Who we are
ZATCA Tools is a cloud e-invoicing platform that helps Saudi businesses issue invoices compliant with Phase 2 (Integration) of the Zakat, Tax and Customs Authority's requirements. Contact:[email protected].
The data we collect
- Business data:Name, VAT number, CR number, national address, and the certificates used to connect to the Fatoora platform.
- User data:Email address and name, for signing in (no passwords — temporary verification codes).
- Invoice data:Line items, amounts and customer details (name, VAT number for businesses, mobile number) that the regulation requires on an invoice.
- Connected store data (Shopify, for example):When you connect your store we receive the details of paid and refunded orders — products, amounts, and the buyer's name, mobile number and email — for two purposes only: issuing tax invoices and notes automatically, and emailing the buyer their copy. We read nothing beyond that, and our access to your store is read-only on orders.
How we use the data
- Issuing, signing and reporting electronic invoices and notes to the Zakat, Tax and Customs Authority — a legal obligation.
- Running your account and providing support.
- We never sell your data and never share it with any third party for marketing purposes.
Data sharing
Invoice data is shared with the Zakat, Tax and Customs Authority only, as the regulation requires (reporting and clearance), and our data is hosted with cloud infrastructure providers holding recognised security certifications. Nothing else is shared except under legal order.
Retention and deletion
Tax invoices and notes are statutory records that VAT law requires to be kept for a set number of years, so they remain stored even if you disconnect your store or ask for an individual buyer's data to be deleted. When our app is removed from your store, the connection credentials (access tokens) are permanently deleted within 48 hours and no new data is received from that moment. To close your account permanently, contact us.
Data security
All traffic is encrypted (TLS); certificates, keys and access tokens are stored encrypted; and access to our APIs is governed by scoped keys and a verified digital signature on every store notification.
Your rights
You may view and correct your data and export your invoices (XML / PDF) from the platform at any time, and request deletion of anything not subject to a statutory retention period throughContact us.
Changes to this policy
Any material change to this policy will be published here, with the "last updated" date at the top of the page changed accordingly.