Privacy Policy

1) Who we are and the scope of this policy

This policy applies to the website sndfinancial.com and Sand's cloud platform, used for managing bookings, invoicing, accounting, and operations for tourism, travel companies, and related services.

When you register your establishment or invite users to the company (tenant) account, data is processed within a multi-tenant environment with logical separation between company accounts wherever technically possible.

2) Data we may collect

• Identification and contact data: name, email address, phone number, and company information.
• Account and permission data: user roles within the establishment and login sessions.
• Operational data entered by the client: bookings, clients, invoices, payments, residential/hotel units, packages, visas, flights, transport, and cost centers.
• Financial and accounting data related to system use: entries, reports, VAT settings, and activity logs within the platform.
• Technical data: IP address, browser type, error logs, and usage information to improve performance and security.

3) Purposes of data use

• Providing and operating the platform (accounting, invoicing, bookings, reports, permissions).
• Creating accounts and managing subscriptions and technical support.
• Improving service quality and performance, and detecting failures or misuse.
• Complying with regulatory requirements upon official request from competent authorities.
• Communicating about requests, offers, and important service updates.

4) Data sharing

We do not sell your personal data or your establishment's data to marketing parties. Data may be shared with trusted technical service providers (such as hosting, email, monitoring, and payment gateways when enabled) to the extent necessary to operate the platform and under appropriate confidentiality obligations.

Sand may disclose data when there is a legal obligation or an official request from a competent authority in the Kingdom of Saudi Arabia.

5) Protecting financial and operational data

We adopt reasonable technical and organizational measures to protect data from unauthorized access, loss, or alteration, in line with the platform's nature as an accounting and operations system.

The establishment account administrator is responsible for managing internal permissions and reviewing who can access invoices, reports, and sensitive data.

We recommend using strong passwords, not sharing accounts, and enabling available security options in your plan (such as two-factor authentication where available).

6) Data retention

We retain data for as long as the account or subscription remains active, or for the period necessary to provide the service and fulfill the regulatory and accounting obligations related to customer records on the platform.

When requesting account closure or deletion of specific data, requests are handled according to technical capabilities and applicable regulations, taking into account any legal or operational retention requirements.

7) Cookies

We may use cookies and similar technologies to run sessions, improve browsing, and analyze performance. You can manage cookie settings from your browser, noting that disabling some of them may affect how the platform works.

8) Your rights

• Request access to or update your personal data.
• Request correction of inaccurate data linked to your account.
• Request deletion or restriction of certain processing, subject to what regulations and the nature of accounting records allow.
• Contact us to exercise these rights via our official support channels.

9) Updates

We may update this privacy policy from time to time. The version published on the website is the authoritative one, and we recommend reviewing it periodically.