1 Who We Are & Scope

Muzon Al-Raqamiya (Commercial Registration No. 7054592485, located at Riyadh, Kingdom of Saudi Arabia) operates a Software-as-a-Service (SaaS) Customer Relationship Management (CRM) platform integrated with the WhatsApp Business Platform (the "Platform", "we", "us").

This policy explains how we collect, use, protect, and share personal data, and your related rights. It applies to visitors of our website, to businesses subscribing to the Platform ("Clients" or "Tenants"), and to their account users.

2 Our Data Processing Roles

Because the Platform is multi-tenant, our role depends on the data type:

a. We act as "Controller"

For our Clients' account and user data (registration, billing, usage), we determine the purposes and means of processing and therefore act as the data controller.

b. We act as "Processor" on the Client's behalf

For a Tenant's end-customer data (their own WhatsApp contacts and the message content they manage through the Platform), the Tenant is the controller, and we process such data solely on their behalf and per their instructions. The Tenant is responsible for obtaining all required consents from its end-customers before messaging them via WhatsApp.

3 Data We Collect

Account & registration data

• Name, email, phone number, company name, and billing information.
• Login credentials and account settings.

WhatsApp integration data

• WhatsApp Business Account IDs (WABA ID), Phone Number IDs, and access tokens associated with the Tenant's account.
• Message content and contact data processed by the Tenant through the Platform, which we handle as a processor on their behalf.

Technical & usage data

• IP address, browser/device type, access logs, and interaction data for security and service improvement.

4 How We Use Data

• Provide the Platform, connect the Tenant's WhatsApp account, and enable sending/receiving messages.
• Manage subscriptions, billing, and technical support.
• Protect the Platform from fraud and abuse and ensure its security.
• Analyze performance, improve the service, and develop new features.
• Comply with legal obligations and Meta's terms.

We do not sell personal data, and we do not use end-customer message content for our own purposes or for advertising.

5 Legal Basis for Processing

We process data based on one or more of the following under the Saudi Personal Data Protection Law (PDPL) and its Implementing Regulations: performance of your subscription contract, your explicit consent, our legitimate interest in operating and securing the service, or compliance with a legal obligation.

6 WhatsApp & Meta Integration

The Platform relies on the WhatsApp Business Platform provided by Meta Platforms, Inc. When you connect your account, certain data is transferred to Meta and its processing is governed by the WhatsApp Business Policy and Meta Privacy Policy. We do not control Meta's processing of such data and recommend reviewing its policies.

7 Data Sharing & Third Parties

We may share data with a limited set of parties for operational purposes only:

• Meta: to operate the WhatsApp Business service.
• Infrastructure providers: hosting, databases, and monitoring, under agreements preserving data confidentiality and security.
• Regulators: where a legal obligation or a valid official request applies.

We require all sub-processors to maintain a level of protection no lower than that set out in this policy and applicable laws.

8 Data Retention

We retain data for the duration of your subscription and as needed to fulfill the stated purposes or our legal obligations. Upon termination, Client data is deleted or anonymized within 360 days, unless a legal obligation requires longer retention.

9 Data Security

We apply appropriate technical and organizational measures, including encryption of access tokens and sensitive credentials, access controls, logical isolation of each tenant's data, and security monitoring. However, no electronic transmission or storage can be guaranteed 100% secure.

10 Your Rights

Under the PDPL, and within the limits it sets, you have the right to access your data, request its correction or update, request deletion, object to or restrict its processing, and withdraw consent. To exercise these rights, contact us using the details in the final section. If you are an end-customer of one of our Tenants, please direct your request to the company (Tenant) you interact with, as it is the controller of your data.

11 Data Deletion

You may request deletion of your data at any time by emailing privacy@muzon.sa specifying the relevant account. We will process the request within a reasonable period and confirm completion.

For full details and step-by-step instructions, visit our Data Deletion Request page.

12 International Data Transfers

Some data may be processed or stored by providers outside the Kingdom (e.g. Meta or hosting providers). In such cases we apply the necessary safeguards in line with the PDPL and the cross-border data transfer controls issued by the competent authority.

13 Children's Privacy

The Platform is intended for business use and does not target anyone under 18 years of age, and we do not knowingly collect their data.

14 Changes to This Policy

We may update this policy from time to time. For material changes, we will update the "Last updated" date and may notify you by appropriate means. Your continued use of the Platform after an update constitutes acceptance of the revised version.

15 Contact Us

For any privacy-related question or request:

• Email: privacy@muzon.sa
• Company: Muzon Al-Raqamiya — CR 7054592485
• Address: Riyadh, Kingdom of Saudi Arabia