Skip to contentTalk to us
العربيةLog inStart free
Privacy, made clear

Privacy Policy

What data we collect, why, on what legal basis, how long we keep it, and who we share it with — in plain language before the legal text.

Personal Data Protection Law — Saudi ArabiaPersonal Data Protection Law — UAE
Explore your dataYour rights
Legal draft — requires review by legal counsel before publicationPrivacy Policy: a draft template with details in square brackets to be completed. Not legal advice.
Entity[LEGAL COMPANY NAME]
Commercial Registration[COMMERCIAL REGISTRATION]
Address[ADDRESS]
Effective date[EFFECTIVE DATE]
Last updated[LAST UPDATED DATE]
Version[VERSION NUMBER]
Summary

The whole policy in five sentences

We don't sell your dataYour personal data is not for sale — not today, not ever.
Your data stays in the regionHosted within the Middle East, in the region you choose.
Your customers' data is yoursWe process it only on your behalf and per your instructions.
You're in controlAccess, correction, deletion, portability, and objection in one request.
We notify you before any changeAny material change reaches you before it takes effect.
Data Explorer

Pick a data type, and we'll show you everything

Six answers per category: what we collect, why, legal basis, retention, where it's stored, and who we share it with.

Account dataWhat you give us when you sign up and manage your account.
What we collectName, email, mobile number, company name, password (stored encrypted), and SSO settings if enabled.
WhyWe create your account, manage your subscription, verify it's you, and send service and security notices.
Legal basisPerformance of our contract (Terms of Use), and legitimate interest in securing the account.
Retention periodFor the life of your account, then [DURATION] after closure, unless the law requires longer.
Where it's storedPrimary hosting region: [REGION], within the Middle East.
Who we share it with[EMAIL PROVIDER] to send notifications, and [SSO PROVIDER] if enabled. We never sell it.
Payment dataBilling details needed to charge your subscription.
What we collectCardholder name, last 4 digits, expiry date, billing address, tax ID, and invoice history. We never receive the full card number.
WhyWe charge your subscription, issue compliant e-invoices, and detect fraud attempts.
Legal basisPerformance of the contract, and compliance with tax and accounting laws.
Retention periodFor the periods required by tax and accounting laws: [STATUTORY PERIOD].
Where it's storedInvoice history in [REGION]; card data held only by [PAYMENT PROVIDER].
Who we share it with[PAYMENT PROVIDER] to process transactions, and competent authorities where required by law.
Usage dataHow you use the platform, so it runs correctly and securely.
What we collectLogin logs, IP address, device and browser type, projects and deployments, and your agent chats to fulfill your requests.
WhyWe run the service, detect abuse and breaches, and improve the product using aggregated statistics.
Legal basisLegitimate interest in operating and protecting the service; your consent for non-essential analytics.
Retention periodSecurity logs for [DURATION]; statistics are aggregated and de-identified.
Where it's storedPrimary hosting region: [REGION], within the Middle East.
Who we share it with[MONITORING PROVIDER], and [AI MODEL PROVIDER] to run the agent per [MODEL DATA USE POLICY].
Your app's customer dataWhat your app collects from your customers — you're the controller, we're the processor.
What we collectAny data your app collects: customer names and numbers, orders, appointments, addresses, and uploaded files.
WhyWe process it only on your behalf to run and host your app. We never use it for anything else.
Legal basisAs controller, you determine the legal basis; we process it under the Data Processing Agreement.
Retention periodPer your settings. After the service ends, we delete it within [DURATION] once you've exported it.
Where it's storedThe region you choose for your project: Riyadh, Jeddah, Dubai, Bahrain, or Cairo.
Who we share it withOnly the sub-processors listed in the Data Processing Agreement, under the same obligations.
CookiesSmall files in your browser. Only essential ones run without your consent.
What we collectSession ID, language and display preferences, and analytics and marketing data if you consent.
WhyWe keep you signed in, remember your preferences, and measure site performance.
Legal basisEssential: needed to provide the service. Others: your consent, which you can withdraw anytime.
Retention periodFrom end of session up to [DURATION], depending on the cookie type.
Where it's storedIn your browser, with related logs in [REGION].
Who we share it withAnalytics and marketing providers, only if you enable those categories in the preference center.
Your rights

Your data, your right — request any right in one click

Choose the right, enter your account email, and we'll reach out after verifying your identity.

Right of accessRequest a copy of the personal data we hold about you.
Request: right of access
We verify your identity before acting.
We got your requestWe'll respond within [STATUTORY PERIOD].
Right to correctionCorrect any inaccurate or incomplete data.
Request: right to correction
We verify your identity before acting.
We got your requestWe'll respond within [STATUTORY PERIOD].
Right to deletionRequest deletion of your data once it's no longer needed.
Request: right to deletion
We verify your identity before acting.
We got your requestWe'll respond within [STATUTORY PERIOD].
Right to portabilityReceive your data in a machine-readable format.
Request: right to portability
We verify your identity before acting.
We got your requestWe'll respond within [STATUTORY PERIOD].
Right to objectObject to specific processing or withdraw your consent.
Request: right to object
We verify your identity before acting.
We got your requestWe'll respond within [STATUTORY PERIOD].
These rights are guaranteed by the Saudi Personal Data Protection Law (supervisory authority: SDAIA) and the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021), as applicable to you. You also have the right to lodge a complaint with SDAIA or [COMPETENT UAE AUTHORITY].
Full text

Privacy Policy in full

Numbered sections — click any heading in the index to jump straight to it.

1About us

“Fanann” is [COMPANY LEGAL NAME], registered under commercial registration no. [CR NUMBER], with its address at [ADDRESS]. We are the controller of your account data and your use of the platform, and a processor of your app's customer data on your behalf.

2Scope of this policy

This policy applies to the Fanann website, dashboard, Fanann Agent, and mobile apps. It does not apply to the apps you build for your customers — those need their own privacy policy, and we provide a template to start from.

3Data we collect

We collect five categories of data. You can view the details of each in the “Data Explorer” above:

  • Account data: name, email, mobile number, and company name.
  • Payment data: billing details, without the full card number.
  • Usage data: logs, device, and agent conversations.
  • Your app's customer data: processed on your behalf.
  • Cookies: based on your choices.

4How we use data

  • Providing the service and running and hosting your projects.
  • Collecting subscriptions and issuing e-invoices.
  • Protecting the platform and detecting fraud and abuse.
  • Improving the product using aggregated statistics.
  • Contacting you about the service, and marketing only with your consent.

5Legal basis for processing

We process data in accordance with the Personal Data Protection Law of the Kingdom of Saudi Arabia and its Implementing Regulations (supervisory authority: the Saudi Data and Artificial Intelligence Authority, “SDAIA”), and the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021), as applicable in each case.

We rely on: performance of a contract, legal obligation, legitimate interest, and your consent where required. [Legal counsel to specify the exact basis for each purpose]

6Sharing and sub-processors

We do not sell your personal data. We share it only with sub-processors contractually bound to protect it for specific purposes, or with a competent authority where required by law. The full list is in the Data Processing Agreement.

7Cross-border data transfers

As a rule, data remains in the selected hosting region within the Middle East. If we need to transfer it outside the Kingdom, we comply with the requirements of the law and its regulations: transferring it to a jurisdiction with an adequate level of protection, or under appropriate safeguards such as standard contractual clauses, binding corporate rules, or certifications.

In the UAE, we follow the provisions of the Decree-Law and will update this section when its implementing regulations are issued. The Dubai International Financial Centre and Abu Dhabi Global Market have their own regimes.

8Retention and deletion

We retain data only as long as needed for the purpose for which it was collected, or for the period required by law, then delete or de-identify it. Retention periods for each category are in the Data Explorer: [RETENTION SCHEDULE].

9Data security

We apply appropriate technical and organizational controls: encryption in transit and at rest, least-privilege access, audit logs, and backups. If an incident affects your data, we will notify you and the competent authority within the statutory deadlines: [NOTIFICATION PERIODS].

10Your rights

You have the right to access, correction, deletion, portability, objection, and withdrawal of consent, as provided by applicable law. You can submit requests from the “Your rights” section above or via [PRIVACY EMAIL], and we will respond within [STATUTORY PERIOD].

You also have the right to lodge a complaint with SDAIA in Saudi Arabia, or with [COMPETENT UAE AUTHORITY].

11Children

The service is intended for users aged [MINIMUM AGE] and older, and we do not knowingly collect children's data. If you believe a child has provided us with their data, contact us and we will delete it.

12Changes to this policy

If we make a material change to this policy, we will notify you by email and in the dashboard [DURATION] before it takes effect, and update the “Last updated” date at the top of the page.

13Contact and Data Protection Officer

Data Protection Officer: [DPO NAME] — Email: [PRIVACY EMAIL] — Address: [ADDRESS] — Commercial Registration: [CR NUMBER].

Messaging

Questions about your data?

Our Data Protection Officer answers your privacy questions and requests. Write to us in Arabic or English.

  • We reply within [STATUTORY PERIOD]
  • We verify your identity before any disclosure
  • You can file a complaint with SDAIA or [COMPETENT UAE AUTHORITY]
Data Protection Officer[DPO NAME]
Email[PRIVACY EMAIL]
Address[ADDRESS]
Commercial Registration[COMMERCIAL REGISTRATION]

Explore more of Fanann

Data Processing AgreementOur obligations as processor of your customers' data.CookiesManage cookies and your preferences.Trust CenterSecurity, data residency and PDPL compliance.

Build your app, keep customer data private

In-region hosting and data subject rights tools — ready from day one.

Start free · No credit card · Speaks MSA & dialects

Privacy, made clear

Privacy Policy

What data we collect, why, on what legal basis, how long we keep it, and who we share it with — in plain language before the legal text.

Personal Data Protection Law — Saudi ArabiaPersonal Data Protection Law — UAE
Explore your dataYour rights
Your data at FanannEffective date: [EFFECTIVE DATE]
Draft
Account dataEncrypted
Payment dataVia payment provider
Usage dataAggregated
Your app's customer dataIn your region
CookiesWith your consent
Legal draft — requires review by legal counsel before publicationPrivacy Policy: a draft template with details in square brackets to be completed. Not legal advice.
Entity[LEGAL COMPANY NAME]
Commercial Registration[COMMERCIAL REGISTRATION]
Address[ADDRESS]
Effective date[EFFECTIVE DATE]
Last updated[LAST UPDATED DATE]
Version[VERSION NUMBER]
Summary

The whole policy in five sentences

We don't sell your dataYour personal data is not for sale — not today, not ever.
Your data stays in the regionHosted within the Middle East, in the region you choose.
Your customers' data is yoursWe process it only on your behalf and per your instructions.
You're in controlAccess, correction, deletion, portability, and objection in one request.
We notify you before any changeAny material change reaches you before it takes effect.
Data Explorer

Pick a data type, and we'll show you everything

Six answers per category: what we collect, why, legal basis, retention, where it's stored, and who we share it with.

Account dataWhat you give us when you sign up and manage your account.
1 of 5
What we collectName, email, mobile number, company name, password (stored encrypted), and SSO settings if enabled.
WhyWe create your account, manage your subscription, verify it's you, and send service and security notices.
Legal basisPerformance of our contract (Terms of Use), and legitimate interest in securing the account.
Retention periodFor the life of your account, then [DURATION] after closure, unless the law requires longer.
Where it's storedPrimary hosting region: [REGION], within the Middle East.
Who we share it with[EMAIL PROVIDER] to send notifications, and [SSO PROVIDER] if enabled. We never sell it.
Payment dataBilling details needed to charge your subscription.
2 of 5
What we collectCardholder name, last 4 digits, expiry date, billing address, tax ID, and invoice history. We never receive the full card number.
WhyWe charge your subscription, issue compliant e-invoices, and detect fraud attempts.
Legal basisPerformance of the contract, and compliance with tax and accounting laws.
Retention periodFor the periods required by tax and accounting laws: [STATUTORY PERIOD].
Where it's storedInvoice history in [REGION]; card data held only by [PAYMENT PROVIDER].
Who we share it with[PAYMENT PROVIDER] to process transactions, and competent authorities where required by law.
Usage dataHow you use the platform, so it runs correctly and securely.
3 of 5
What we collectLogin logs, IP address, device and browser type, projects and deployments, and your agent chats to fulfill your requests.
WhyWe run the service, detect abuse and breaches, and improve the product using aggregated statistics.
Legal basisLegitimate interest in operating and protecting the service; your consent for non-essential analytics.
Retention periodSecurity logs for [DURATION]; statistics are aggregated and de-identified.
Where it's storedPrimary hosting region: [REGION], within the Middle East.
Who we share it with[MONITORING PROVIDER], and [AI MODEL PROVIDER] to run the agent per [MODEL DATA USE POLICY].
Your app's customer dataWhat your app collects from your customers — you're the controller, we're the processor.
4 of 5
What we collectAny data your app collects: customer names and numbers, orders, appointments, addresses, and uploaded files.
WhyWe process it only on your behalf to run and host your app. We never use it for anything else.
Legal basisAs controller, you determine the legal basis; we process it under the Data Processing Agreement.
Retention periodPer your settings. After the service ends, we delete it within [DURATION] once you've exported it.
Where it's storedThe region you choose for your project: Riyadh, Jeddah, Dubai, Bahrain, or Cairo.
Who we share it withOnly the sub-processors listed in the Data Processing Agreement, under the same obligations.
CookiesSmall files in your browser. Only essential ones run without your consent.
5 of 5
What we collectSession ID, language and display preferences, and analytics and marketing data if you consent.
WhyWe keep you signed in, remember your preferences, and measure site performance.
Legal basisEssential: needed to provide the service. Others: your consent, which you can withdraw anytime.
Retention periodFrom end of session up to [DURATION], depending on the cookie type.
Where it's storedIn your browser, with related logs in [REGION].
Who we share it withAnalytics and marketing providers, only if you enable those categories in the preference center.
Your rights

Your data, your right — request any right in one click

Choose the right, enter your account email, and we'll reach out after verifying your identity.

Right of accessRequest a copy of the personal data we hold about you.
Request: right of access
We verify your identity before acting.
We got your requestWe'll respond within [STATUTORY PERIOD].
Right to correctionCorrect any inaccurate or incomplete data.
Request: right to correction
We verify your identity before acting.
We got your requestWe'll respond within [STATUTORY PERIOD].
Right to deletionRequest deletion of your data once it's no longer needed.
Request: right to deletion
We verify your identity before acting.
We got your requestWe'll respond within [STATUTORY PERIOD].
Right to portabilityReceive your data in a machine-readable format.
Request: right to portability
We verify your identity before acting.
We got your requestWe'll respond within [STATUTORY PERIOD].
Right to objectObject to specific processing or withdraw your consent.
Request: right to object
We verify your identity before acting.
We got your requestWe'll respond within [STATUTORY PERIOD].
These rights are guaranteed by the Saudi Personal Data Protection Law (supervisory authority: SDAIA) and the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021), as applicable to you. You also have the right to lodge a complaint with SDAIA or [COMPETENT UAE AUTHORITY].
Full text

Privacy Policy in full

Numbered sections — click any heading in the index to jump straight to it.

1About us

“Fanann” is [COMPANY LEGAL NAME], registered under commercial registration no. [CR NUMBER], with its address at [ADDRESS]. We are the controller of your account data and your use of the platform, and a processor of your app's customer data on your behalf.

2Scope of this policy

This policy applies to the Fanann website, dashboard, Fanann Agent, and mobile apps. It does not apply to the apps you build for your customers — those need their own privacy policy, and we provide a template to start from.

3Data we collect

We collect five categories of data. You can view the details of each in the “Data Explorer” above:

  • Account data: name, email, mobile number, and company name.
  • Payment data: billing details, without the full card number.
  • Usage data: logs, device, and agent conversations.
  • Your app's customer data: processed on your behalf.
  • Cookies: based on your choices.

4How we use data

  • Providing the service and running and hosting your projects.
  • Collecting subscriptions and issuing e-invoices.
  • Protecting the platform and detecting fraud and abuse.
  • Improving the product using aggregated statistics.
  • Contacting you about the service, and marketing only with your consent.

5Legal basis for processing

We process data in accordance with the Personal Data Protection Law of the Kingdom of Saudi Arabia and its Implementing Regulations (supervisory authority: the Saudi Data and Artificial Intelligence Authority, “SDAIA”), and the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021), as applicable in each case.

We rely on: performance of a contract, legal obligation, legitimate interest, and your consent where required. [Legal counsel to specify the exact basis for each purpose]

6Sharing and sub-processors

We do not sell your personal data. We share it only with sub-processors contractually bound to protect it for specific purposes, or with a competent authority where required by law. The full list is in the Data Processing Agreement.

7Cross-border data transfers

As a rule, data remains in the selected hosting region within the Middle East. If we need to transfer it outside the Kingdom, we comply with the requirements of the law and its regulations: transferring it to a jurisdiction with an adequate level of protection, or under appropriate safeguards such as standard contractual clauses, binding corporate rules, or certifications.

In the UAE, we follow the provisions of the Decree-Law and will update this section when its implementing regulations are issued. The Dubai International Financial Centre and Abu Dhabi Global Market have their own regimes.

8Retention and deletion

We retain data only as long as needed for the purpose for which it was collected, or for the period required by law, then delete or de-identify it. Retention periods for each category are in the Data Explorer: [RETENTION SCHEDULE].

9Data security

We apply appropriate technical and organizational controls: encryption in transit and at rest, least-privilege access, audit logs, and backups. If an incident affects your data, we will notify you and the competent authority within the statutory deadlines: [NOTIFICATION PERIODS].

10Your rights

You have the right to access, correction, deletion, portability, objection, and withdrawal of consent, as provided by applicable law. You can submit requests from the “Your rights” section above or via [PRIVACY EMAIL], and we will respond within [STATUTORY PERIOD].

You also have the right to lodge a complaint with SDAIA in Saudi Arabia, or with [COMPETENT UAE AUTHORITY].

11Children

The service is intended for users aged [MINIMUM AGE] and older, and we do not knowingly collect children's data. If you believe a child has provided us with their data, contact us and we will delete it.

12Changes to this policy

If we make a material change to this policy, we will notify you by email and in the dashboard [DURATION] before it takes effect, and update the “Last updated” date at the top of the page.

13Contact and Data Protection Officer

Data Protection Officer: [DPO NAME] — Email: [PRIVACY EMAIL] — Address: [ADDRESS] — Commercial Registration: [CR NUMBER].

Messaging

Questions about your data?

Our Data Protection Officer answers your privacy questions and requests. Write to us in Arabic or English.

  • We reply within [STATUTORY PERIOD]
  • We verify your identity before any disclosure
  • You can file a complaint with SDAIA or [COMPETENT UAE AUTHORITY]
Data Protection Officer[DPO NAME]
Email[PRIVACY EMAIL]
Address[ADDRESS]
Commercial Registration[COMMERCIAL REGISTRATION]

Explore more of Fanann

Data Processing AgreementOur obligations as processor of your customers' data.Learn moreCookiesManage cookies and your preferences.Learn moreTrust CenterSecurity, data residency and PDPL compliance.Learn more

Build your app, keep customer data private

In-region hosting and data subject rights tools — ready from day one.

Start free · No credit card · Speaks MSA & dialects