Privacy policy

Two kinds of people in this policy

Dots is a point-of-sale and customer-messaging product sold to cafés and restaurants. That means two different sets of people appear in it, and they have different relationships with us.

• The café — our customer. They sign up, their staff hold accounts, and they decide what the product is used for. For their own business data we are the controller.
• The café’s customers — the people who buy a coffee, join a loyalty card, or send the café a message. We hold their data on the café’s instructions and for the café’s purposes. For that data the café is the controller and we are the processor.

If you are a café customer and want your data removed, the café is the first place to ask. We will act on their instruction, and we will also act on a request sent directly to us — see “Deleting your data”.

What we collect

From the café and its staff:

• Account details: name, email address, role, and a hashed sign-in PIN for point-of-sale devices. We never store a PIN or a password in readable form.
• Business details: trading name, branches, VAT registration number, and the commercial details ZATCA requires on an invoice.
• Operational records: orders, payments, shifts, stock counts, and the audit trail of who did what on a till.

About the café’s own customers, when the café uses those features:

• Name and phone number, where the café records one against an order or a loyalty card.
• Loyalty history: stamps earned, rewards issued, and the wallet pass on a phone.
• Messages: the content of conversations the customer has with the café on WhatsApp, Instagram, Facebook or TikTok, including photos, voice notes and files the customer sends, along with the phone number or platform handle the message arrived from.
• Google reviews the customer has left on the café’s public listing, and the café’s replies to them.

We do not collect payment card numbers. Card payments are handled by our payment processor and card details never reach our systems — we store only the processor’s reference, the amount, and whether it succeeded.

Messaging channels, and what Meta data we hold

A café can connect WhatsApp, Instagram, Facebook and TikTok accounts so that messages from their customers arrive in one inbox. Connecting is always the café’s own act, performed through the provider’s sign-in, and it can be undone at the provider at any time.

• We receive and store the messages sent to the connected account, and media attached to them, so the café’s staff can read and answer them.
• We store an access token for the connected account, encrypted, so we can deliver replies. Tokens are never exposed to a browser and never leave our servers.
• We store the account identifiers the provider gives us — a phone number ID, a page ID, an Instagram account ID — so an incoming message can be matched to the right café.
• We do not use message content to train models, sell it, or share it with anyone outside the processors named below.

Where a café connects a Google Business Profile, we read the reviews on that listing and publish the café’s replies. We request only the permission needed to do that.

Why we hold it

• To run the product the café is paying for: take a sale, print an invoice, show a message, award a stamp.
• To meet Saudi tax and e-invoicing obligations. Sales records are kept because the law requires them to be kept, and for as long as it requires.
• To keep the service secure and to investigate misuse — sign-in records, device pairings, and an audit trail of changes.
• To bill the café and support them when something goes wrong.

We do not sell personal data, and we do not use a café’s data or their customers’ data to advertise to anyone.

Where it is processed

Our database and file storage run on Supabase in the eu-central-1 region (Frankfurt, Germany). Our web application runs on Vercel’s global network. Payments are processed by Moyasar in Saudi Arabia. Messaging is delivered by Meta Platforms, TikTok and Google, each under their own terms.

This means personal data is transferred outside the Kingdom of Saudi Arabia. We use providers that offer contractual data-protection commitments, and we hold data with them only for the purposes described above.

Who else sees it

Only the processors that make the product work:

• Supabase — database, authentication and file storage.
• Vercel — application hosting.
• Moyasar — card payment processing.
• Meta Platforms — WhatsApp, Instagram and Facebook message delivery.
• TikTok — TikTok message delivery.
• Google — Business Profile reviews and replies.
• OpenAI — only where a café switches on automatic drafting of review replies, and only the review text needed to draft one. It is off unless the café turns it on.

We disclose data to a public authority only where the law obliges us to, and we will tell the café unless we are forbidden from doing so.

How long we keep it

• Sales, invoices and payment records: for the period Saudi tax and e-invoicing rules require. These records cannot be edited or deleted, by anyone, including us — a correction is a new reversing record. That is a legal requirement, not a design preference.
• Messages and their media: while the café’s account is active, and deleted within 30 days of the account closing.
• Loyalty and customer records: until the café deletes them or closes the account.
• Access tokens for a connected channel: deleted the moment the café disconnects it.
• Sign-in and audit records: 24 months.

Your rights

Under the Saudi Personal Data Protection Law you may ask to see the personal data we hold about you, to have it corrected, to have it deleted, and to receive a copy of it. Where we are the processor rather than the controller we will pass your request to the café and support them in answering it.

Write to support@botly-solutions.com. We answer within 30 days. If you are not satisfied you may complain to the Saudi Data & Artificial Intelligence Authority (SDAIA).

Security

• Every café’s data is isolated in the database itself, by row-level security, not by a filter in the application. One café cannot read another’s records even through a direct API call.
• Sign-in PINs are hashed. Channel access tokens are encrypted at rest and are never readable from a browser.
• Files a customer sends are stored privately and are reachable only through a short-lived signed link.
• Traffic is encrypted in transit throughout.

Children

Dots is a business tool and is not directed at children. We do not knowingly collect data from anyone under 18. If you believe we have, write to us and we will remove it.

Changes

If we change this policy in a way that affects how we use personal data we will tell cafés by email before it takes effect. The date at the top of this page is always the date of the current wording.

Contact

Dots is operated by منظومة المستقبل الرقمية (Botly Solutions).

• Commercial Registration: 7051699291
• Address: Al Mubarraz 36341, Saudi Arabia
• Email: support@botly-solutions.com