Privacy policy

What we collect

We deliberately collect only what an earned wage advance needs. We do not ask for identity documents, we do not run a credit check, and we do not collect location data, contacts, photos or device identifiers for advertising.

From your employer, when they add you to their roster:

• Your name, mobile number and work email address
• Your national ID number
• Your IBAN — the bank account an advance is paid into
• Your monthly salary, department, job title, employee code and hire date
• Your employment status with them (active or inactive)

What we collect from you

• The mobile number you sign in with, and the one-time codes we send to verify it
• The amount of each earned wage request you make, and when you made it
• A record that you accepted this policy, and which version you accepted
• Messages you send us, if you contact support

What we do not collect

Your app-unlock PIN never leaves your phone. It is stored in your device’s secure storage and is never sent to Liquid, so we cannot see it, recover it, or use it. If you forget it, we verify your mobile number and you set a new one.

We do not collect your device location, your contacts, your photos, your browsing history, or advertising identifiers. We do not use your data for advertising and we do not sell it.

Why we use it, and on what basis

We use your data to run the service you or your employer signed up for:

• To verify it is you when you sign in — your mobile number and the code we send it
• To calculate how much of your salary you have earned so far this pay cycle
• To review and decide each request, and to pay approved amounts to your bank account
• To tell your employer what to deduct from your next salary
• To keep the financial records the law requires us to keep
• To answer you when you contact support

Who we share it with

We share only what each party needs to do its job, and only with these parties:

• Your employer — the amount and date of advances to deduct from your salary. Your employer does not approve or see the detail of individual requests beyond what payroll deduction requires.
• Our payout bank — your name, IBAN and the amount, so the transfer can be made.
• Authentica, our SMS provider — your mobile number, to deliver sign-in codes.
• Resend, our email provider — email addresses, to deliver codes and notices to company administrators.
• Google Cloud — our hosting and database provider, acting as our processor.
• Cloudflare — traffic routing and protection in front of our services.
• Regulators, auditors or law enforcement, where we are legally required to disclose.

Where your data is stored

Your data is stored in Google Cloud’s Dammam region, inside the Kingdom of Saudi Arabia. It is not transferred outside the Kingdom except where a named provider above necessarily processes it abroad to deliver a message to you, and then only the minimum needed to do so.

How we protect it

Your IBAN and your national ID are encrypted in our database with keys held separately from it, so they are unreadable even to someone holding a copy of the data. Your national ID is additionally stored as an irreversible fingerprint, which is what we match on, and we display only its last four digits.

Access to production data is restricted to named Liquid staff and every advance decision is recorded against the person who made it. All traffic between your app and Liquid is encrypted in transit.

How long we keep it

We keep your account and advance records for as long as you use the service, and afterwards for the period Saudi financial record-keeping rules require. When that period ends, or when you ask us to erase your data and we are not required to keep it, we delete the personal fields and retain only the anonymised financial totals we are obliged to hold.

If your employer removes you from their roster, your account is closed and no further advances can be requested. Records of advances already paid are retained under the same rules.

Your rights

Under PDPL you have the right to:

• Be informed of how your data is used — that is what this policy is for
• Request a copy of the personal data we hold about you
• Ask us to correct data that is wrong or incomplete
• Ask us to delete your data, where we are not legally required to keep it
• Withdraw consent where our use of your data rests on it
• Complain to the Saudi Data & AI Authority (SDAIA) if you believe we have handled your data unlawfully

Correcting your details

Your name, salary, IBAN and employment details come from your employer’s records, so the fastest way to correct them is through your company’s HR team. If you cannot resolve it that way, contact us and we will help.

Children

Liquid is for employed adults. We do not knowingly collect data from anyone under 18. If you believe we hold data about a minor, contact us and we will delete it.

Changes to this policy

If we change this policy we will update the date at the top and, where the change is significant, notify you in the app. Each version is recorded, and we keep a record of which version you accepted.

Contact us

For any privacy question, or to exercise any right above, contact us at info@liquid.sa. We answer within 30 days, as PDPL requires.