Draft — under review. This text is not final.
Privacy Policy
Last updated: 2026-10-13
1. Scope
This policy explains how split.pay handles personal data. Data controller: [to be completed by split.pay]
2. What we collect
Merchant account data: name, email and account details.
Participant data: a name or label and payment metadata (amount, currency, status, time).
Technical logs, including IP address and request logs, kept for 30 days.
Card data is collected by Stripe, not stored by split.pay.
3. Why we use it
To provide the split-payment service, to secure the platform and prevent fraud, to give support, and to meet legal obligations.
4. Sharing
We share data with Stripe, which processes payments and verifies merchants, and with service providers that help us run split.pay. The merchant of an order sees the status of its participants' payments. We disclose data to authorities only where the law requires.
5. Retention
Request logs are kept for 30 days. Other data is kept as long as needed for the purposes above and for legal and financial record-keeping: [retention periods to be completed by split.pay]
6. Your rights
You may ask for access to, correction of, or deletion of your personal data, where the law allows. Contact: [to be completed by split.pay]
We work to the general principles of the Saudi Personal Data Protection Law (PDPL) and the GDPR: lawfulness, a stated purpose, data minimisation, security and respect for your rights. We do not claim certification under either.
7. Cookies
Only necessary ones: the session cookie of a signed-in merchant, and your language preference stored in your browser's local storage.
8. Changes
We may update this policy. The date at the top shows the latest version.