Privacy policy.

MIQAS is operated by Ensign Establishment for Advertising ("Ensign"), a Saudi-registered entity. This Privacy Policy describes what data we collect, how we use it, and your rights under KSA's Personal Data Protection Law (PDPL).

• Account data: name, email, password hash, role within your workspace.
• Workspace data: the data you upload (ad credentials, aggregator exports, order data from your connected platforms), and the data we derive from it (aggregated metrics, cross-channel attribution).
• Technical data: IP address, browser type, login timestamps. Used for security and abuse detection only.
• Cookies: essential session cookies (always on), and analytics cookies (opt-in via the consent banner).

We process your data only to operate the Service: authenticate you, show your dashboards, send transactional emails, and improve the product. We never sell, rent, or otherwise distribute your data to any third party for its own purposes, and we never share it with advertisers.

Your workspace data is visible only to the members you invite. Ensign staff do not browse customer data. A small number of authorised Ensign administrators can open a workspace only to provide support or resolve a technical issue, and every such access is recorded in an audit log. We never access your connected ad accounts beyond what is needed to pull the metrics you asked us to show.

Workspace data is stored in Supabase (Postgres) in the EU-Central (Frankfurt) region. Static assets are served via Vercel's global edge network. Transactional emails go through Resend.

The minimum needed to run the Service:

• Paymob — when you start a subscription, we share your name, email, and workspace ID so they can take payment. Your card details are entered directly into Paymob and never touch our servers.
• Supabase — database and authentication hosting.
• Vercel — application hosting.
• Resend — transactional email delivery.
• AI processing— aggregated workspace metrics and the text you write in the in-product help chat are processed by a licensed AI provider under a zero-data-retention configuration to generate answers, reports, and recommendations. Your end-customers' identifiers are not included in this processing.
• Connected platforms you authorize (Meta, TikTok, Google, etc.) — your credentials are used to pull data on your behalf, only for as long as you keep the connection active.

Under PDPL, you have the right to:

• Be informed of how and why your data is processed
• Access the personal data we hold about you
• Obtain a copy of your data in a readable and clear format (PDPL's equivalent of data portability)
• Correct, complete, or update inaccurate data
• Request destruction (subject to retention obligations under KSA law)
• Withdraw consent to non-essential processing at any time
• Lodge a complaint with the Saudi Data & AI Authority (SDAIA)

You can download a full copy of your workspace data, and request permanent deletion, yourself from Settings → Privacy & your data inside the dashboard. For corrections or anything else, email contact@ensignksa.com. We respond within 30 days (extendable by a further 30 days for complex requests, as PDPL allows).

If a personal-data breach occurs that affects your data, we notify the Saudi Data & AI Authority (SDAIA) within 72 hours of becoming aware of it, as required by the PDPL Implementing Regulation, and we notify affected users without undue delay where the breach may cause harm.

We retain your data for as long as your workspace is active, plus 30 days after cancellation to allow account recovery. After that, all personal data is permanently deleted unless KSA law requires longer retention (e.g., tax records for 10 years).

MIQAS is a business tool. We do not knowingly collect data from anyone under 18.

Material changes are communicated via email at least 14 days before taking effect. The "last updated" date at the top reflects the most recent revision.

contact@ensignksa.com