1. Who we are
Margrow is a Saudi company registered in Riyadh, providing an email marketing platform for Salla merchants. We act as Data Controller for merchant account data, and as Data Processor for end-customer data.
2. Data we collect
a. Account data (Merchant)
- Name, email, phone number
- Store name, commercial registration number, company address
- Billing data through Salla
b. Store data (synced via Salla)
- Product catalog and inventory
- Customer base (names, emails, phone, address)
- Orders and revenue
- Cart events (abandoned, completed)
c. Usage data
- Your interaction with the platform (pages visited, features used)
- IP address, browser type, device
- Technical error logs
3. How we collect data
- Directly from you: when you sign up and complete your account profile
- From Salla: via the official API after you grant permission (OAuth)
- Automatically: while you use the platform (analytics, logs)
4. How we use data
We use data exclusively for:
- Delivering the Service (sending campaigns, segmentation, analytics)
- Improving the platform and AI capabilities
- Communicating with you about your account (alerts, billing, support)
- Complying with legal and regulatory obligations
We never sell your data. We never use your customers' data for advertising on third-party platforms.
5. Who we share with
We share data only with:
- Core service providers: Amazon Web Services (hosting), email providers (SendGrid, Postmark), payment processing providers.
- Salla: for syncing your store data (limited by OAuth scopes).
- Government authorities: only upon formal request from a competent judicial authority.
A full list of sub-processors is available in our Data Processing Agreement.
6. Data retention
- Active account data: for the duration of your subscription
- Post-cancellation: 30 days exportable, then permanent deletion
- Billing records: 5 years (ZATCA requirement)
- Security logs: 90 days
7. Your rights
Under the Saudi Personal Data Protection Law (PDPL), you have the right to:
- Access data we store about you
- Correct inaccurate data
- Request deletion of your data (subject to legal obligations)
- Withdraw consent to processing
- Export your data in a machine-readable format
- File a complaint with the Saudi Data & AI Authority (SDAIA)
To exercise these rights: privacy@margrow.com
8. Cookies and tracking
We use essential session cookies (login, preferences) and analytics cookies (PostHog) to understand platform usage. We do not use cookies for external marketing.
9. Children's data
The Service is directed at businesses, not children under 18. We do not knowingly collect data from minors.
10. International data transfer
Primary servers are hosted on AWS · Riyadh region (me-central-1). Encrypted backup copies only are stored on AWS · Ireland (eu-west-1) for business continuity. No processing occurs outside these locations.
11. Policy updates
We will notify you of any material changes to this policy by email at least 30 days before they take effect.
12. Contact
Privacy Officer: privacy@margrow.com
General support: support@margrow.com
Address: Margrow, Riyadh, Kingdom of Saudi Arabia