Legal
Privacy Policy
What we collect when you use this website, why we collect it, where it goes, how long we keep it, and how to make us delete it.
Summary
The short version.
This site is an informational portfolio and direct contact service. It is not a shop, it does not create accounts, and it does not follow you around the internet.
- What we collect: the details you share with us — name, business name, phone, email, the service you require and your project details — plus the basic technical data any web server records.
- Why: to answer you, to keep a record of the conversation, and to keep the site working and free of spam.
- How long: enquiry records for up to 24 months; server and anti-spam records for up to 12 months.
- Who sees it: us, and the providers that host the site, carry our email, and provide Google Analytics 4 measurement. Nobody else. We do not sell data or use analytics here to build advertising audiences.
- Your control: ask us and we will show you what we hold, correct it, or delete it.
The rest of this page explains each of those points properly, including the parts most policies leave vague.
In detail
What we hold, and for how long.
| Information | Why we hold it | How long |
|---|---|---|
| Direct enquiries: name, business name, phone number, email address, selected service, message | To reply to you, to quote for the work you asked about, and to keep a record of what was discussed | Up to 24 months from the last contact, then deleted |
| Correspondence by WhatsApp, phone or email | The same conversation, continued on the channel you chose | The same 24 months, unless it becomes part of a client record |
| Server logs: IP address, time, page requested, browser and device type | Security, diagnosing faults, and keeping the site available | Up to 12 months, then deleted or overwritten |
| Anti-spam signals: hashed IP address, submission timing, honeypot field | To stop automated form submissions without showing visitors a captcha | The counter resets hourly; the hashed address is not kept beyond that |
| Language preference cookie wc_lang | So the site does not ask you to choose Arabic or English on every visit | 12 months, or until you clear your browser data |
| Client records: scope, invoices, correspondence, delivered files | Only if we end up working together — needed for the engagement and for tax and accounting rules | For the period Saudi tax and accounting rules require |
Nothing on this list is collected silently, and nothing on it is shared with anyone for marketing.
How it is used
What we do with it — and what we refuse to do.
Who we are
WEB CRAFT SA is a digital services practice based in the Eastern Province of Saudi Arabia, working with businesses across the Kingdom. For anything on this page, write to us at the address on our contact page and it will be handled by a person, not a ticket queue.
What we use your information for
- Answering your enquiry and providing the service you asked about.
- Preparing a quotation, scope or proposal.
- Keeping a record of work agreed and delivered.
- Keeping the website secure, available and free of automated abuse.
- Meeting tax, accounting and other legal obligations that apply to us.
Why we are allowed to
Under Saudi Arabia's Personal Data Protection Law (PDPL), we rely on your consent when you contact us, on the necessity of processing to respond to your request, and on our legitimate interest in keeping the website secure. Where the law requires a specific basis for something, we apply it. You can withdraw consent at any time by telling us to stop, though that will usually end the conversation.
What we do not do
- We do not sell, rent or trade personal data. Not to anyone, for any reason.
- We do not run advertising pixels, retargeting tags, session recording or audience profiling on this site.
- We do not send marketing email to people who did not ask for it, and contacting us does not subscribe you to any unwanted marketing.
- We do not ask for passwords, and we never ask for card details through this website or over WhatsApp. If you receive such a request claiming to be from us, it is not from us.
- We do not embed third-party widgets on this site — no chat bubble, no map embed, and no social feed. The only third-party script currently used is Google Analytics 4 for basic measurement.
Storage and sharing
Where it goes and who touches it.
Cookies and similar technology
This site sets the wc_lang cookie to remember whether you chose Arabic or English. Google Analytics 4 may also set or read analytics identifiers to measure page visits and aggregated website usage. We do not use advertising pixels or remarketing. You can block or delete analytics cookies in your browser; the site will still work.
Who else may process it
- Hosting. The website and the mailbox that receives enquiries sit with our hosting provider, which processes data on our instructions.
- Email. Enquiries are delivered to our mailbox and may pass through the provider's spam filtering.
- Google Analytics 4. We use Google's analytics service to understand page visits, traffic sources and aggregated site usage. Google may process technical data under its own terms and policies.
- WhatsApp. If you choose to message us on WhatsApp, that conversation is governed by WhatsApp's own terms and privacy policy — we do not control what their service records.
- Platforms you own. In a project we sometimes work inside accounts you control — Google, Meta, Snapchat, TikTok, Amazon, Noon, Salla, Zid. You grant that access yourself and can revoke it whenever you like.
Transfer outside the Kingdom
Our hosting and email providers may store data on servers outside Saudi Arabia. Where that happens we rely on providers that apply comparable protection, and we keep what we hold to the minimum needed. If you would rather we deleted your enquiry than hold it, ask us and we will.
Security, and the one file worth mentioning
The site is served over HTTPS. Direct communications are handled securely over encrypted channels, a timing check and a per-address rate limit. If an enquiry cannot be emailed, it is written to a private log kept outside the website directory with owner-only permissions, so it is never reachable over the web and never lost. That log is reviewed when it fills, and deleted once the enquiries in it have been handled.
Questions
Privacy questions we actually get asked.
What happens to the information I provide?
It is validated in the browser and again on the server, then emailed to our mailbox and kept as a message. If email delivery fails, it is written to a private log outside the website folder so it is not lost, and we are told it needs attention. It is not added to a database, a CRM or a mailing list.
Do you use Google Analytics or advertising pixels?
Yes. We use Google Analytics 4 to understand which pages are useful and how visitors find the site. We do not run advertising pixels or session recording. You can block or delete analytics cookies in your browser; the site will still work.
Will I get marketing email if I send an enquiry?
No. You will get a reply about what you asked. You will not be added to a list, and you will not receive newsletters, offers or follow-up sequences you did not request.
Can you delete my information?
Yes. Ask us and we will delete the enquiry, the correspondence and any record we hold that we are not legally required to keep. Where an obligation to retain something exists — an invoice for a completed engagement, for example — we will tell you exactly what is kept and why.
Do you share my details with platforms, like Amazon or Google?
Only where your project requires it and with your knowledge: for example, submitting registration details to a marketplace on your instruction. We never send your information to a platform for marketing, and we do not sell it or pass it to third parties who might.
What if I am outside Saudi Arabia?
The same rules apply. The site is aimed at businesses in the Kingdom, but nothing here changes because of where you are reading it. Where your local law gives you stronger rights than this policy describes, we will honour them.
Your rights
What you can ask us to do.
Saudi Arabia's Personal Data Protection Law gives you specific rights over your personal data, and we apply them whether or not you cite the law:
- To know. Be told what we hold about you and what we do with it.
- To access. Receive a copy of the personal data we hold on you.
- To correct. Have inaccurate or incomplete information put right.
- To destroy. Have data deleted where there is no legal reason for us to keep it.
- To withdraw consent to processing that relies on your consent.
- To object to particular processing, and to ask us to stop using your data for anything beyond answering you.
Ask by phone, WhatsApp or email using the details on our contact page. We will confirm what we are doing within a reasonable time, and we will not charge you for a request. If you are not satisfied with our answer, you have the right to complain to the Saudi Authority for Data and Artificial Intelligence (SDAIA), which supervises the PDPL.
Children
This website is intended for businesses and is not directed at children. We do not knowingly collect information from anyone under eighteen. If you believe a child has sent us information, tell us and we will delete it.
Changes to this policy
If our practices change — a new provider, a longer retention period, anything that affects you — this page is updated and the date below changes. We do not quietly rewrite it. The version published here is the one that applies.
Last updated: 28 September 2026.
Privacy
Ask us what we hold
To see, correct or delete what we hold about you, send a message — or call and ask. It is handled directly by our team, not an automated queue.
Prefer to speak directly?
Reach us directly via WhatsApp or phone to discuss your project.
We usually reply within one working day.
Before you write
Have these ready and we can give you a clear answer in the first reply:
- Your business and your city
- Whether you hold a Commercial Registration (CR)
- Whether a website or seller account already exists
- The platform you are targeting, if any
A question this page does not answer?
Ask it directly. If something here is unclear, we would rather explain it than have you guess.