Privacy Policy
Last updated: 4 November 2026
This policy explains how ExtraMile Business Solutions ("ExtraMile", "we") handles personal data when you use the ExtraMile ZATCA service: this website and client portal, the ExtraMile WhatsApp Business number, and the Odoo accounting system we host for each client. We process personal data in line with the Saudi Personal Data Protection Law (PDPL).
What we collect
- Account data: name, email address, mobile number and password (stored hashed).
- Company data: company name, VAT number, commercial registration, national address, and the documents you upload (CR, VAT certificate, national address certificate).
- Employee numbers: names and WhatsApp numbers of the employees you authorise, and their roles.
- WhatsApp messages: messages, photos and files your authorised employees send to our WhatsApp number, with the sender's number and time.
- Accounting data: invoices, credit notes, vendor bills and expenses created in your Odoo database, including your customers' and suppliers' names and VAT numbers.
- Payment data: subscription payments are handled by our payment provider; we keep the amount, status and reference only, never card details.
How we use it
- To read the documents you send and turn them into accounting drafts, ask you to confirm, and create them in your Odoo database.
- To sign your e-invoices and clear or report them with ZATCA's Fatoora platform, as Saudi e-invoicing rules require.
- To run your subscription: onboarding, support, quota tracking, billing and monthly reports.
We do not sell personal data and do not use it for advertising.
Who we share it with
- ZATCA (Zakat, Tax and Customs Authority): your e-invoices, as required by law.
- Meta Platforms (WhatsApp Business Platform): to receive and send WhatsApp messages.
- Anthropic: the AI service that reads message text, photos and files to extract invoice details. It processes this data on our behalf and does not use it to train its models.
- Our payment provider: to process subscription payments.
- Our hosting provider: the servers that run the portal, the WhatsApp agent and your Odoo database.
We may also disclose data when Saudi law or a competent authority requires it.
How long we keep it
Invoices and accounting records are kept for as long as Saudi tax law requires (currently at least six years), even after a subscription ends. WhatsApp messages and attachments are kept for as long as needed to create and audit the related documents. Account and company data is kept while your subscription is active and then for as long as legal and accounting obligations require.
Security
Data is sent over encrypted connections (HTTPS). Each client has a separate Odoo database, and access is limited to the client's own users and the ExtraMile staff who support them.
Your rights and data deletion
You can ask to see, correct or delete your personal data, or to stop receiving messages from us. To remove an employee number, delete it in the portal or ask your company's account owner. To request deletion of your data, email admin@extramile-sa.com from your registered email, or send "DELETE MY DATA" to our WhatsApp number. We will reply within 30 days. Records that tax law requires us to keep will be kept until that period ends, and then deleted.
Contact
ExtraMile Business Solutions · admin@extramile-sa.com · extramile-sa.com
We may update this policy; the date above shows the latest version.