IbraTech privacy policy

Who we are and what this policy covers

Ehteraf Al-Inshaa Co. (شركة احتراف الإنشاء), Saudi Arabia, operates IbraTech for tailoring-shop management. Our privacy contact is info@pccgroup.sa. Publishing this address does not designate a formally appointed Data Protection Officer.

Each shop manages its customer and employee records and determines why it enters them into the system. We process information needed to provide IbraTech, support the shop's account and perform integrations it requests. Customers can contact their shop about order records and contact us for help routing an IbraTech-related request.

This policy concerns application and WhatsApp onboarding data. Visits to PCC product pages and demo requests are covered by the website privacy policy linked below. Demo requests include a name and mobile number, plus any email, shop name or other details the requester chooses to provide, to follow up on the requested demonstration.

Public website pages use optional Google Analytics after the visitor accepts it; the choice can be changed through Cookie settings. The choice is stored locally in the browser, and the theme preference may be saved in a cookie and local storage. These separate IbraTech legal-document pages do not load Google Analytics, Meta's SDK or a checkout form.

Information we process

Depending on the shop's use and enabled features, this can include:

• Shop and user account information: names, contact details, organization, branch and device identifiers, permissions and subscription status.
• Business records entered by the shop: customer and dependent names, contact numbers, tailoring measurements, designs, attachments, orders, invoices, payments and related operational records. Dependent records may include children's data entered by the shop; the shop is responsible for establishing the authority and notices needed to process it.
• WhatsApp onboarding information: Meta business, WhatsApp Business Account, business phone and template identifiers, granted permissions, connection status and attempts. Authorization codes and access credentials are processed server-side to support the integration.
• Messaging information: recipient numbers and the fields required by the selected template, message identifiers, delivery states, errors, consent and usage records. Minimizing phone data in some operational logs does not remove the full number from the original customer record.
• Payment, support and diagnostic information: transaction and invoice references and outcomes, support requests, and technical request, device and error information. For hosted checkout, payment-method details are entered on the payment provider's page, not in WhatsApp onboarding fields.

Why we use information

We use information to provide shop-management and synchronization features, verify identity and permissions, connect the requested WhatsApp account, send authorized shop messages and track their status, calculate usage and verify payments, provide support, protect the service, investigate errors and meet applicable legal requirements.

Shops must provide the necessary notices, obtain permissions for processing customer data and sending WhatsApp messages, and honor opt-out requests. Having a customer's number or an order is not, by itself, permission for every type of message.

Connecting WhatsApp is optional. Withholding the permissions it requires prevents that integration from working; those permissions are not required for every IbraTech feature. Some account and operational information is necessary for the requested function, which may be unavailable without it. Information comes from the user or shop and, when the relevant integration is used, from Meta and service providers.

Meta and WhatsApp integration

Onboarding starts in IbraTech and continues in a browser using Facebook Login for Business and WhatsApp Embedded Signup. Authentication occurs with Meta; IbraTech does not ask you to enter your Facebook password into its own fields.

We receive authorized account and asset information and a code that is exchanged on the server for the access needed by the integration. Sending a message involves processing its recipient number and selected template fields and transmitting them to Meta; onboarding does not require uploading the shop's entire database to Meta.

The onboarding bridge loads Meta's SDK after validating a valid initiation link. Meta may process session information, technical events and cookies according to the integration settings and its policies. These legal-document pages themselves do not load Meta's SDK or a checkout form.

Service providers and access

Relevant information is processed by providers according to the feature used: Supabase for cloud services, authentication and storage; Vercel for website and onboarding hosting; Meta for authorization and WhatsApp messaging; Moyasar for hosted payments when enabled; and Resend for email and operational alerts. Email handling can also involve our mailbox or forwarding provider.

When shop-payment integrations with Tabby or Tamara are enabled, the required payment-request information and shop or device identifiers are transmitted; a Tabby request can also include the configured branch location. In Phase 2 electronic invoicing, signed invoice data is transmitted to the Zakat, Tax and Customs Authority (ZATCA) when submission is initiated or optional automatic reporting of simplified invoices is enabled. Generating a Phase 1 QR code alone does not transmit an invoice to ZATCA. Listing these features does not mean they are enabled or fully onboarded for production at every shop.

Authorized support personnel and providers access information needed for operations, support, security or a legal requirement. Some processing may occur outside Saudi Arabia depending on the hosting service or provider; we do not promise storage exclusively in one country. Applicable transfer arrangements and safeguards must be reviewed before the relevant processing goes live.

Security and retention

IbraTech uses identity and permission controls, encryption for its local database and server-side secret storage, and minimization of sensitive information in WhatsApp integration logs. Shops remain responsible for their devices, accounts, exported copies and printed records. No system can guarantee the complete absence of risk.

Local database encryption does not mean that every export or backup file is encrypted. Local backup and export files may contain readable records; keep them in a restricted, secure location and do not share them publicly.

Retention is determined by the purpose of the information and how long it is needed, followed by destruction without delay once that purpose ends, subject to applicable legal exceptions such as a legally required retention period or necessity connected to pending judicial proceedings. We explain the scope and reason for any exception. Calling a record financial, security or audit information does not justify indefinite retention. An onboarding link's expiry is not the retention period for account data.

Your rights and choices

You can contact us to ask about your information, request access or a copy, request correction or deletion, or withdraw consent where processing relies on it, as applicable to your request. Withdrawal does not invalidate earlier lawful processing or applicable retention obligations.

Deleting data, disconnecting WhatsApp and stopping messages are different requests. Use our deletion instructions to specify what you need. We may request the minimum information necessary to verify identity and authority before disclosing or deleting data. You may also raise a complaint with the competent data-protection authority under applicable rules.

Contact and updates

Email privacy requests to info@pccgroup.sa with the shop name, contact email and a brief explanation. Do not include access credentials or sensitive attachments in the initial email. We use the necessary information to handle and follow up on your request.

Updates will be displayed here with their date, with additional notices or permissions where required. Publishing these documents does not activate commercial messaging, establish Meta approval or appoint a Data Protection Officer.