Privacy Policy

"Mahsumah", "we", or "us" refers to Mahsumah Business (شركة محسومة), a company registered in Riyadh, Kingdom of Saudi Arabia, under Commercial Registration 7038325788 and VAT number 312062837400003. This policy explains how we handle the personal data of customers and visitors when they use our website and our managed hosting services.

We collect only the data required to deliver and securely operate our services:

• Account data: your name, business name, email address, phone number, and the domain associated with your service.
• Billing data: payments are processed through our payment provider Moyasar. We do not store card numbers or full card details on our servers; we retain only transaction records such as amount, date, payment status, and transaction reference.
• Infrastructure logs: IP addresses, browser type, request timestamps, and server logs generated automatically for security, diagnostics, and operational monitoring.
• Support & ticket data: the content and attachments of the messages you send when contacting our support team by email or through our ticketing system.

We use only two categories of cookies: essential (always active and cannot be disabled — required to operate the site, protect our services, keep your session, remember basic preferences (including your language), and complete checkout) and analytics (optional, disabled by default, and loaded only after you consent — used only to understand aggregate website usage and improve performance). We do not use cookies to track you across other websites or to build profiles about you, we use no advertising or ad-tracking cookies, and we do not sell your visitor data. You can change your choices at any time from the “Cookie Preferences” link in the footer.

Services and data are hosted on managed infrastructure located in Riyadh, Kingdom of Saudi Arabia. We manage SSL certificates (via Let's Encrypt), our own DNS name servers (ns1.mahsumaah.sa and ns2.mahsumaah.sa), uptime monitoring, and daily backups on managed cPanel/WordPress hosting.

Some data may be processed by vendors necessary to deliver the service: Moyasar for payment processing, Microsoft 365 / Graph for operational email, Huawei Cloud ECS for infrastructure hosting inside Riyadh, and an SMS provider for operational alerts when enabled. The full, current list is on our Subprocessors page.

We retain account and billing data for the duration of your subscription and for the period necessary to comply with statutory and accounting obligations in the Kingdom. Platform backups are kept for 14 days before being rotated out. Server logs are kept for a limited period for security purposes and are then deleted or aggregated.

We apply reasonable technical and organisational measures to protect your data, including encryption in transit via SSL, access controls to our systems, continuous operational monitoring, and daily backups on managed cPanel/WordPress hosting. Despite our efforts, no system can be guaranteed 100% secure, and we are committed to notifying you in the event of a security incident affecting your personal data.

At any time you have the right to:

• Access the personal data we hold about you.
• Correct any inaccurate or incomplete data.
• Delete your data, subject to what we are legally required to retain.

To exercise any of these rights, contact us at info@mahsumaah.sa.

We are committed to handling personal data in line with the Personal Data Protection Law (PDPL) in force in the Kingdom of Saudi Arabia and its implementing regulations. This policy, and any dispute relating to it, is governed by the laws of the Kingdom of Saudi Arabia.

For any question regarding privacy or your personal data, contact Mahsumah Business at info@mahsumaah.sa — Riyadh, Kingdom of Saudi Arabia.