Privacy Policy

Last updated: September 21, 2026

This Privacy Policy explains how Arsel ("we", "us", or "our"), accessible at https://arsel.sa, collects, uses, stores, and protects your personal information when you use our marketing engagement platform and related services (the "Service").

1. Information We Collect

1.1 Account Information

When you register for an account, we collect your name, email address, password, and organization details. If you sign in via Google OAuth, we receive your name, email, and profile picture from Google.

1.2 Contact Data You Upload

You may upload or input contact lists containing names, email addresses, phone numbers, tags, and custom fields. You are the data controller for this contact data, and we process it on your behalf as a data processor.

1.3 Campaign & Engagement Data

When you send campaigns or transactional messages through our Service — by email, SMS, WhatsApp, mobile or web push notification, or in-app message — we collect and store delivery events including: sends, deliveries, opens, clicks, taps, bounces, complaints, failures, and unsubscribes. Email open tracking uses a small tracking pixel. Click tracking uses redirect links to record when recipients click URLs in your campaigns.

1.4 Device & Push Data

If you integrate one of our client SDKs (Android, iOS, or web) into your own app or website, the SDK registers each installation with us so that you can send push and in-app messages to it. For each registered installation we store: a push token issued by the platform's notification service, an installation identifier generated by the SDK, the platform and notification permission state, and — where the platform provides them — device model and manufacturer, operating system version, app version, SDK version, locale, and time zone.

An installation may be registered before it is linked to a contact. Until your app or website identifies the user, the registration is held against an anonymous identifier and is not associated with a named person by us.

1.5 Behavioural Events

You may send us behavioural events — product or website actions such as a purchase or a signup — through our API or client SDKs. Each event carries an event name, a timestamp, the properties you choose to include in its payload, and an identifier linking it to a contact or to an anonymous installation. You decide which events and properties to send; you are the data controller for them, and we process them on your behalf.

1.6 Usage & Log Data

We automatically collect IP addresses, browser type, operating system, referring URLs, pages visited, date/time stamps, and general usage patterns when you access our platform.

1.7 Cookies & Similar Technologies

Our platform uses the following categories of cookies and similar technologies:

  • Essential cookies: Required for authentication and core platform functionality, including secure session tokens.
  • Analytics and session-recording technologies: On our public marketing website only, we use Google Analytics 4 to measure aggregate traffic and Microsoft Clarity to produce heatmaps and session recordings that show how visitors move through the pages. Both are loaded only after your first interaction with the page or when the browser is idle.

These analytics tools do not run inside the signed-in application, and they never receive your contact lists, campaign content, or engagement data. You can block them through your browser settings or a tracker-blocking extension; Google also publishes a browser opt-out add-on for Google Analytics. Disabling essential cookies may prevent you from using the Service.

2. How We Use Your Information

We use the information we collect to:

  • Provide, operate, and maintain the Service
  • Process and deliver your email, SMS, WhatsApp, push, and in-app campaigns and transactional messages
  • Track campaign performance (delivery, opens, clicks, taps, bounces, complaints) and attribute conversions you report to us
  • Run the automation workflows you build, and evaluate your audience segments
  • Manage your account, organizations, and team member access
  • Process payments and manage billing
  • Send you service-related notifications and updates
  • Detect, prevent, and address fraud, abuse, and technical issues
  • Comply with legal obligations

3. Data Isolation & Multi-Tenancy

Each organization's data (contacts, campaigns, analytics) is logically isolated within our systems. Team members can only access data belonging to the organizations they are part of. Organization administrators control who has access to their organization's data.

4. Third-Party Service Providers

We share data with the following categories of service providers who process data on our behalf:

  • Cloud infrastructure: hosting, databases, storage, and event processing
  • Email delivery: sending email on your behalf
  • SMS, WhatsApp, and push delivery: regional SMS gateways, the WhatsApp Business Cloud API, and the mobile platforms' notification services
  • Email template editing: the drag-and-drop email editor
  • Payments: processing subscription and credit purchases
  • Authentication and website analytics: optional single sign-on, and traffic measurement on our public marketing website

Each provider we currently use, what it does, and the data it processes are listed on our sub-processors page, which we keep current as vendors change. All third-party providers are contractually obligated to protect your data and may only process it according to our instructions.

We do not sell your personal data, and we do not share it with third parties for their own advertising purposes.

5. Data Storage & Retention

  • Account data: Retained for the duration of your account and for up to 30 days after account deletion.
  • Contact data: Retained until you delete it or close your account.
  • Raw engagement events: Individual delivery events (opens, clicks, bounces, and their equivalents on the other channels) are retained for 90 days, after which the aggregated campaign analytics derived from them remain available for up to 24 months from the send date.
  • Behavioural events: Retained for 12 months by default. You can set a shorter or longer window per event type, from one day to two years, in your event settings; events are deleted once they fall outside the window you choose.
  • Device registrations: Retained while the installation remains reachable and until you or the end user removes it, the app is uninstalled, or the platform reports the push token as invalid.
  • Log data: Server logs are retained for up to 90 days.

You may request early deletion of your data at any time by contacting us at support@arsel.sa.

6. International Data Transfers

Our infrastructure is hosted on cloud services that may process data in different regions. When your data is transferred outside your country of residence, we ensure appropriate safeguards are in place, including standard contractual clauses and equivalent data protection agreements where required by law.

7. Data Security

We implement industry-standard security measures to protect your data, including:

  • Encryption of data in transit (TLS/SSL) and at rest
  • Secure authentication with hashed passwords and HTTP-only session tokens
  • Role-based access control within organizations
  • Regular security reviews of our infrastructure

No method of electronic storage or transmission is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

8. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

  • Access: Request a copy of the personal data we hold about you.
  • Rectification: Request correction of inaccurate or incomplete data.
  • Erasure: Request deletion of your personal data.
  • Data portability: Request your data in a structured, machine-readable format.
  • Restriction: Request that we limit processing of your data.
  • Objection: Object to processing based on legitimate interests.
  • Withdraw consent: Where processing is based on consent, withdraw it at any time.

To exercise any of these rights, contact us at support@arsel.sa. We will respond within 30 days of receiving your request.

9. Legal Basis for Processing (GDPR)

If you are in the European Economic Area (EEA), we process your data based on:

  • Contract performance: To provide the Service you signed up for.
  • Consent: Where you have given explicit consent (e.g., marketing communications).
  • Legitimate interests: To improve our Service, prevent fraud, and ensure security.
  • Legal obligation: To comply with applicable laws and regulations.

10. Data Breach Notification

In the event of a data breach that poses a risk to your rights and freedoms, we will notify affected users and relevant supervisory authorities within 72 hours of becoming aware of the breach, as required by applicable law.

11. Children's Privacy

Our Service is not directed to individuals under the age of 16. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child, we will delete it promptly. Contact us at support@arsel.sa if you believe a child has provided us with personal data.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by posting a prominent notice on our platform at least 14 days before the changes take effect. Your continued use of the Service after changes become effective constitutes acceptance of the updated policy.

13. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data protection rights, contact us at:

  • Email: support@arsel.sa
  • Website: https://arsel.sa