Privacy Policy

Arqam360 is a consent-management platform. Merchants add our banner to their websites and online stores to ask visitors for consent, record the answer, and pass that answer on to the marketing and analytics tools they use. This policy explains what personal data we handle, why, for how long, who helps us, and what rights you have.

Arqam360 is the commercial name of a business registered in France (SIRET 100 552 249 00011), with its registered address at 72 avenue Ledru-Rollin, 94170 Le Perreux-sur-Marne, France. For any privacy question or request, write to admin@arqam360.com.

We handle personal data in two different capacities, and your rights are exercised differently in each.

• As a controller, for people who visit arqam360.com, create an Arqam360 account, use our free tools, subscribe to our emails or contact us. We decide why and how this data is used, and this policy is the notice for it.
• As a processor, for visitors to our customers’ websites and stores. When our banner or events tools run on a merchant’s site, the merchant is the controller of the data they collect and we process it only on the merchant’s instructions and to provide our service to them. The merchant’s own privacy policy is the notice for that data.

If you visited a store that uses Arqam360 and want to access or delete your data, contact that store first: it decides what happens to the data. If you write to us instead, we will tell you which merchant to contact.

In our role as controller we collect:

• Account details: your name, email address, company name, a hash of your password (we never store the password itself), language, time zone, country, plan and subscription status, and sign-in history such as the last sign-in time and failed attempts. If you sign in with Google, we store your Google account identifier.
• Two-factor authentication settings, if you turn this feature on.
• Store connections: when you install Arqam360 from Shopify, Salla, Zid or WordPress, the identifier or address of your store and the access tokens the platform issues to us. Tokens are encrypted before they are stored.
• Billing: your Stripe customer identifier and subscription status. Card details are entered on Stripe and never reach our servers.
• Your configuration: domains, banner settings, and the credentials of any marketing or analytics tools you connect. Those credentials are encrypted before they are stored.
• An activity log of actions taken in your account, with the IP address and browser details of the person who took them. When an Arqam360 staff member acts in your account at your request, the log records who did it.
• Free tools: if you use our website scanner or a related tool and give us your email, we keep that email, the address scanned, the results, your language, and how you reached us (campaign parameters, referring page and ad click identifiers).
• Newsletter: your email address, where you signed up, and when you subscribed or unsubscribed.
• Messages you send us through the contact form, by email, or through support requests in the dashboard.
• A log of the service emails we send you and whether they were delivered.
• Website analytics: on arqam360.com we load Google Analytics only after you accept analytics cookies in our banner.

In our role as processor, depending on the features a merchant turns on, we handle the following about visitors to that merchant’s site:

• Consent records: the choice made for each category, the time, the website and page address, the referring page, the language, a random identifier created in the visitor’s browser, the browser’s user agent and the device type, operating system and browser read from it, the Global Privacy Control signal, the IAB TCF consent string when the merchant has enabled TCF, and the version of the merchant’s privacy notice in force. The IP address is shortened before it is stored (the last block of an IPv4 address and the last 80 bits of an IPv6 address are removed). Before shortening, we use the full address to look up the country and city in a database that runs on our own servers; no outside service receives it.
• Banner impressions: when the banner is shown, the website, page address, language, the random identifier if one already exists, the country, the privacy regime applied, and how long the banner took to appear.
• Privacy regime: to decide which rules the banner applies (for example PDPL or GDPR), we read the visitor’s country from the request. This check does not store anything on its own.
• Events, only where the merchant installs our events script: the name and details of each event, page details, user agent, IP address, language setting, time zone, country, region and city, the visitor’s consent state, and the random identifier. If the visitor has refused analytics, the event is not recorded. If the visitor has refused marketing, personal fields are removed from the event details.
• Visitor profiles, only where the merchant uses our events features: email addresses and phone numbers are stored only as one-way SHA-256 hashes, together with the merchant’s own customer identifier. Other attributes are stored only when the visitor has given marketing consent.
• Forwarding: when a merchant connects tools such as Google, Meta or TikTok, we send consent signals and events to them on the merchant’s instructions, within the visitor’s consent and the merchant’s routing rules. We keep a record of each forwarding decision.
• Privacy requests: when a visitor submits a request through a form we host for the merchant, we record the email, name, request type, message and language, and send a one-time code to verify the email. For stores connected through Shopify, Salla or Zid, we can retrieve that customer’s data from the platform so the merchant can answer the request.

This section covers our role as controller. Under the GDPR, each use relies on the legal basis shown.

Where the Saudi Personal Data Protection Law (PDPL) applies, we rely on your consent unless the law allows another ground, such as performing a contract with you or meeting a legal obligation.

We do not sell personal data, and we do not use merchants’ visitor data for our own purposes.

arqam360.com runs our own consent banner. Strictly necessary cookies keep you signed in and protect forms against forgery. Analytics cookies are set only after you accept them, and you can change your choice at any time from the banner. The full list is in our Cookie Policy.

We use the following providers to run Arqam360. They process personal data on our behalf and only for the purpose shown.

Other recipients: the e-commerce platform you connect (Shopify, Salla, Zid or WordPress), which exchanges data with us to install and run the app; the marketing and analytics tools a merchant connects, which receive data on that merchant’s instructions; and public authorities, when the law requires us to disclose data.

Our providers operate infrastructure in several countries, so your data may be stored or processed outside the country where you live, including outside Saudi Arabia and the European Economic Area. Where the law requires safeguards for such transfers, we rely on the mechanisms it provides. To ask where your data is hosted, write to admin@arqam360.com.

Where a period is shown, deletion happens automatically. Where no automatic period exists, we say so.

Data travels over encrypted HTTPS connections. Passwords are stored only as bcrypt hashes. Store access tokens and the credentials of connected tools are encrypted with AES-256-GCM before they are stored. Accounts lock after repeated failed sign-ins, two-factor authentication is available, and IP addresses in consent records are shortened before storage. No system is perfectly secure; the Security page describes our measures in more detail, including the ones still in progress.

Under the GDPR, you have the right to:

• access your personal data and receive a copy;
• have inaccurate data corrected;
• have your data erased;
• restrict how your data is processed;
• receive your data in a portable format;
• object to processing based on our legitimate interests, including direct marketing;
• withdraw your consent at any time, without affecting processing that took place before;
• lodge a complaint with a data protection authority. In France, this is the CNIL.

Under the Saudi PDPL, you have the right to:

• be informed of how and why your personal data is collected and used;
• access your personal data;
• obtain a copy of your personal data in a clear, readable format;
• have your data corrected, completed or updated;
• have your data deleted when it is no longer needed;
• withdraw your consent at any time;
• lodge a complaint with the Saudi Data & AI Authority (SDAIA).

If you are an Arqam360 customer or visited arqam360.com, write to admin@arqam360.com. You can also update most account details yourself in the dashboard settings, and close your account there.

If you visited a merchant’s site that uses Arqam360, contact that merchant. Many merchants link to a request form we host for them at arqam360.com/privacy/request; a request sent through it goes directly to the merchant concerned.

We may ask you to confirm your identity before acting on a request, and we answer within the time limits set by the applicable law.

When we change this policy, we update the date at the top of this page. If a change significantly affects how we use account holders’ data, we will tell them by email before it takes effect.