Privacy Policy

Who we are and what this covers

This policy explains what Saudi Hidayath ("we", "us") collects when you use SaudiHidayath.com, why, who can see it and how long it is kept. It covers the English and Arabic versions of the site. It does not cover what we agree with you in a contract or purchase order, which has its own terms.

We are the controller of the information described here. Our branches in Jeddah, Riyadh and Dammam, with their telephone numbers and e-mail addresses, are listed on the contact page — write to the branch nearest you for anything to do with your data.

Information you give us

Everything in this section is collected only when you fill in a form and press send. Browsing the site gives us none of it.

Requests for quotation

The quotation form asks for the type of service you need, your name, e-mail address and telephone number, and optionally your company, country, city, project name, quantity, required date and comments (up to 5,000 characters). You may attach up to five files of up to 15 MB each: drawings and documents in PDF, JPG, PNG, WebP, DWG, DXF, STEP, IGES, ZIP, Excel or CSV format. We also record which page the request came from and, when you arrive from a product, service, finish, industry or calculator page, which one, so the enquiry reaches the right desk with its context.

When you send a quotation from a calculator result, the inputs you entered (grade, dimensions) and the computed theoretical value travel with the request so our team can check the same figures.

Job applications

The careers form asks for the position, your name, e-mail address, telephone number, an optional cover note and LinkedIn URL, and your CV as a PDF.

Vendor registration

The vendor form asks for your name, e-mail address, telephone number, company, commercial registration number, city, website, what you offer, and optionally a company profile file.

Anti-abuse checks

Each form carries a hidden field that people never fill in and a signed timestamp that shows the form was opened by a browser at least a few seconds before it was sent. Neither contains personal information. Submissions are also rate-limited per connection for one minute at a time; that count is held in memory and is not stored with your request.

Information collected automatically

The site itself sets no cookies. Our hosting provider (Vercel) and our database and file-storage provider (Supabase) keep ordinary server logs — request paths, timestamps, IP addresses, browser type — for the operation and security of the service, on their standard retention.

Images are served through Cloudflare, which receives the requesting IP address in the normal course of delivering them.

Analytics, and the consent banner

We use PostHog to understand how the site is used. Nothing is sent to it until you choose "Allow analytics" on the banner; if you decline, or never answer, no analytics run. Your choice is remembered in your browser's local storage under the key hidayath-analytics-consent, not in a cookie, and you can withdraw it at any time by clearing that storage for this site.

With your consent we send a fixed list of named events: page views, search queries (including the text you searched), which product codes, services, finishes and industries you viewed, the service type of a quotation you started or sent, which calculator you used and for which grade, and clicks on WhatsApp and download links. Automatic capture of what you click or type is switched off, and there is no session recording. Quotation files and form contents are never sent to analytics.

PostHog processes this on servers in the United States. If we enable Google Analytics 4 it runs under the same consent and receives the same events; it is not enabled unless a measurement ID is configured.

Search

Site search is provided by Algolia. When you type a query it goes from your browser directly to Algolia's servers, which receive the query text and your IP address in order to answer it. We do not attach your name or contact details to searches.

E-mail and WhatsApp

When you send a form, Resend delivers an internal notification to the branch inbox that will handle it, containing the fields you filled in. Attached files are not e-mailed; they stay in our private storage and staff open them there. Resend is also used to send password-reset messages to our own staff. We do not send automated replies, newsletters or marketing e-mail to people who use the forms.

The WhatsApp buttons open a chat with our sales line inside WhatsApp, which is operated by Meta under its own terms and privacy policy. We receive nothing until you send a message there.

Downloads

Catalogue and datasheet files are stored privately. A download link is a temporary signed address that expires after five minutes; requesting one records nothing about you beyond the server log described above. Some documents are marked "available on request" and are sent by our team rather than downloaded.

Why we use it

• To prepare and send the quotation, sample or information you asked for, and to follow up on it.
• To consider your job application or vendor registration.
• To keep the forms free of automated abuse and the service running securely.
• With your consent, to understand which pages, products and tools are used, so we can improve them.

Who can see it

Form submissions and the files attached to them are visible only to our staff who sign in to the site's content system — administrators, editors and sales staff — and to the branch that handles your enquiry. Files are never published, never shared with analytics providers and never passed to artificial-intelligence tools.

The providers that process data on our behalf are: Vercel (hosting), Supabase (database and file storage), Cloudflare (image delivery), Algolia (search), PostHog (analytics, with consent), Resend (transactional e-mail) and Meta (WhatsApp, when you choose to use it). Some of these process data outside the Kingdom of Saudi Arabia. We do not sell personal information and we do not share it with anyone else unless the law requires it.

How long we keep it

Quotation requests, applications and vendor registrations are kept for as long as we are dealing with them and for a period afterwards so that a returning enquiry can be picked up where it left off. We do not currently delete them automatically. We will delete your submission and its files on request, unless we need to keep a record for a quotation or contract that went ahead.

Your rights

Under the Saudi Personal Data Protection Law you may ask us what personal information we hold about you, ask us to correct or delete it, and withdraw consent to analytics at any time as described above. Write to the branch that handled your enquiry, or use the contact page; a member of staff, not an automated system, will respond. You also have the right to complain to the Saudi Data & AI Authority (SDAIA).

Security

The site is served over HTTPS only. Uploaded files go into a private storage bucket that cannot be reached without signing in; the content system is access-controlled by role; form endpoints are rate-limited and token-checked. No system is perfectly secure, and we will tell you if a breach affects your information as the law requires.

Changes

When this policy changes, the new version is published here with its effective date. A change that affects what we collect or why is announced on the site before it takes effect.