Privacy Policy

1. Who we are and what this policy covers

1.1 This policy is issued by Almustaqbal Alfadh for digital marketing Establishment, trading as FTH Digital Marketing, Commercial Registration No. 1009092617, Riyadh, Kingdom of Saudi Arabia ("FTH", "we").

1.2 It covers the FTH Maps platform at maps.fth.marketing (the "Platform") and what the Platform collects about the people who use it. It does not cover FTH's public websites, which carry their own privacy notices.

1.3 FTH processes Platform clients' data, including review data received from Google, as a processor on the client's behalf under the Data Protection Specifications published at fth.marketing/en/data-protection in their current version. This policy does not amend those specifications. It explains what the Platform does with your data as a user of it.

1.4 The organisation that invited you (the "Client") decides why you use the Platform. Your account data is processed to provide the service to that organisation, on its instructions, inside its workspace. In the limited cases where no client stands behind an account, such as FTH's own staff accounts, FTH is the controller of that account's data.

2. What we collect

2.1 At account creation. An account is created by an invitation issued by an authorised administrator of the Client, or by self-registration when FTH makes it available, in which case you give us your email address directly. The invitation carries your email address as the administrator typed it, your role and the branches assigned to you. On accepting it you provide your name and a password. The password itself is never stored; an argon2id hash of it is.

2.2 Google sign-in (optional). If you choose to sign in with Google, Google sends us the account identity: email address, name, account image, and the sign-in tokens this requires. This option does not create a new account; it attaches to an existing, verified one.

2.3 During use. The Platform records: your IP address as reported by the edge network in front of it; a short label for your browser and system (such as "Chrome on macOS"); your approximate country as a two-letter code; the time of your last sign-in; your language preference; your session records; failed sign-in counters; hashes of your previous passwords, to prevent reuse; a record of the messages sent to you; and product usage events written into our own database, never to a third party.

2.4 The audit trail. Every privileged action on the Platform is recorded with who performed it and when, and a snapshot of what changed before and after. That snapshot may contain personal data where the change involved it, such as a user's name or a billing email address.

2.5 Review authors. Reviewer names and review text reach the Platform from Google under the Client's authorisation, never through a form in the Platform. They are processed under the Data Protection Specifications: a reviewer's name is not shown on any Platform screen and is not exported, though it may appear in the email alerts about low-rated reviews sent to the Client's users. The Client has a setting that decides whether reviewer names are stored at all. No profiles of individuals are built.

2.6 The Platform collects no payment card data and no government identity documents. For a paid subscription it records the billing details needed to issue the invoice.

3. Who receives your data outside the Platform

3.1 Google. When a Client connects its workspace to a Google account, Business Profile and review data moves between the Platform and Google's official APIs under the Client's revocable authorisation. Google is not an FTH sub-processor.

3.2 Breached-password check. Whenever a password is set, changed or reset, the Platform sends only the first five characters of the password's SHA-1 hash to the Have I Been Pwned service (api.pwnedpasswords.com) to learn whether that password has appeared in a known breach. The password itself, its full hash, your email address and any identifier of you never leave the Platform, and the service cannot learn the password or who is setting it. This is a security control applied to every user.

3.3 Email. Verification messages, security notices, invitations, digests and reports are sent from the mail server FTH operates at the hosting provider named in the sub-processor register.

3.4 Infrastructure. The Platform, its database and its encrypted backups run at Contabo GmbH within the European Union, and traffic to it passes through the edge network of Cloudflare, Inc. The authoritative sub-processor list is published at fth.marketing/en/subprocessors.

3.5 The Platform loads no third-party script, no external font and no analytics or advertising tool. While you use it your browser contacts exactly one host, maps.fth.marketing, except for MyFatoorah's payment page when you pay an invoice.

3.6 FTH works from outside the Kingdom too. FTH personnel operate, develop and support the Platform remotely, including from outside the Kingdom, under the Data Protection Specifications, and FTH maintains a documented assessment of these transfers, available to the Client on request.

3.7 Payment. When an invoice is issued the Platform sends the buyer's name and email address to MyFatoorah, the payment provider named in the sub-processor register, to create the payment link. Card details are entered on MyFatoorah's page directly and never pass through the Platform.

4. Cookies

4.1 A visitor who is not signed in receives no cookie at all.

4.2 When you sign in, only cookies necessary for operation are used, and none of them is used for analytics, tracking or advertising:

__Secure-better-auth.session_token — Your session on the Platform — Ends when the browser closes, or 30 days if you tick "remember me"

__Secure-better-auth.dont_remember — Records that you asked for a session that is not kept — Ends when the browser closes

__Secure-better-auth.two_factor — Only while a two-factor code is being entered — 10 minutes

__Secure-better-auth.trust_device — Only if you choose "trust this device" at the two-factor prompt — 30 days

gbp_pkce — Only while a Google Business Profile account is being connected — 10 minutes

fth_branch_retired — A short-lived notice after a branch is retired; carries an internal identifier only — 120 seconds

4.3 The Platform therefore shows no cookie choice banner: there is nothing to choose.

5. How we protect your data

• Passwords are stored as argon2id hashes; a password that has appeared in a known breach is refused, and so is a password previously used on your account.

• Two-factor authentication is available on every account, and a Client can require it across its workspace.

• Each Client's data is isolated by the database engine itself, verified by automated tests.

• Stored Google Business Profile credentials are encrypted with AES-256-GCM, and backups are encrypted before they leave the Platform host.

• Connections to the Platform are encrypted with TLS.

• You are notified by email when a new device signs in to your account; the message carries a short device label, not the full browser details.

• A verification message is sent to your address when your account is created.

6. Artificial intelligence

No feature of the Platform sends review text or any Client data to an AI model provider today. The Platform's AI setting is off by default, and switching it on today processes nothing and transfers nothing. Before any feature that sends data to an external provider operates, this policy and the Data Protection Specifications are updated and published, and the feature runs only after an authorised user of the Client enables it for that workspace.

7. Retention

Audit trail, usage events, sent-message records, Business Profile change events, review removal request copies — 12 months

Account and membership data after the Client's agreement ends — 90 days from the end date

Known devices — 365 days from last use

Expired sessions and verification tokens — Deleted on expiry

Failed sign-in lockouts — 24 hours after release

Two-factor reset tokens — 7 days after expiry or use

Content of a workspace whose deletion was requested — Removed permanently after a recovery window of 30 days unless another period is set

Encrypted backups — Destroyed on a rolling schedule

These periods are enforced by an automated job that runs daily.

8. Your rights

8.1 Under the Personal Data Protection Law you may request access to your data, its correction and its destruction, and object to its processing in the cases the law provides.

8.2 The Platform offers no self-service account deletion. Requests are made through the Client's workspace administrator, or directly to privacy@fth.marketing, and are fulfilled within 10 business days of the Client's instruction as controller.

8.3 You may lodge a complaint with the Saudi Data and Artificial Intelligence Authority (SDAIA) as the competent authority.

9. Incidents

On any actual or suspected incident affecting your data, the Client is notified without undue delay, and FTH supports notification to the competent authority within 72 hours under the Implementing Regulations.

10. Minors

The Platform is a business tool for organisations. It is not directed at persons under 18, and we do not knowingly collect their data.

11. Changes to this policy

Every version of this policy is published with a version number and effective date at fth.marketing, and publication constitutes sufficient notice. No existing protection is reduced without prior notice to the Client.

12. Contact

privacy@fth.marketing. This policy is issued in Arabic and English; the Arabic text prevails in case of any discrepancy.

---