Privacy Policy

1. Who we are

Saudi IPO (saudi-ipo.com) is a free guide to listing on the Saudi Exchange, run by Bader Aloqayli in the Kingdom of Saudi Arabia (“we”, “us”). We decide why and how the data below is used. For anything about your data, write to contact@saudi-ipo.com.

2. What we collect, and why

• Newsletter signup: your email address, the language you choose for the newsletter, which form you used, the date and time, whether you are waiting to confirm, subscribed or unsubscribed, when you accepted the Terms and Privacy Policy and which version of them and of the consent wording, a confirmation token stored only as a one-way hash that expires after 48 hours, and an unsubscribe token so each email can carry a working unsubscribe link. Why: to send you the newsletter after you confirm, and to be able to show what you agreed to. We do not use tracking pixels and we do not record whether you open an email or click a link.
• Readiness check: your answers, the company profile you enter (industry, target market, legal form, revenue, expected market value, share of shares offered to the public, number of shareholders, years operating, years of audited accounts, employees), the score we compute, and, because they are needed to see the results, your name, company, work email, optional mobile number and the time you accepted the Terms and Privacy Policy with their version. Why: to show your results and to contact you about them.
• Technical data: when you visit, Cloudflare, which hosts the site, handles your IP address and browser details to deliver and protect the site and keeps operational logs. To limit abuse of the forms we also store, for each form, a keyed one-way code made from your network address and the hour (and, for the newsletter form, a keyed one-way code made from the email address), never the address itself. These codes are deleted within three hours. Why: security and keeping the site running.
• Feedback: if you use the feedback button, we keep the note you write, an optional email address if you type one, the page you were on, the language, a coarse device type (phone, tablet or desktop) and the time. You may attach up to 3 pictures. Pictures stay private and are never published, and they are kept for 12 months with the note, then deleted. We may use your note only to improve this site. Each note, including any pictures and any email address you type, may be sent by email to the person who runs the site so they can read it and reply. If you leave an email, we use it to send one confirmation and to reply to your note, never for the newsletter or anything else. We do not share it with any third party. A note, any pictures, and any email address you type may be stored or processed by our service providers. The copy we keep is kept for 12 months from when the note is sent, then deleted, and sooner if you ask. The person who runs the site deletes the emailed copy within that period, and sooner if you ask. To limit abuse we also keep, for that day only, a keyed one-way code made from your network address, never the address itself, and then we delete the code.
• Visits: the site uses Cloudflare Web Analytics, a privacy-focused service that uses no cookies, to count visits and page performance in aggregate. Cloudflare adds a small script to each page. The script sends the page address, the referring page, the browser, the operating system, the device type and performance timings (how long the page took to load, and Core Web Vitals). The counts can be broken down by page, referrer, browser, device type and country. They are aggregate and are not tied to your name or email. The script does not read what you type into a form. We do not run advertising tools, and we do not sell this information.

3. Cookies and storage on your device

The site sets no cookies. Cloudflare Web Analytics counts visits without a cookie and without using your browser's storage. Your browser's local storage on your own device keeps your language and theme, your progress in the readiness check, the details you typed into the results form (so you do not have to type them again), and a note that the newsletter invitation has been shown. This stays on your device until you clear your browser data, and it is sent to us only when you submit a form.

4. Our basis for using your data

Your consent: for the newsletter and the readiness check. You can withdraw it at any time. For the technical data in section 2, our legitimate interest in running and protecting the site. This follows the Saudi Personal Data Protection Law (PDPL) and its Implementing Regulations; where the law of your own country applies to you (for example the GDPR in the EU or UK, or the CCPA/CPRA in California), we honour its rights too.

For a note you choose to send from the feedback button, our legitimate interest in improving the site. You can ask us to delete it at any time.

5. Who receives your data

• Service providers that run the site for us: Cloudflare (hosting, the database, security and Cloudflare Web Analytics) and, for readiness check results, Notion (the workspace where we keep a copy). Resend (the email service, sending from saudi-ipo.com) receives your email address when you sign up for the newsletter, to send you the confirmation email. Once you confirm, it also keeps your address and the newsletter language as a contact so it can deliver the newsletter. It does not receive your name. Every feedback note, including any pictures and any email address you type, may be sent by email to the person who runs the site so they can read it and reply. If you leave an email, you may also receive one confirmation. That does not add you to the newsletter.
• Authorities, when the law requires it.
• We do not sell your data, and we do not share it with third parties for their own purposes.

6. Transfers outside Saudi Arabia

Your data may be stored or processed inside or outside the Kingdom by our service providers, subject to the safeguards required by law. We use them to host the site, keep a copy of readiness-check results, deliver the newsletter and count visits. A feedback note, any pictures you attach, and any email address you type may be stored or processed by our service providers. Pictures stay private and are never published. We give each provider only what it needs, and we rely on your consent and on the safeguards the Personal Data Protection Law allows for such transfers.

7. How long we keep it

• Newsletter signups: while you are subscribed. If you unsubscribe we stop emailing you, and we delete the signup when you ask us to.
• Readiness check submissions: for as long as needed for the purposes above. We review stored records at least once a year and remove those no longer needed, and we delete yours when you ask.
• Technical logs: for the short periods set by Cloudflare.
• Feedback notes: kept for 12 months from when they are sent, then deleted, and sooner if you ask. The same period applies to the copy that may be sent by email to the person who runs the site, including any pictures and any email address you typed. The person who runs the site deletes that emailed copy within the same period, and sooner if you ask. Up to 3 pictures may be attached to a note. Pictures stay private and are never published, and they are kept for 12 months with the note, then deleted.

8. Your rights

You can ask us to tell you what we hold about you, send you a copy, correct it, delete it, or stop using it, and you can withdraw any consent at any time. Write to contact@saudi-ipo.com and we reply within 30 days. If you live in California you can also ask what we have collected and shared, and tell us not to sell or share your data; we do not sell it, and we do not treat you worse for asking. If you are unhappy with our answer you can complain to the Saudi Data and AI Authority (SDAIA) or to the authority in your country.

9. Withdrawing your agreement

Newsletter: use the unsubscribe link in any issue, or write to contact@saudi-ipo.com. To have your signup deleted, write to contact@saudi-ipo.com. Withdrawing never affects the free parts of the site.

10. Security and children

The site is served over HTTPS, access to stored data is limited to its owner through a protected sign-in, and we keep only what we need. The site is for business use by adults and is not aimed at anyone under 18.

11. Changes

If we change this policy in a way that matters, we update the date above and, where the change needs your agreement, we ask again. Contact: contact@saudi-ipo.com.