Privacy Policy & Data Protection

1. Introduction & Overview

Ribh (Ribh Analytics) ("we," "our," or the "Platform") is committed to protecting the privacy and security of our users and merchants on the Salla platform ("Merchant" or "User").

This Privacy Policy describes how we collect, process, store, and safeguard your data when you use our analytics application connected to your Salla store and advertising accounts across Meta, TikTok, Snapchat, Google Ads, and Pinterest.

2. Information We Collect and Sources

We collect only the analytical data strictly necessary to compute your store's Profit & Loss (P&L) statements and unit economics:

• Salla Store Data (via Authorized OAuth 2.0): Order numbers, order timestamps, fulfillment status (completed, canceled, refunded), gross order value, product SKUs and quantities, shipping courier assignments, and payment methods (Mada, Credit Card, Tabby, Tamara, Apple Pay, Cash on Delivery).
• Ad Platform Data (Meta, TikTok, Snapchat, Google Ads, Pinterest APIs): Daily campaign spend, impressions, clicks, and attributed conversions. We operate strictly with Read-Only permissions and never create, edit, or publish ads.
• Courier Remittance Statements: Delivery milestone records and uploaded remittance CSV reports from Aramex, SMSA, Saudi Post (SPL), and local logistics partners to reconcile cash-on-delivery payments.
• Merchant-Provided Financial Inputs: Cost of Goods Sold (COGS) per SKU, fixed monthly operating expenses (rent, payroll, software), packaging costs, and custom payment gateway negotiated fee rates.
• Account & Support Details: Merchant name, business email, and store identifier for authentication, system alerts, and customer support.

3. Purposes of Data Processing

We process collected data exclusively to:

• Calculate real-time net profit per individual order and across the entire store.
• Reconcile Cash-on-Delivery (COD) collections with courier remittance statements to identify unremitted or overdue funds and fee variances.
• Calculate True Net Return on Ad Spend (Net ROAS) across multi-channel advertising campaigns.
• Deliver automated financial insights on loss-making products and unprofitable campaigns.
• Provide technical customer service and platform performance updates.

4. No Sale or Commercial Sharing of Data

We strictly do not sell, rent, lease, monetize, or share your store data or customer information with any third party for commercial or advertising purposes.

Data is processed solely to provide financial analytics to your authorized account.

5. Security, Cloud Infrastructure & Saudi PDPL Compliance

We employ rigorous organizational and technical safeguards to protect your records:

• Cloud Hosting Location: All application servers and databases are hosted on secure cloud infrastructure located in Frankfurt, Germany (EU region).
• Encryption Standards: Data in transit is encrypted using TLS / HTTPS (256-bit SSL). Data at rest and API access tokens are encrypted using AES-256 standards.
• Saudi PDPL Compliance: Full adherence to the Kingdom of Saudi Arabia's Personal Data Protection Law (Royal Decree No. M/19) regarding lawful processing, confidentiality, and data minimization.
• Transactional Email Infrastructure: System transactional notifications and account alerts are delivered securely via Postmark infrastructure.
• Access Restrictions: Access is restricted to automated analytic pipelines with zero manual human inspection of merchant raw financials without explicit permission.

6. Merchant Rights & Data Retention Policy

Merchants retain full control over their financial records at all times:

• Right of Access: Review all synchronized data within the dashboard at any time.
• Right to Export: Download complete financial reports, SKU economics, and courier reconciliation logs in standard Excel / CSV formats.
• Data Retention Post-Uninstall: Upon uninstalling the application, store data is retained in a read-only state for 30 days to allow merchants to export their accounting records, after which all store data is permanently purged in compliance with Saudi PDPL regulations.
• Immediate Deletion Requests: Merchants may request immediate permanent deletion of their account records at any time by contacting hello@ribh.dev.

7. Cookies & Session Management

We use strictly necessary functional session cookies to authenticate merchant login sessions and maintain application security. We do not use third-party behavioral tracking cookies or third-party marketing pixels.

8. Policy Revisions

We may update this Privacy Policy to reflect regulatory, technical, or legal changes. Registered merchants will be notified of material changes via email or dashboard notification.