Privacy policy | Arttop 360

Scope

This policy explains how we process data in the Arttop 360 platform: the website arttop360.com, the program at app.arttop360.com, and the Arttop 360, Arttop 360 Portal and Arttop 360 POS mobile apps.

The platform is provided by Art Top Investment Company (CR 7028478191), 7055 Salahuddin Al Ayyubi Rd, Al Zahra Dist., Riyadh 12811, Secondary No. 2176, Saudi Arabia.

Our role and the establishment’s role

The subscribing establishment owns, and is responsible for, the data it enters in the program; its administrator decides who can see it and what is kept. We process that data on the establishment’s behalf and only to provide the service to it.

We are responsible for the account data of subscribers and for the data of website visitors.

Data we process

Account data: name, email address and mobile number, and a profile photo if the user uploads one. Passwords are stored by the authentication service in hashed form that no one can read.
Establishment data: whatever the subscriber and its users enter, such as accounts, journal entries, invoices, vouchers, customers, suppliers, inventory and point-of-sale sales; and employee files, contracts, payroll, bank accounts, attendance and leave.
Health data: in medical establishments, patient files, appointments, sessions, treatment plans and clinical photos. This is sensitive data that only users granted access by the establishment can open, and every access is logged.
Attachments: files and images attached to records, kept in private cloud storage for the establishment and opened only for users entitled to see the record.
Location: requested at the moment of a check-in or check-out, and when a field session or shift starts or ends; it is stored with that record together with the distance from the work site or the client’s address. We do not track location in the background or between punches, and a punch takes no photo and reads no fingerprint or face.
Communications: internal mail, tasks and follow-ups between the establishment’s users, and support conversations with the Arttop 360 team.
Operational and security logs: sign-in and session times, and a record of who created, changed and approved each document. To protect new-account sign-up we keep a hashed fingerprint of the network address and email for 30 days.
Website chat: if you message us from the chat button we keep your name, contact details, company name if you give it, your messages, and the page and campaign you came from. Only the authorised sales team can read them, to reply to you.
Website visitors: visit statistics from Cloudflare Web Analytics and Metricool without cookies; Metricool receives the page address, screen size and the page you came from, and your browser remembers the country you choose for prices.

Why we process it

To provide and run the service, protect accounts and data, answer support requests, manage and bill subscriptions, and meet legal obligations. We do not use data for advertising, build marketing profiles from it, or sell it.

Notifications, email and text messages

Notifications appear inside the program and the portal for the person concerned: an approval request, a task, an internal message or a decision on a request.
Platform email is sent from the arttop360.com domain through Resend: account invitations, verification codes, password recovery and appointment notices to collaborating specialists.
Email and text messages that an establishment sends to its customers, employees and patients go out through its own mail server and the SMS provider it chose and configured; their passwords and keys are kept on the server and no user can read them.

Artificial intelligence

The Arttop 360 AI assistant is optional and enabled per subscriber. When a user uses it, their questions, the files they attach and the results the program shows them are sent to Anthropic to generate the answer. Each user’s chats are stored on our servers as text without their attachments, visible to that user alone — not to the establishment’s administrator or colleagues — the latest 50 chats per user per establishment are kept, and the user can delete any of them at any time; we also keep the number and cost of requests for billing.
Professional translation of names sends only the names themselves to Anthropic, such as account, item, customer and supplier names; it sends no documents and no health data.
Anthropic processes this data under its commercial terms, under which it is not used to train models.

Where data is stored

The database, attachments and backups are stored with Supabase in a data centre in Frankfurt, Germany, outside Saudi Arabia, and we transfer data with the safeguards required by the Personal Data Protection Law and its regulations.

Who we share data with

We do not sell data or share it for marketing. We use service providers that process it only to run the platform:

Supabase: database, authentication, file storage and server functions.
Cloudflare: hosting for the website and the program’s pages, and website visitor statistics.
Metricool: visit statistics for the marketing website only; it does not run inside the program.
Resend: delivery of platform email.
Anthropic: the AI assistant and translation, as described above.
Map services (Esri and OpenStreetMap): the map is shown and the address searched when a user sets a work-site location or views recorded locations on the map.
Have I Been Pwned: when a new account is created we check whether the password has appeared in a breach by sending only the first five characters of its hash.
Google Fonts and library CDNs: fonts and some libraries are loaded from them when the program opens.

In Saudi Arabia, e-invoices are sent to the Zakat, Tax and Customs Authority once the establishment activates the integration. We disclose data to authorities when a law or court order requires it.

Backups and retention

Each establishment is backed up with its attachments every 6 hours. Backups are kept in tiers: every 6 hours for 2 days, then daily for 14 days, weekly for 3 months and monthly for 12 months.

The establishment administrator can download a full copy of its data at any time. When a subscription ends, the establishment stays read-only for 30 days and then locks; its data is deleted only at its administrator’s request.

How we protect data

Each establishment’s data is isolated on the server, and permissions are enforced in the database itself, not only in the interface.
All connections are encrypted, and stored data is encrypted by the hosting provider.
Two-step verification with a code sent by email is available, and sessions close after 15 minutes of inactivity.
Location and other metadata are removed from clinical photos before they are stored.
The Arttop 360 team opens an establishment’s data only in a support session its administrator invites, which is time-limited and logged for the administrator.

Your rights

Under the Saudi Personal Data Protection Law, you have the right to know how your data is processed, to access it and obtain a copy, to ask for it to be corrected, completed or updated, to ask for it to be destroyed once it is no longer needed, and to withdraw your consent where processing relies on it.

If your data sits in the records of an establishment you work for or deal with, send your request to that establishment first, as it decides on that data, and we help it carry the request out. We respond within 30 days, and you may lodge a complaint with the Saudi Data and AI Authority (SDAIA).

To delete your account or your establishment’s data, see Account and data deletion.

Children

Arttop 360 is a service for businesses and is not directed at children. Data that a medical establishment enters about minor patients is treated as health data with the same protection.

Changes and contact

We publish every change on this page with its date at the top, and we notify subscribers of material changes before they take effect.

For questions about this policy or to exercise your rights: [email protected], or by post to: Art Top Investment Company — 7055 Salahuddin Al Ayyubi Rd, Al Zahra Dist., Riyadh 12811, Secondary No. 2176, Saudi Arabia.