Privacy Policy — Mu'tamad (معتمد)

Last updated: 17 June 2026

Mu'tamad (معتمد) ("the App", "we", "us") helps Shopify merchants in Saudi Arabia issue ZATCA (FATOORA) Phase 2 compliant e-invoices automatically. This policy explains what data the App processes, why, and how it is protected. By installing the App you (the merchant) agree to this policy.

1. Information we process

• Store information: your .myshopify.com domain, store name, and the access token Shopify grants the App.
• ZATCA onboarding details you enter: VAT registration number, commercial registration number (CRN), and business address. During onboarding ZATCA issues cryptographic credentials (a CSID certificate, a secret, and a signing key) that the App generates and stores to sign your invoices.
• Order & invoice data: for each order, the line items, quantities, prices, taxes and totals, and the customer's name and email — used to produce the tax invoice and, if you choose, to email it.

2. How we use it

Solely to provide the service: to generate ZATCA-compliant invoices and credit notes, cryptographically sign them, report/clear them to ZATCA as required by Saudi law, store them, attach the invoice (and its QR code) to the Shopify order, and — only when you click "Email invoice" — send the invoice to a recipient you specify. We do not sell your data or use it for advertising.

3. Who we share it with

• ZATCA (Zakat, Tax and Customs Authority): signed invoices and credit notes are reported/cleared to ZATCA's FATOORA platform — this is a legal requirement of e-invoicing in Saudi Arabia.
• Amazon Web Services (SES): only to deliver an invoice email when you choose to send one.
• DigitalOcean: our hosting and encrypted-backup provider.

We do not share your data with any other third parties except where required by law.

4. Storage & security

• Data is transmitted over TLS/HTTPS and stored in a managed PostgreSQL database on DigitalOcean.
• Sensitive credentials — your ZATCA signing key and CSID secret — are encrypted at rest (AES‑256‑GCM). Database backups are encrypted before leaving the server.
• Each store's data is isolated; the App's internal APIs require a verified Shopify session.

5. Data retention

Invoices and credit notes are retained to meet Saudi VAT record‑keeping obligations (currently six years). When you uninstall the App or a data‑erasure request is received, we delete your data except records we are legally required to retain for the retention period.

6. Customer data & erasure requests

We honour Shopify's mandatory privacy webhooks: customers/data_request, customers/redact, and shop/redact. Merchants and their customers may request access to, correction of, or deletion of personal data, subject to the legal retention above, by contacting us.

7. International processing

Our servers are hosted in the European Union (Amsterdam). By using the App you consent to your data being processed there and transmitted to ZATCA in Saudi Arabia.

8. Changes

We may update this policy; the "Last updated" date will change. Material changes will be communicated through the App.

9. Contact

Mu'tamad
Email: support@progressive-labs.com