Privacy at Nalpay

Information we handle

• Account and contact information, such as name, email and mobile number.
• Business-verification information, including the relevant registration, identity, licence, address, VAT and IBAN documents.
• Customer, paymentLink, subscription, payment, refund and settlement records entered or created through the service.
• Security and operational logs needed to protect accounts, diagnose errors and meet legal obligations.

Card information

Sensitive card fields are supplied directly to a PCI DSS compliant payment gateway licensed in Saudi Arabia. Nalpay does not receive or store the full card number or security code. We may retain the gateway token and limited card description, such as brand, last four digits and expiry, when needed for a saved card or subscription.

Why we use information

• To create accounts, process payments and settle eligible funds.
• To verify businesses and prevent fraud or unlawful use.
• To provide support, keep an audit trail and improve service reliability.
• To meet Saudi legal, financial and regulatory requirements.

Service providers and transfers

We share only the information needed with payment, banking, identity-verification, hosting, communications and support providers that help us deliver Nalpay. Some technical providers may process data outside Saudi Arabia under appropriate contractual and legal safeguards.

Retention and your rights

We retain information while an account is active and for the periods required for payment, tax, dispute, security and legal records. Subject to applicable Saudi law, you may ask to access, correct or delete personal information by contacting our team. Some financial records cannot be deleted before a mandatory retention period ends.

Contact

Questions or privacy requests can be sent to [email protected]. Nalpay is operated by the same Saudi company team behind Rekaz.