Privacy Policy

Who we are

Karum is a marketplace connecting cafes and vendors in Saudi Arabia, run by Faisal Alshaya under freelance document FL-196445179, who is the controller of your personal data. To contact us about it, email [email protected].

What we collect

• Early-access signup: business name, email, phone, business type, site language, the page you signed up on and where the visit came from.
• Account: email, name, phone and business details, including your commercial registration number if you enter it.
• Platform use: products and prices, orders, quote requests and bids, uploaded files, and messages or feedback you send us.
• Connections: if you link Odoo or Foodics, we read the product, price, stock or consumption data that feature needs.
• Technical: your IP address when you request a login code, a session cookie that keeps you logged in, and data saved in your browser such as a signup form draft.

Why we use it

• To contact you about your signup and our launch.
• To create your account and run the platform, including orders and quote requests.
• To review and approve vendor accounts and protect the platform from abuse.
• To send notifications about your account and orders.
• To send Karum updates on WhatsApp or email, if you tick the box for this. It is optional, and saying no does not affect your use of the platform.

Our legal basis

We process your data based on your consent at signup, because it is needed to provide the service you asked for, or to meet a legal duty. We keep the date of your consent and the policy version you agreed to.

Who we share it with

We do not sell your personal data. We share only what is needed with:

• Other users where a transaction needs it, such as a vendor's details on their public page or order details going to the other party.
• Service providers we rely on: Cloudflare for hosting and database, Google for signup sheets and Resend for sending email.
• Services you connect yourself, such as Odoo and Foodics.
• Government authorities when the law requires it.

Transfers outside Saudi Arabia

Our service providers may process your data on servers outside Saudi Arabia. We limit this to the data needed to provide the service.

How long we keep it

We delete early-access signup data 24 months after signup if you have not created an account, or sooner if you ask us to. We keep your account data while your account is active or while it is needed for the purpose it was collected for, or as long as the law requires. After that we delete it or make it no longer linked to you. Login codes are deleted after about a day.

How we protect it

We use encrypted connections and passwordless login with temporary codes. No protection is perfect, and we will handle any data breach as the law requires.

Your rights

You have the right to:

• Know how your data is processed.
• Access your data and get a copy of it.
• Ask us to correct or update it.
• Ask us to delete it when it is no longer needed, unless the law requires us to keep it.
• Withdraw your consent at any time, including consent to receive Karum updates.
• File a complaint with the Saudi Data and AI Authority (SDAIA).

To use any of these rights, email [email protected].

Changes

We may update this policy and will post the new version here with its effective date. If a change is significant, we will tell you before it applies.