Legal

Privacy Policy

What we collect, why, how we protect it, and how to use your rights under the Personal Data Protection Law.

Last updated28 September 2026

This policy explains how Naffes CRM handles personal data when you visit naffes.net, write to us, or create an account and use the app at app.naffes.net. We have kept it direct; if anything is unclear, write to hello@naffes.net.

Who we are

Naffes CRM is a customer relationship management system delivered online. In this policy, "Naffes", "we" and "us" mean the operator of naffes.net and app.naffes.net.

For anything about your personal data, write to hello@naffes.net.

Our two roles

Under the Personal Data Protection Law (PDPL) we handle personal data in two capacities:

Controller of the data we collect for our own purposes: messages sent through our contact form, your account, and billing. This policy covers that data in full.
Processor of the data our customers keep in their Naffes CRM workspaces about their own customers and contacts. The customer is the controller of that data; we process it on their behalf and on their instructions, only to provide the service. See data our customers keep in the app.

When you visit naffes.net

Language choice. When you pick Arabic or English, your browser keeps the choice in its local storage (the naffes-lang entry) so the site opens in your language next time. It stays on your device and is not sent to us.
Analytics, only with your consent. If you accept analytics cookies, we use Google Analytics to measure how the site is used: Google receives data such as your IP address, browser type and the pages you visit, and sets its own cookies. It is not loaded before you agree, and the site shows no advertising. Details are in our Cookie Policy.
Technical data. Like any website, the servers that deliver our pages receive technical data such as your IP address, browser type and the page requested. It is used to run and protect the site.
Fonts from other services. Some pages load fonts from Google Fonts and Fontshare. To send the font files, these services receive your IP address and basic browser details.

When you write to us

When you send the contact form, we store what you enter: your name, email address and message, plus the company name, phone number and subject if you add them. We also store the page language, your IP address and the time of sending, so we can reply in your language and protect the form from abuse.

Messages are kept in our database and are read only by the Naffes team members responsible for replying. If you email hello@naffes.net directly, we keep your message and address for the same purpose.

When you create an account and use the app

Sign-up details. Your name, email address, company name and a password. We store the password only as a one-way hash, which cannot be turned back into the password.
Signing up with Google or Microsoft. If you choose this, the provider shares your name, email address and basic profile with us, and no password is needed.
Verification. We send a code or link to confirm your email address. The sign-up page uses Google reCAPTCHA to block automated sign-ups; it processes data from your browser under Google's terms.
Workspace set-up. Your browser's time zone, so dates and reminders show in your local time, and the email addresses of any colleagues you invite.
Billing. Subscriptions are paid through the Tap payment gateway. You enter your card details on Tap's payment page, so we never receive the full card number. We keep the card reference Tap gives us, the card brand, its last four digits and its expiry date, so we can renew your subscription and show you the saved card. We also keep your invoices and payment history.
Security logs. We record events such as sign-ins and administrative actions, with the IP address and time, to protect your account and investigate misuse.
Service emails. We email you about your account, for example verification, welcome and billing messages.

Data our customers keep in the app

Our customers keep data about their own customers and contacts in their workspaces, or bring it in through integrations they switch on. For example:

Contacts and companies: names, email addresses, phone numbers, job titles and addresses.
Deals, quotes, invoices and documents.
Tasks, notes, comments and meetings.
Email from mailboxes that users connect, and calls and WhatsApp conversations, including recordings and transcripts where these are turned on.
Form and survey responses, and leads from connected ad platforms such as Meta lead ads.
Engagement data, such as clicks on links in emails sent from the app, and where a lead came from.

For this data the customer is the controller. The customer is responsible for having a lawful basis to collect it and for informing the people it concerns. We process it only to provide, secure and support the service for that customer, and we do not sell it.

When an AI feature is used, such as summarising records, sorting incoming email or transcribing a call recording, the content that task needs (the text, or a call's audio for a transcript) is sent to the AI model provider we use for that feature, which returns the result.

Why we use personal data

To answer your messages and requests, because you asked us to.
To create your account and provide the service under our agreement with you, including billing and support.
To protect the service and its users from fraud, automated sign-ups and misuse.
To meet our legal obligations, such as invoicing and tax requirements.
To send you service emails about your account.
To measure how the site is used and improve it, with your consent.

We do not sell personal data and we do not use it for targeted advertising. Where we rely on your consent, you can withdraw it at any time; this does not affect processing that took place before.

Where data is stored, and transfers outside the Kingdom

We store the service's data with the cloud hosting provider we contract with. If providing the service requires personal data to be transferred outside the Kingdom of Saudi Arabia or processed there, we do so only as the Personal Data Protection Law and its regulations allow, with the safeguards they require.

If you run Naffes CRM on your own servers (self-hosting), your workspace data stays on infrastructure you control.

How long we keep data

We keep personal data only as long as the purpose it was collected for requires, or as long as the law obliges us to, and then delete it or make it no longer identify you.

Contact messages: for as long as we need them to follow up on your request.
Account and workspace data: for as long as the subscription lasts. The workspace owner can ask to delete the workspace from the app's settings; it stays for 30 days after the request, during which the deletion can be cancelled, and its data is then deleted from the service.
Invoices and payment records: for the period accounting and tax laws require.
Security logs: for as long as needed to protect the service and investigate incidents.

Copies of deleted data may remain in backups, and in the archive copy of a workspace we take as a safeguard just before its final deletion.

How we protect data

Connections between your browser and our servers are encrypted (HTTPS).
Passwords are stored as one-way hashes.
Each workspace's data is kept separate from every other workspace's, and access inside a workspace follows the roles and permissions its owner and admins set.
Two-step verification is available, and sign-ins and sensitive actions are recorded in audit logs.
Naffes staff enter a workspace only to provide support, fix a problem or protect the service, and that access is logged.

No protection is perfect. If an incident affects your personal data, we will inform you and the competent authorities as the law requires.

Your rights

The Personal Data Protection Law gives you rights over your personal data, including:

To be informed how and why your data is collected; this policy does that.
To access your data and get a copy of it.
To correct your data, or have it completed or updated.
To deletion of your data once it is no longer needed, unless a law requires us to keep it.
To withdraw consent where processing is based on it.

To use any of these rights, email hello@naffes.net, from the address we have on file if you can. We may ask you to confirm your identity first, and we will reply within the period the law sets.

If your data is held in one of our customers' workspaces (for example, you are one of their contacts), send your request to that customer, as the controller of that data; the app lets them correct or delete a contact's data. If your request reaches us, we will pass it on to them.

A workspace owner can download a copy of the workspace's records, such as contacts, companies, deals, tasks, notes, calls, quotes and documents, from the app's settings at any time.

If you believe we have breached the law, you can complain to the Saudi Data & AI Authority (SDAIA). We would ask you to write to us first so we can put it right.

Children

Naffes CRM is a service for businesses. It is not directed at children, and we do not knowingly collect children's personal data.

Changes to this policy

We may update this policy when the service or the law changes. We will change the "Last updated" date at the top, and for significant changes we will tell account holders by email or in the app before they take effect.

Contact us

Questions about this policy or your data: hello@naffes.net.