Hala‑Invoice ("we", "us", "our") operates https://hala-invoice.com and related apps (the "Service"). This Privacy Policy explains what we collect, how we use it, and your choices. If you do not agree, please do not use the Service.
Plain English: The free generator runs locally in your browser. It does not upload invoice content to our servers and does not retain that content on our servers. Signed-in services process only the account and workspace data needed to provide and protect those services. We use Google Analytics to measure how the Service is used — never invoice content, customer names, or email addresses. Analytics and advertising cookies stay denied by default. Company accounts and their invoices are stored with us, issued invoices are sent to ZATCA, and payments go through DigetPay (see Company accounts and cloud invoices).
Exception: if you use fill-from-image, the image you choose is sent through our servers to our AI provider, DeepSeek, to extract its details and may be processed outside KSA. We do not store the image; we keep only a daily usage count.
1. Who we are
Istidlal Alnajah Company (commercial registration 7053785106), which operates Hala‑Invoice, is the "Controller" for account data and the "Processor" for invoice content you upload.
Contact: info@hala-invoice.com
Jurisdiction: Kingdom of Saudi Arabia (KSA). We may use providers in other countries to run the Service.
Language: This policy is published in Arabic and English. If the two versions differ, the Arabic text prevails.
2. Data we collect
- Account data: name, email, phone, company name, role, password hashes, settings.
- Signed-in workspace data ("Customer Data"): customer and invoice records already stored in a workspace, including items, amounts, VAT, buyer/seller details, invoice numbers, notes, and logos.
- Free-generator draft: we do not collect its invoice content; the current draft remains only in this browser's local storage.
- Security and service logs: IP address, browser information, request metadata, errors, and security events needed to operate and protect the Service.
- Usage analytics: pages viewed, language, and product milestones (for example that an invoice was created or issued, its total, and its currency), collected through Google Tag Manager and Google Analytics 4. We never send invoice content, invoice numbers, customer names, email addresses, or VAT numbers, and analytics never runs on invitation, password-reset, e-mail-verification, or shared invoice links.
- Support content: messages, email threads, recordings/screenshots you choose to share.
- Cookies & similar: to keep you signed in, remember preferences, and prevent abuse.
You are responsible for the legality and accuracy of any personal data you include in invoices (e.g., your customers' details).
3. Why we use your data
- Provide and secure signed-in services (authentication, authorized workspace access, storage, back-ups, and abuse prevention).
- Run the free generator locally in your browser, including totals/VAT calculations and the draft-expiry check described below.
- Comply with applicable law (e.g., e‑invoicing formats or retention requirements).
- Diagnose errors and improve reliability.
- Measure how the Service is used — which pages are visited and which product milestones are reached — so we can improve it. Analytics and advertising storage are denied by default, so Google Analytics receives no cookies from your browser unless you later consent.
- Communicate with you (service notices, security alerts, support).
- Take payment for paid plans and keep the payment records tax law requires.
Where required by law, our legal bases include performance of a contract, legitimate interests, consent, and compliance with legal obligations.
4. Free generator draft storage
The no-account free generator runs in your browser. To help you continue an unfinished invoice, it saves the current draft — including the invoice details you enter and any uploaded logo — in browser localStorage on that device.
The free generator does not upload the draft to our servers, does not retain it on our servers, and does not create a public share link. The local record carries an expiry 30 days after its last saved change. The next time the generator reads the draft, it checks that expiry and removes an expired record. A browser cannot remove the record while the site is closed, so it may remain on the device until you return or clear it yourself.
Select New Invoice in the generator to clear the current draft, or clear your browser data for this site in browser settings to remove it manually. Clearing browser data, using private-browsing mode, or changing devices may remove or make the draft unavailable.
Company accounts and cloud invoices
The Hala Invoice cloud service is operated by Istidlal Alnajah Company (commercial registration 7053785106), which is the controller of account data and processes the invoice and customer data your company enters on its behalf.
- What we store: your account (name, email, sign-in method), your company's legal identity (Arabic legal name, VAT number, commercial registration, national address), your customers, your invoices and drafts, and your subscription and payment history.
- ZATCA: once your company connects to ZATCA, the Service sends each issued invoice, including seller, buyer and amount details, to the Zakat, Tax and Customs Authority for reporting or clearance. Your company's signing key is stored encrypted, and we keep the signed invoice and ZATCA's response.
- Payments: payments are taken on DigetPay's hosted payment page. We send DigetPay your name, email, mobile number and the amount; your card details never reach us. The payment page shows the merchant name "Hala Agent", the DigetPay merchant account through which we collect Hala Invoice payments.
- Account email: if we send you account email (invitations, password recovery or email verification), it is sent through our email provider, Resend.
- Where data is processed: the Service runs on Vercel (Frankfurt, Germany); the database is hosted by Supabase on AWS in Mumbai (India); sign-in uses Google. Your data is therefore processed and stored outside the Kingdom of Saudi Arabia, under contractual safeguards and encryption in transit.
- Retention: an issued invoice is locked and cannot be edited or deleted. We keep it, and the tax records tied to it, for as long as Saudi VAT rules require (at least six years). You can ask us to delete your other data, and we will unless the law requires us to keep it.
5. Sharing & transfers
We share data only with:
- Service providers/sub-processors needed for hosting, databases, Google sign-in, operational logging, content delivery, and usage analytics (Google Tag Manager and Google Analytics 4), payments (DigetPay), account email when sent (Resend) and e-invoice reporting to ZATCA. Providers may process data outside KSA subject to contracts and safeguards.
- AI image reading: Exception: if you use fill-from-image, the image you choose is sent through our servers to our AI provider, DeepSeek, to extract its details and may be processed outside KSA. We do not store the image; we keep only a daily usage count.
- Legal compliance (e.g., lawful requests, fraud, security, protecting our rights or users).
- Business transfers (merger, acquisition). We will notify you if ownership changes.
We do not sell your personal information.
We do not share free-generator draft content with service providers because it is not uploaded to our servers.
6. Security
We use protections including encryption in transit and access controls. No system is 100% secure; please keep your sign-in credentials safe.
7. Your rights & choices
Depending on your region, you may have rights to access, correct, delete, export, or object/restrict processing. We honor reasonable requests after verifying your identity.
- Email: info@hala-invoice.com
- Browser storage: you can clear cookies and localStorage in your browser settings, but doing so may sign you out and delete your local draft.
For Customer Data you control (invoice contents), we will route requests to your administrator if applicable.
8. International transfers
If we transfer data outside your country, we use contractual protections and technical safeguards. Use of the Service may involve processing in regions other than KSA.
9. Data retention & deletion
- Account data: kept while your account is active and as needed for legal/accounting purposes.
- Free-generator drafts: stored only in your browser and handled by the 30-day expiry-on-read rule in Section 4.
- Signed-in Customer Data: kept while needed to provide the workspace and meet applicable legal obligations, or until an authorized deletion request is completed.
- You can request deletion at any time; some logs/archives may persist for limited periods for security or legal reasons.
10. Children
The Service is not intended for children under 13 (or the age required in your region). Do not submit children's data without a lawful basis.
11. Changes to this policy
We may update this policy. We'll post the new version with a new "Last updated" date and, for material changes, notify you by email or in‑app.
12. Contact
Questions or requests: info@hala-invoice.com.
Postal address available upon request.
This document is provided for convenience and is not legal advice.