سياسة الخصوصية

English version

The Arabic version above prevails in case of any conflict, in line with Saudi practice.

CODsure is an order-verification service operated by Datajar, Inc., a Delaware corporation (File No. 10279904), 131 Continental Dr, Suite 305, Newark, DE 19713, United States. It helps online merchants confirm cash-on-delivery orders with their customers over WhatsApp before shipping, reducing fake orders and failed deliveries. This policy is written to comply with the Saudi Personal Data Protection Law (PDPL) and with the platform policies of Salla and Meta (WhatsApp).

1. Our two roles

For merchants who install CODsure, we are a data controller of account data. For merchants' customers, we act as a data processor on behalf of the merchant you purchased from — that merchant is the controller and your primary contact for privacy requests.

2. Data we process

Merchant account data: store name, domain, contact details and profile from Salla; authentication tokens (encrypted at rest); plan, billing status and trial dates (payment is handled by Salla — we never see card details); your settings; session and technical logs.

Customer order data: name, phone, delivery address; order identifiers, amount, currency, payment method; WhatsApp interaction data including delivery/read status, button responses, a one-time code for high-value orders, any updated address, and WhatsApp-assigned identifiers.

We do not process card data, government IDs or special-category data, and the service is not directed at children.

3. Sources

Salla (order and store data via authorised webhooks), Meta's WhatsApp Business Platform (messages and responses), and merchants themselves (settings and optionally their own WhatsApp credentials).

4. Purposes and legal bases

Sending the verification message and processing the reply, and updating order status, rest on performance of the merchant's contract with their customer and on legitimate interest in fraud prevention. One-time codes rest on fraud prevention. Account operation and billing rest on our contract with the merchant. Security, abuse prevention and aggregate non-identifying statistics rest on legitimate interest. We do not sell personal data, use it for third-party advertising, or build marketing profiles from it.

5. Sharing

Meta Platforms (message transport), Salla (reading orders and writing status updates), infrastructure providers hosting within the European Union (Germany) under data-processing terms, and authorities only where the law requires. No other third parties.

6. International transfers

The company is incorporated in the United States, service data is hosted in the European Union (Germany), and some providers — including Meta — process data outside Saudi Arabia. Where PDPL-governed data is transferred abroad we do so under the PDPL's cross-border rules and only as far as necessary to provide the service.

7. Retention

Verification records: while the account is active, up to 12 months, then deleted or anonymised. Technical logs: up to 90 days. One-time codes: expire in 10 minutes, never reused. Merchant account data: deleted or anonymised within 30 days of uninstallation, except where retention is legally required.

8. Security

Salla and WhatsApp tokens are encrypted at rest with AES-256-GCM. All traffic uses TLS and inbound webhooks are cryptographically verified before processing. Production access is restricted and logged. If a breach affects your data we will notify the competent authority and affected parties as the PDPL requires.

9. Your rights

Access, correction, deletion, information about processing, and withdrawal of consent where processing relies on it. Merchants should contact us directly; customers should contact the store they purchased from, though we will route requests on request. You may complain to the Saudi Data & AI Authority (SDAIA).

10. Cookies

The merchant dashboard runs inside the Salla dashboard and authenticates with a short-lived token held in browser memory. We use no advertising or analytics cookies in the dashboard.

11. Changes

We may update this policy as the service evolves; material changes are announced to merchants via the dashboard or email with the effective date updated.

12. Contact

Datajar, Inc.
131 Continental Dr, Suite 305, Newark, DE 19713, USA
Delaware File No. 10279904
privacy@codsure.com