Privacy Policy

Last updated: March 9, 2026

This Privacy Policy explains how Arsel ("we", "us", or "our"), accessible at https://arsel.sa, collects, uses, stores, and protects your personal information when you use our marketing engagement platform and related services (the "Service").

1. Information We Collect

1.1 Account Information

When you register for an account, we collect your name, email address, password, and organization details. If you sign in via Google OAuth, we receive your name, email, and profile picture from Google.

1.2 Contact Data You Upload

You may upload or input contact lists containing names, email addresses, phone numbers, tags, and custom fields. You are the data controller for this contact data, and we process it on your behalf as a data processor.

1.3 Campaign & Engagement Data

When you send email or SMS campaigns through our Service, we collect and store delivery events including: sends, opens, clicks, bounces, complaints, and unsubscribes. Email open tracking uses a small tracking pixel. Click tracking uses redirect links to record when recipients click URLs in your campaigns.

1.4 Usage & Log Data

We automatically collect IP addresses, browser type, operating system, referring URLs, pages visited, date/time stamps, and general usage patterns when you access our platform.

1.5 Cookies

Our platform uses the following categories of cookies:

  • Essential cookies: Required for authentication and core platform functionality, including secure session tokens.
  • Analytics cookies: Help us understand how users interact with our platform to improve the experience.

You can manage cookie preferences through your browser settings. Disabling essential cookies may prevent you from using the Service.

2. How We Use Your Information

We use the information we collect to:

  • Provide, operate, and maintain the Service
  • Process and deliver your email and SMS campaigns
  • Track campaign performance (delivery, opens, clicks, bounces, complaints)
  • Manage your account, organizations, and team member access
  • Process payments and manage billing
  • Send you service-related notifications and updates
  • Detect, prevent, and address fraud, abuse, and technical issues
  • Comply with legal obligations

3. Data Isolation & Multi-Tenancy

Each organization's data (contacts, campaigns, analytics) is logically isolated within our systems. Team members can only access data belonging to the organizations they are part of. Organization administrators control who has access to their organization's data.

4. Third-Party Service Providers

We share data with the following categories of service providers who process data on our behalf:

  • Email delivery: Amazon Web Services (AWS) Simple Email Service (SES) for sending emails on your behalf
  • SMS delivery: Regional SMS gateway providers for sending SMS messages on your behalf
  • Cloud infrastructure: AWS for hosting, storage, and event processing
  • Email template editing: Stripo for the drag-and-drop email editor

All third-party providers are contractually obligated to protect your data and may only process it according to our instructions.

5. Data Storage & Retention

  • Account data: Retained for the duration of your account and for up to 30 days after account deletion.
  • Contact data: Retained until you delete it or close your account.
  • Campaign analytics: Engagement events (opens, clicks, bounces) are retained for up to 24 months after the campaign send date.
  • Log data: Server logs are retained for up to 90 days.

You may request early deletion of your data at any time by contacting us at support@arsel.sa.

6. International Data Transfers

Our infrastructure is hosted on cloud services that may process data in different regions. When your data is transferred outside your country of residence, we ensure appropriate safeguards are in place, including standard contractual clauses and equivalent data protection agreements where required by law.

7. Data Security

We implement industry-standard security measures to protect your data, including:

  • Encryption of data in transit (TLS/SSL) and at rest
  • Secure authentication with hashed passwords and HTTP-only session tokens
  • Role-based access control within organizations
  • Regular security reviews of our infrastructure

No method of electronic storage or transmission is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

8. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

  • Access: Request a copy of the personal data we hold about you.
  • Rectification: Request correction of inaccurate or incomplete data.
  • Erasure: Request deletion of your personal data.
  • Data portability: Request your data in a structured, machine-readable format.
  • Restriction: Request that we limit processing of your data.
  • Objection: Object to processing based on legitimate interests.
  • Withdraw consent: Where processing is based on consent, withdraw it at any time.

To exercise any of these rights, contact us at support@arsel.sa. We will respond within 30 days of receiving your request.

9. Legal Basis for Processing (GDPR)

If you are in the European Economic Area (EEA), we process your data based on:

  • Contract performance: To provide the Service you signed up for.
  • Consent: Where you have given explicit consent (e.g., marketing communications).
  • Legitimate interests: To improve our Service, prevent fraud, and ensure security.
  • Legal obligation: To comply with applicable laws and regulations.

10. Data Breach Notification

In the event of a data breach that poses a risk to your rights and freedoms, we will notify affected users and relevant supervisory authorities within 72 hours of becoming aware of the breach, as required by applicable law.

11. Children's Privacy

Our Service is not directed to individuals under the age of 16. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child, we will delete it promptly. Contact us at support@arsel.sa if you believe a child has provided us with personal data.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by posting a prominent notice on our platform at least 14 days before the changes take effect. Your continued use of the Service after changes become effective constitutes acceptance of the updated policy.

13. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data protection rights, contact us at:

  • Email: support@arsel.sa
  • Website: https://arsel.sa