Skip to Content

Privacy Policy

How the Raqeem platform collects, uses and protects your personal data, in line with the Personal Data Protection Law of the Kingdom of Saudi Arabia and its Implementing Regulations.

Effective date: 2 November 2026

1. Who we are (data controller)

Raqeem is a technology platform owned and fully operated by Mukaab Alhulool Establishment. The data controller is the Establishment itself; its full legal details (Commercial Registration, VAT number, national address) are published on the Legal information page.

We act as the “data controller” for your account personal data, and as a “data processor” for the content of your workspace, which we process on your behalf and on your instructions.

  • Commercial Registration: 4030602699
  • VAT number: 310165069500003
  • Privacy contact: info@cubeos.co

2. What data we collect

  • Account data: name, email, mobile number, company name and workspace (subdomain).
  • Usage and technical data: IP address, sign-in and activity logs, browser type and cookies.
  • Billing data: your plan and payments. We do not store your card numbers; payments are processed by a licensed payment provider on a secure payment page.
  • Your workspace content: what you enter into your system (customers, invoices, employees…). You are the controller of that content; we process it on your behalf to deliver the service.

3. Purposes and legal basis

  • Performance of the contract: creating your account and workspace, running the service, support and billing.
  • Legal obligation: keeping invoices and accounting records as required by the Zakat, Tax and Customs Authority (ZATCA).
  • Consent: marketing messages and non-essential cookies — you may withdraw consent at any time.
  • Legitimate interest: platform security, fraud prevention and service improvement, without prejudice to your rights.

4. Cookies

We use essential cookies for sign-in, security and remembering your language (these cannot be disabled), and we store your cookie choice in a dedicated cookie (rq_cookie_consent, 180 days). We do not currently run analytics cookies; if we enable them in future they will run only with your consent. A short-lived attribution cookie may be set if you arrive via a campaign link. You can change your choice at any time from cookie settings.

5. Sharing

We do not sell your personal data. We share it only with service providers acting on our behalf and only as needed: the licensed payment provider, the email provider and the hosting provider. We disclose it to the competent authorities where the law requires.

6. Cross-border transfer

Your primary database is hosted inside the Kingdom of Saudi Arabia, specifically in Jeddah. We may currently keep encrypted backups with a storage provider whose servers may be outside the Kingdom, for continuity and disaster-recovery only, under the safeguards of the Personal Data Protection Law and with an appropriate level of protection. This arrangement is temporary; backup storage will be moved fully inside the Kingdom later. Enterprise-plan customers can schedule their own backups and receive them directly by email or direct download.

7. Retention

We keep your account data for as long as your subscription is active. When you request account deletion, a 15-day grace period begins during which you can cancel or export your data; after it, the data is permanently deleted. Records the law requires us to keep (invoices and accounting entries) are retained for the statutory period even after the account is closed. Backups are rotated over a limited period and then destroyed.

8. Your rights

Under the Personal Data Protection Law you have the right to access your data and obtain a copy, correct it, delete it, withdraw consent, and restrict its processing. You can exercise these rights from the My data page (full export and deletion request — by request now, and self-service from your account panel when available). We respond to your request within 30 days, after verifying your identity and at no charge, and you may lodge a complaint with the Saudi Data and Artificial Intelligence Authority (SDAIA).

9. Data security

Every customer runs in a fully separate database — no shared tables and no shared files — with encryption in transit, access controls and daily backups.

10. Children

The service is intended for businesses and is not directed at children. If your workspace contains data about people below the legal age (for example minor employees), you are the controller of that data and responsible for the legal basis of its processing.

11. Data breach

If a breach occurs that may cause harm, we notify the Saudi Data and Artificial Intelligence Authority (SDAIA) and inform affected individuals within the period set by law.

12. Changes and contact

We may update this policy and will post the effective date above. For any privacy question, contact us at info@cubeos.co.