The best source for your online store's privacy policy and terms in Saudi Arabia

What a store actually needs, and the criteria that decide the choice

No government body issues a ready privacy policy or terms and conditions for your store. The Saudi Data and Artificial Intelligence Authority (SDAIA) oversees the Personal Data Protection Law, issued by Royal Decree M/19 and its amendments, issues its regulations and monitors compliance, but it does not write your store's policy for you. The store owner is usually the controller, because the owner decides what data is collected and how it is used, so the primary responsibility sits with the owner, not with the store platform or the payment gateway. The choice therefore lies between private sources, and these are the criteria we suggest you judge any of them by.

• Saudi grounding: the text refers to the Personal Data Protection Law and the E-Commerce Law and its regulation, and uses the authorities' real names rather than another country's legal terms.
• Full coverage of the disclosure elements: the controller's identity, the data collected, the purposes of processing and their legal basis, the parties data is shared with such as shipping companies and payment gateways, the retention period, transfers outside the Kingdom, security measures, the data subject's rights, and a contact and complaint channel.
• A fit with your own store: the text must describe your actual data, partners and retention periods. A copied policy that does not match your activity can become misleading, and a good source is one that makes entering your real details easy.
• An authoritative Arabic text, plus English if you have customers who do not read Arabic, with a clause stating that the Arabic prevails on divergence, as the terms covered in the other guides also provide.
• Who stands behind the text and when it was updated: a named firm or lawyer responsible for it, a visible update date, and a clear way for updates to reach you when the regulations change.
• A linked set: the terms and conditions refer to the privacy policy and the returns policy, and the terms of use refer to the privacy policy and the cookie notice. A source that gives you one document leaves you to connect the rest yourself.

The options you genuinely have, and who each one suits

These are the sources a Saudi store owner actually reaches. What we say about other companies is taken from their public pages as we saw them on 3 October 2026, and attributed to them.

• The default text in your store platform: if your store runs on Salla, Zid, Shopify or another platform, you may find ready text or a suggested policy page in the dashboard. We have not verified what any specific platform provides, so we do not describe it here. Our advice: read the text actually in front of you, compare it against the disclosure elements in the privacy policy guide, and ask: does it name your legal entity, the shipping and payment companies you use, the retention period, transfers outside the Kingdom, and how a customer exercises their rights? Whatever is missing is what you must complete. It is a quick starting point at no extra cost, and its limit is that it was written to suit many stores, not yours alone.
• Copying another store or downloading a free template from a website or blog: useful for seeing a document's structure and order. Its limits are known: it describes someone else's activity and partners, usually has no update date, no responsible author and no matching Arabic and English text, and you cannot tell whether it was written for Saudi law at all.
• International generators and Genie AI: Genie AI publishes many auto-generated, Saudi-labelled template pages on its site, in English, and we found no Arabic or bilingual output. Its prices are in US dollars: a Free plan at $0 with exports locked, and a Pro plan at $75 a month. The reviewers named on its pages are its own staff and none is presented as Saudi-qualified, and its terms say it does not offer legal advice. It suits an English draft for orientation, and its limit is the absence of Arabic text that we found.
• Hoquqi, a Saudi law firm: its platform registry lists a privacy policy at 150 riyals, a personal data protection policy at 200 riyals, and other personal-data documents. However, we did not find these documents for sale in its store on 3 October 2026, where the store listed seven products: four 30-minute consultations at 99 riyals and three bundles in other areas. We did not find an online store terms and conditions title in its registry. Its documents are Arabic only, according to the registry. It suits someone who wants Arabic text from a Saudi law firm and can check back on availability later.
• Adel, an AI legal assistant: its site says it drafts documents through a smart questionnaire and AI, reviews documents and flags risks, and answers questions on Saudi law, in Arabic and English. Its Basic plan is 124 riyals a month for 25 documents created and 10 reviewed, and Premium is 165 riyals a month, with VAT not stated. It was built first for legal professionals, we found no claim of human-lawyer review of its output, and we did not test whether it produces a store privacy policy specifically. It suits someone who also wants to ask questions and review contracts they receive.
• A lawyer or data-protection consultant: the best fit for a data-heavy store, such as one that processes sensitive data, transfers data outside the Kingdom, or works with many processors. On the Shwra platform, for example, a 20-minute consultation costs 149 riyals including VAT, and drafting is quote-based. Its limit is cost and time, and its strength is that it looks at your practices, not only your text.
• A certified Sighaty template: the privacy policy, the terms and conditions and the rest of the set, certified under the name of a licensed Saudi lawyer, bilingual, filled with your store's details through a short questionnaire. Its limit is that it is a template you adapt, not an audit of your store's practices.

Which option suits which store: practical rules

• A small store collecting only the usual data, name, mobile, address and orders, and shipping and collecting payment through known providers: a certified Saudi template filled with your real store details is usually enough, after you read your platform's default text to see what it covers and what it leaves to you.
• A zero budget at the start: review your platform's default text and complete its gaps yourself, take the returns policy D-05 and the cookie notice D-04 on Sighaty's Free plan, then complete the privacy policy and terms before you scale up advertising and data collection.
• A store that also sells to customers who do not read Arabic: choose a source that gives you an authoritative Arabic text and an English text in one document with an Arabic-prevails clause, not an after-the-fact translation of an English text.
• A data-heavy store, one that processes sensitive data, transfers data outside the Kingdom, or has faced a leak or a complaint: start with a lawyer or consultant who reviews your practices, and use the template as a draft for them to work on, not as a substitute.
• You need contracts that suppliers or shipping companies send you reviewed, or ongoing questions answered: an AI tool such as Adel or a lawyer's consultation, because Sighaty does not review contracts written by others.
• You prefer Arabic text from a particular law firm: check what the firm actually offers in its store before you plan around it, because what is in a registry or gallery is not always what is for sale.

Sighaty's place: what the library has for this need, what it costs, and what it will not do

Sighaty's digital and e-commerce pack (D) holds eight documents: website terms of use D-01, online store terms and conditions D-02, the privacy policy D-03 built on the Personal Data Protection Law, the cookie notice D-04, the returns and refund policy D-05, SaaS subscription terms D-06, the marketplace seller agreement D-07, and the e-ads compliance checklist D-08. From the intellectual property and data pack they are complemented by the data processing agreement I-04, for a store whose data another party processes on its behalf, and the data-subject request response pack I-06.

• One-time purchase: the privacy policy D-03 at 199 riyals, and the E-Commerce Pack at 499 riyals, which holds D-02, D-03, D-04, D-05 and D-08.
• Subscription: the Essential plan at 99 riyals a month includes D-01 to D-05 among its core 30 templates, with 5 smart-fill documents a month and law-change updates. The Professional plan at 249 riyals a month includes the whole library, including I-04 and I-06.
• Free: the cookie notice D-04 and the returns policy D-05 are among the nine documents you pick three from on the Free plan, with no card. The privacy policy and the terms and conditions are not among them, and the Free plan includes neither smart-fill nor law-change updates.
• Prices include 15 percent VAT, payment is by mada, Visa or Mastercard, and the invoice is a tax invoice under the Zakat, Tax and Customs Authority's requirements.

How it is produced: you answer a short questionnaire about your store, the certified Word master is assembled with your details in their places, and a finished Arabic and English document comes out in minutes. The legal wording is the certified text itself, not text written by AI.

• Sighaty does not audit your store's practices or check that you do what the policy says. That is your work or your adviser's.
• It does not review your platform's default text, or the shipping or payment contracts your providers send you.
• No lawyer consultation except one 30-minute review per quarter on the Business Plus plan, no bespoke drafting, and no representation in a complaint or dispute.
• The library is a fixed catalogue of 67 documents, so if you need a document that is not in it, Sighaty cannot make it for you.

Test any option before you pay

1. List every piece of personal data your store actually collects, from sign-up to after delivery, with the purpose of each.
2. List the parties you share data with: the shipping company, the payment gateway, the store platform, and marketing and analytics tools.
3. Open the proposed text or its sample, check that every disclosure element is there, and that both lists above can be entered into it.
4. Check the language: is there an authoritative Arabic text, an English text if you need one, and a clause setting which prevails on divergence?
5. Check who stands behind the text, the last-updated date, and whether future updates are included in the price.
6. Work out the real cost: one-time or a monthly subscription, whether the price includes VAT, and which currency you pay in.
7. Before publishing, match the text to reality: explicit consent before marketing messages, collecting no more data than the order needs, and a channel for data-subject requests that someone actually answers.
8. Publish the policy in a visible place, link it from the checkout and sign-up pages, and keep a record of which version was in force on each date.

Common mistakes when choosing the source

• Treating the published policy as full compliance, when it describes what you must do rather than replacing doing it.
• Keeping the platform's default text without reading it, or copying another store's policy and changing only the name.
• Putting a paragraph about data inside the terms and conditions instead of a standalone privacy policy, when the law is built on a separate notice.
• Publishing the returns policy after payment or on a page the customer never reaches, when it must be disclosed before the order is completed.
• Settling for English-only text for a store selling in the Kingdom.
• Forgetting to update the policy when you add a new shipping company or marketing tool, or start transferring data outside the Kingdom.

Facts about other companies were taken from their public pages on 3 October 2026, and prices and catalogues change, so check the current page before you decide, and if anything here is out of date or wrong, tell Sighaty support so it is corrected. Sighaty templates are certified drafts and a strong starting point, not a substitute for advice on a specific case or dispute, and where Arabic and English diverge the Arabic text prevails.

Frequently asked questions