transaction amounts, payment statuses, refunds, and transaction references.
• Mystery Shopping Information: Registration and qualification details, assignment information, visit records, evaluations, observations, photographs, receipts, and payment-related information.
• Communication Information: Inquiries, correspondence, support requests, complaints, and feedback.
• Technical Information: Internet Protocol (IP) addresses, browser and device information, login records, platform usage data, and performance information.
• Integration Information: Information obtained from external services that users choose to connect to Shahizy, subject to the permissions granted.
• Google Business Profile Information: Authorized business accounts, business locations, review content, review metadata, published responses, and resource identifiers necessary to provide Sanad functionality.
• Authorization Information: Technical information required to manage Google connections, including OAuth authorization tokens, connection status, and granted permissions.

We collect and process information only for specified, legitimate purposes associated with delivering our services or for other purposes permitted by applicable law.

4.Purposes of Data Processing

We may use personal data for the following purposes:

• Creating and managing user accounts and verifying access permissions.
• Providing requested services and fulfilling subscriptions and orders.
• Managing mystery shopping assignments, preparing reports, and delivering results.
• Processing payments, issuing invoices, and managing financial obligations.
• Communicating with users and providing technical and operational support.
• Improving the user experience and evaluating platform performance.
• Protecting accounts and preventing fraud, unauthorized access, and misuse.
• Managing integrations with external platforms and service providers.
• Connecting authorized business accounts and locations to Sanad.
• Retrieving and displaying Google reviews to authorized business users.
• Analyzing reviews and generating AI-assisted response suggestions.
• Publishing authorized responses to Google reviews on behalf of business users.
• Complying with applicable legal and regulatory obligations.
• Sending marketing communications where legally permitted, with applicable opt-out mechanisms.

Our processing activities rely on appropriate lawful grounds, which may include contractual necessity, legal obligations, legitimate interests where permitted, or consent when required.

5.Information Sharing and Disclosure

Shahizy may share information with third parties where reasonably necessary to provide services, fulfill customer requests, or comply with applicable legal obligations.

Such parties may include:

• Cloud hosting and technical infrastructure providers.
• Payment service providers.
• Email, messaging, and notification service providers.
• Analytics, automation, and artificial intelligence technology providers.
• Authorized operational partners and service providers.
• External integration providers, including Google, where required to perform user-authorized operations.
• Regulatory, judicial, or governmental authorities where disclosure is legally required.

Information sharing is limited to what is necessary for the relevant purpose and is subject to appropriate confidentiality, security, and contractual safeguards.

Shahizy does not sell users' personal data to third parties for commercial data-trading purposes.

Information obtained through Google Business Profile APIs is not used for personalized advertising, advertising retargeting, resale, or the creation of commercially traded data collections.

6.Sanad and Google Business Profile Integration

Sanad is a Shahizy service designed to help businesses monitor customer reviews on Google Business Profile, prepare appropriate responses, and manage the publication of those responses using artificial intelligence and user-configured settings.

Sanad integrates with official Google Business Profile APIs.

Using Sanad does not require users to disclose their Google account passwords to Shahizy.

Access to Google data is limited to the functionality requested or explicitly enabled by users and the permissions granted through Google's authorization process.

7.Connecting a Google Account and Granting Permissions

When users choose to connect their Google Business Profile accounts to Sanad, they are redirected to Google's official authorization interface using the OAuth 2.0 protocol.

Google presents the requested permissions before authorization is completed.

Users may decline authorization or revoke previously granted access.

To provide Sanad functionality, Shahizy may request the following Google OAuth scope:

https://www.googleapis.com/auth/business.manage

This scope enables access to Google Business Profile management functionality associated with the business accounts the user is authorized to manage, including operations necessary to retrieve reviews and manage responses.

Although this scope may technically provide broader management capabilities, Shahizy uses it only for the disclosed and authorized functions of Sanad.

Shahizy does not request or store users' Google account passwords.

OAuth tokens issued by Google are used to establish and maintain authorized connections and perform permitted operations, subject to appropriate security measures.

8.Google Data Accessed by Sanad

Depending on the permissions granted and the features used, Sanad may access the following information through Google Business Profile APIs:

• Business accounts the user is authorized to access or manage.
• Business names, locations, branch identifiers, and related location information necessary for account linking.
• Review identifiers and associated metadata.
• Customer star ratings.
• Published review text.
• Reviewer display names and publicly available reviewer information provided by Google.
• Review creation and update timestamps.
• Existing business-owner responses to reviews.
• Connection status, authorization information, and permissions required to operate the integration.

Sanad does not use its Google Business Profile integration to access Gmail messages, Google Drive files, Google Calendar events, or personal contacts.

Shahizy does not request access to those services for the Sanad functionality described in this Privacy Policy.

9.How Sanad Uses Google Data

Sanad uses information obtained through Google Business Profile solely for purposes directly associated with its disclosed functionality.

These purposes include:

• Identifying the business accounts and locations selected by authorized users.
• Retrieving and displaying customer reviews within the Shahizy dashboard.
• Identifying reviews that require responses according to the business's settings.
• Analyzing review content to prepare relevant responses.
• Generating response suggestions using artificial intelligence.
• Allowing users to review and approve proposed responses when manual approval is enabled.
• Publishing authorized responses through official Google APIs.
• Monitoring response publication results and handling operational errors.
• Maintaining connection security and preventing unauthorized operations.

Shahizy does not use Google data for unrelated purposes or beyond the scope of the user's authorization.

10.Automated Responses and User Authorization

Sanad may offer businesses the option to review responses before publication or enable automated responses according to their selected settings.

Connecting a Google account does not automatically authorize the publication of responses.

Automated publication requires users to explicitly select and authorize the relevant feature.

Users may configure available response settings, including response tone, signatures, rating criteria, and approval preferences.

When automated responses are enabled, Sanad may publish responses without requiring individual approval for every review, within the limits explicitly authorized by the user.

Users may disable automated responses or modify their settings using the available service controls.

Response publication takes place through official Google APIs and remains subject to Google's applicable terms, technical limitations, and policies.

11.Artificial Intelligence and Google Review Processing

Shahizy may use specialized artificial intelligence technologies, including Google Gemini, to analyze customer review text and generate suggested responses.

Providing this functionality may require transmitting review text and necessary contextual information to an artificial intelligence service provider.

Shahizy seeks to minimize the information transmitted and avoid including unnecessary personal or account information.

Such processing is intended solely to provide the AI-assisted response functionality requested by the user and is subject to applicable legal requirements and Google policies.

Shahizy does not use Google Business Profile data to build independent review databases for resale or to train general-purpose artificial intelligence models outside the authorized scope of the service.

The use of external artificial intelligence providers is subject to applicable restrictions on data sharing, processing, and permitted use.

12.Google Data Storage and Retention

Shahizy handles information received through Google Business Profile APIs in accordance with Google's applicable policies and relevant data protection requirements.

Where permitted by Google's policies, certain Google content may be temporarily cached for operational purposes, subject to a maximum retention period of 30 calendar days for content to which that restriction applies.

Temporary caching is not used to establish permanent independent archives of Google reviews, circumvent applicable storage limitations, or redistribute restricted content.

Shahizy may retain operational information separate from Google-provided content, including business configuration settings, branch mappings, subscription details, connection status, authorization events, and security records, where such retention is permitted and necessary.

These records remain subject to applicable retention and deletion requirements.

Operational records will not be used to preserve permanent copies of Google content in violation of Google's policies.

13.Disconnecting Google and Revoking Access

Users may request to disconnect their Google Business Profile accounts from Sanad through the available connection management features or by contacting Shahizy support.

When an account is disconnected, Shahizy stops initiating new operations using the revoked authorization, disables the associated connection, and revokes and removes authorization tokens that are no longer required.

Shahizy takes appropriate steps to terminate the relevant account access within the timeframes required by Google's policies.

Users may also manage and revoke access granted to Shahizy directly through their Google Account settings:

https://myaccount.google.com/connections

Disconnecting a Google account may disable Sanad features associated with the relevant business accounts or locations.

Disconnecting does not automatically delete original customer reviews or previously published business responses from Google, as that content remains subject to Google's systems and the business owner's account permissions.

14.Google Data Deletion Requests

Users may request deletion of information retained by Shahizy in connection with their Sanad integration, subject to applicable legal rights and Google policies.

Deletion requests may be submitted to:

support@shahizy.com

Shahizy may verify the requester's identity and authority to manage the relevant business account before fulfilling requests that require such verification.

Authorization data and temporary content that is no longer necessary or permitted to be retained will be deleted through appropriate procedures.

Certain operational, financial, or security records may be retained where a valid legal basis requires or permits continued retention.

Such exceptions do not authorize Shahizy to retain Google content in violation of Google's applicable API policies.

Users may also contact Shahizy to request information about connected accounts, data access, correction, or deletion in accordance with applicable laws.

15.Compliance with Google API Policies

Shahizy uses Google Business Profile APIs according to the permissions granted by users and the purposes disclosed in this Privacy Policy.

Access, use, storage, and sharing of Google data are subject to Google's applicable policies and terms, including the Google API Services User Data Policy and any additional requirements specific to Google Business Profile APIs.

Shahizy does not sell Google user data or disclose it for unauthorized advertising, data brokerage, or unrelated commercial purposes.

Information obtained from Google is not used to monitor individuals for unrelated purposes or create advertising profiles about them.

Sharing with technical service providers is limited to purposes permitted by applicable policies and reasonably necessary to provide the disclosed functionality, subject to appropriate safeguards.

Sanad is an independent service operated by Shahizy Establishment. It is not a Google product, and its use of Google APIs does not imply sponsorship, endorsement, or commercial partnership with Google.

16.Data Hosting, Processing, and International Transfers

Shahizy relies on technical infrastructure and specialized service providers to operate and deliver its digital services.

The storage, processing, and sharing of personal data are subject to applicable legal and regulatory requirements, including requirements governing data protection, international transfers, and disclosures.

Certain services may involve technical integrations or data processing by external service providers within legally and contractually permitted limits.

Where personal data is transferred, disclosed, accessed, or processed outside the Kingdom of Saudi Arabia, Shahizy will provide the disclosures required by applicable law and implement the necessary safeguards before conducting transfers subject to those requirements.

Shahizy restricts data access and processing to authorized purposes and implements safeguards appropriate to the nature of the information and associated risks.

17.Data Security

Shahizy implements appropriate technical and organizational measures designed to protect personal data against unauthorized access, modification, disclosure, loss, destruction, or misuse.

Depending on the relevant systems and services, these measures may include authentication mechanisms, access controls, secure communications, security monitoring, backup procedures, and operational recovery practices.

Authorization credentials associated with external integrations are treated as security-sensitive information.

Access to such information is restricted to authorized systems and personnel based on legitimate operational needs.

Shahizy periodically reviews its security measures to address operational requirements, relevant risks, and applicable regulatory obligations.

18.Artificial Intelligence Services

Shahizy may use artificial intelligence technologies to support certain services, including content analysis, response generation, report enhancement, and workflow automation.

These functions may involve processing user-provided content or service-related information through internal systems or specialized technology providers.

Shahizy seeks to limit the information processed to what is reasonably necessary for the intended functionality.

Google data processed through Sanad remains subject to the additional restrictions described in the Google Business Profile integration sections of this Privacy Policy.

Automated processing activities are subject to applicable legal requirements, including relevant data subject rights.

19.Mystery Shopping Privacy

Shahizy's mystery shopping services require the processing of information related to assignments, field visits, reports, and participating individuals.

This information is used to administer assignments, verify completion, evaluate deliverables, prepare reports, and determine financial entitlements.

Reports and related materials are made available only to authorized parties according to their roles and applicable access permissions.

Shahizy seeks to limit the disclosure of mystery shopper identities to participating businesses unless disclosure is legally required or otherwise permitted.

20.Third-Party Services and Integrations

Shahizy may allow users to connect their accounts with third-party platforms, including business management services, review platforms, and payment providers.

The use of such integrations is subject to the permissions granted by users and the applicable terms and policies of the relevant third parties.

Disconnecting an integration may disable related functionality without affecting legally justified retention obligations or provider-specific restrictions on stored content.

21.Cookies and Similar Technologies

Shahizy may use cookies and similar technologies to support essential website functionality, maintain sessions, remember preferences, improve performance, and strengthen security.

Non-essential cookies, where used, are managed in accordance with applicable notice and consent requirements.

Users may manage certain cookies through their browser settings or controls provided by the platform.

22.Data Retention

Shahizy retains personal data for as long as necessary to fulfill the purposes for which it was collected or to comply with applicable legal, regulatory, or contractual obligations.

Retention periods vary depending on the nature of the information, its processing purpose, and relevant legal requirements.

Information received through Google Business Profile APIs is subject to provider-specific retention restrictions, which may be shorter than those applicable to ordinary account data and operational records.

When continued retention is no longer necessary or legally justified, Shahizy takes appropriate measures to securely delete, destroy, or anonymize the relevant information.

23.Your Privacy Rights

Under the Saudi Personal Data Protection Law, and subject to applicable legal limitations and exceptions, individuals may have the following rights:

• The right to be informed about the purposes and lawful grounds for collecting and processing their personal data.
• The right to access personal data held about them.
• The right to request a copy of their personal data in accordance with applicable requirements.
• The right to request correction, completion, or updating of inaccurate information.
• The right to request destruction of personal data where permitted by law.
• The right to withdraw consent where consent is the lawful basis for processing, subject to applicable conditions.

Requests relating to these rights may be submitted through the contact channels specified in this Privacy Policy.

Shahizy handles such requests in accordance with the applicable legal procedures and timeframes.

24.User Responsibilities

Users must provide accurate information when using Shahizy services and maintain the confidentiality of their login credentials.

Users must not submit personal data relating to other individuals without an appropriate lawful basis.

Business customers remain responsible for complying with applicable data protection obligations concerning information they collect, provide, or authorize Shahizy to process on their behalf, according to their respective roles and contractual arrangements.

Users connecting Google Business Profile accounts must be authorized to manage the relevant accounts and business locations.

Such users must ensure that the permissions granted to Shahizy are within their lawful authority.

25.Children's Privacy

Shahizy's commercial services are primarily intended for businesses and individuals authorized to act on their behalf.

Our platform is not specifically designed to collect personal data directly from children.

Any necessary processing involving minors remains subject to applicable legal requirements and safeguards.

26.Changes to This Privacy Policy

Shahizy may update this Privacy Policy to reflect changes in services, data processing practices, operational procedures, or applicable legal requirements.

Updated versions will be published on the official website with the relevant last-updated date.

Additional notices will be provided where required by applicable law.

If material changes affect the use or disclosure of information received through Google services, Shahizy will provide the necessary disclosures and obtain any additional authorization required before using such information for new purposes.

27.Contact and Privacy Requests

For inquiries about this Privacy Policy, personal data requests, Google integrations, account disconnection, or data deletion, please contact:

Legal Entity: Shahizy Establishment

Commercial Registration Number: 7052854812

Email: support@shahizy.com

WhatsApp Support: +966 55 120 8552

Website: https://www.shahizy.com

Country: Kingdom of Saudi Arabia

Individuals may also submit complaints to the competent regulatory authority in accordance with applicable legal procedures.

28.Applicable Laws and Policies

This Privacy Policy is governed by the applicable laws and regulations of the Kingdom of Saudi Arabia, including the Personal Data Protection Law (PDPL), its Implementing Regulations, and other relevant legal requirements.

When using Google services and APIs, Shahizy also observes the applicable Google terms and policies, including requirements governing authorization, user data protection, and Google Business Profile API usage.

In the event of any inconsistency between this Privacy Policy and mandatory applicable legal provisions, the relevant legal provisions shall prevail.

© Shahizy Establishment. All Rights Reserved.