Privacy policy

1. Who is responsible

FacilitiesHub, Kingdom of Saudi Arabia is responsible for the personal data described here (the controller under the Saudi Personal Data Protection Law). For any privacy question or request, write to info@facilitieshub.io.

2. What we collect

Account details (name, email, mobile, company) and billing details (VAT and commercial registration numbers, national address); sign-in records (time, IP address, device); the data your Home Assistant sends (device names, states and their recent history, areas, and camera pictures or video passed through to you live); payment records (amount, date, reference, card type and last four digits; card numbers go to our payment provider only, never to us); messages you send us.

3. Why we use it

To provide FacilitiesHub and keep it secure; to bill you and issue tax invoices, which Saudi law requires; to answer your questions and send service messages such as invoices, renewals, alerts you set up and security notices. We do not send marketing without your consent and we do not sell personal data.

4. Who we share it with

Only what each needs: our payment provider (Paymob) for payments, our accounting and e-invoicing provider (Aliphia, with ZATCA) for invoices, our hosting and email providers to run the service, and authorities when the law requires it.

5. Where it is kept

On our hosting provider's servers. When personal data is processed outside the Kingdom, we do so only as the Personal Data Protection Law and its regulations allow, with the safeguards they require.

6. How long

Account data while the account is open and up to 90 days after it closes; invoices and payment records for as long as Saudi tax law requires; device history for 14 days; activity logs for the period your administrator chooses (30 days by default). Live camera video is passed through and not stored, apart from a short buffer while you watch.

7. Security

Connections are encrypted (HTTPS); administrators sign in with two-factor authentication; passwords and tokens are stored only as hashes, and secrets such as authenticator keys are encrypted.

8. Your rights

You may ask to know what we hold about you, to receive a copy, to correct it, to have it deleted when we no longer need to keep it, and to withdraw any consent you gave. Write to us; we answer within the time the law sets. You may also complain to the Saudi Data and Artificial Intelligence Authority (SDAIA).

9. Cookies

We use only the cookies the service needs: your sign-in session, your preferences (language, light or dark mode) and similar. No advertising or tracking cookies. Our website loads its fonts from Google Fonts, which receives your IP address when it does.

10. Changes

We will post any change here with a new date, and tell account holders by email about important ones.