Data Deletion Instructions

Last updated: 1 June 2026 — Effective date: 11 February 2025

1. Overview

You have three ways to delete your data, or parts of it:

• Self-service deletion: directly from your account settings — instant.
• Email request: if you need broader deletion or no longer have access to the account.
• Meta-only disconnection: without affecting the rest of your data in Murafaah.

2. Self-Service Deletion

a. Delete your individual account

1. Sign in to murafaah.sa.
2. Open Account Settings > Security & Privacy > Delete Account.
3. Read the displayed warning, enter your password to confirm, then click Confirm Account Deletion.
4. A confirmation email is sent to you within 24 hours. Your reply makes the request effective.

b. Delete the Organization (for subscription owners)

1. Sign in to your Organization’s subdomain (e.g. yourorg.murafaah.sa).
2. Open Admin Panel > Organization Settings > End Subscription & Delete Data.
3. Choose between:
   • Cancel subscription, retain data (30 days) — you can return within this window.
   • End subscription and permanently delete data — countdown begins, deletion in 7 days after notice.
4. All active users in the Organization will be notified of the decision.

c. Delete specific data

At any time you may delete:

• Cases, invoices, clients, documents — from their screens inside the platform (deletion goes to a recycle bin for 30 days before permanent erasure).
• WhatsApp/Instagram messages — from the conversations screen.
• Attachments and files — from file management.

3. Email Deletion Request

If you cannot access your account, or want a broader-scope request, email info@ecit.sa including:

• Subject: “Personal Data Deletion Request”.
• Your identity: full name and national ID, or a copy of your ID (to prevent impersonation).
• The email used for the account or your Organization’s subdomain.
• Scope of deletion: are you requesting full account deletion, or specific data?
• Confirmation of understanding: “I acknowledge that deletion is final and irreversible.”

4. Disconnecting a Social Channel Only

If you only want to disconnect a specific channel without deleting your account or the rest of your data:

1. Open murafaah.sa > Social Media or Settings > Integrations.
2. Click Disconnect next to the channel you want to detach.
3. The access token is invalidated immediately, and we send no further requests to that platform on your behalf.
4. Content copies tied to the channel (messages, comments, reports) are deleted within 7 days — except invoice records, which must be retained per ZATCA requirements.

Currently supported channels:

• Meta channels: WhatsApp Business, Instagram Business, Facebook Pages (see section 9 for Facebook-specific flow).
• X (Twitter): revoke at x.com/settings/connected_apps or from within Murafaah.
• YouTube / Google: revoke at myaccount.google.com/permissions or from within Murafaah.
• Snapchat: revoke from your Snap account settings or from within Murafaah.
• TikTok: revoke at tiktok.com/setting/connected-apps or from within Murafaah.

5. What Exactly Gets Deleted

Upon approval of a full-deletion request, the following are deleted from all our databases and servers:

• Identity data: name, email, mobile, photo, national ID.
• Account data: (hashed) password, tokens, active sessions.
• Platform content: cases, clients, documents, tasks, dates, past support messages.
• Settings and preferences.
• Meta access tokens, Meta-linked permissions, message copies.
• Uploaded photos, files, and attachments.
• Your access logs (after the legal retention period elapses).

6. What Is Retained & Why

Some data must be retained — partially or fully — exclusively for legal reasons:

Such data has restricted access (accounting/legal staff only) and is not processed for any other purpose.

7. Timeline

1. Day 0: request received (you receive a “Request received” notice within 24 hours).
2. Day 1–7: verification of your identity and authority to make the request.
3. Day 7–14: deletion executed in the live production environment.
4. Day 30 max: completion of deletion from primary databases and written confirmation sent.
5. Day 90 max: completion of deletion from encrypted backups.

We may extend by 30 additional days in exceptional cases — with notice of the reasons.

8. Confirmation & Notification

You will receive three emails during the process:

1. Request received — within 24 hours of submission.
2. Follow-up — if we need additional verification.
3. Deletion completion confirmation — within 30 days.

9. Facebook Data-Deletion Flow (User Data Deletion)

In accordance with Meta Platform Terms, we provide two parallel mechanisms:

a. Revoke directly from Facebook

You may revoke our app’s permissions from your Facebook account at any time:

1. Go to facebook.com/settings?tab=business_tools.
2. Locate the “Murafaah” or “ECIT” app.
3. Click Remove.
4. Facebook will automatically notify our endpoint, and we will delete your access token and disable the integration within 24 hours.

b. Delete only Meta data by direct request

Email info@ecit.sa with subject “Meta Integration Data Deletion” including:

• The display name of your Facebook account.
• The page or account name linked to the integration.
• Approximate last date you used the integration.

We will confirm deletion within 7 business days.

10. Contact