Terms of Service

Last updated: 1 June 2026 — Effective date: 11 February 2025

1. Definitions

The following terms carry the meanings set out next to them throughout these Terms:

• “Company” or “we”: Encrypted Code Information Technology Co. (ECIT), Commercial Registration No. 7048922111, VAT No. 311533331400003, with its head office in Riyadh, Kingdom of Saudi Arabia.
• “Services”: all software, cloud services, platforms, APIs, consulting and development offered by the Company. They include — by way of example, not limitation — our SaaS products (such as the Murafaah platform for legal practice management), web & mobile development services for clients, cloud integrations, e-invoicing services and ZATCA integration, AI and IoT systems, and customer-communication channels via Meta (WhatsApp, Instagram, Facebook), X, YouTube, Snapchat and TikTok when explicitly enabled.
• “User” or “you”: the individual or entity that uses the Services, whether as a subscriber, employee, lawyer or end customer.
• “Organization”: the legal entity (company, firm, establishment) that opens an account and is considered the owner of both the data and the subscription.
• “Content”: any data, files, text, images, documents or messages that you input, create or upload through the Services.
• “Applicable Laws”: the laws and implementing regulations of the Kingdom of Saudi Arabia, including the Personal Data Protection Law (PDPL) and its implementing regulations, the Electronic Transactions Law, the E-Commerce Law, and the regulations of the Zakat, Tax and Customs Authority (ZATCA).

2. Acceptance & Eligibility

2.1. By accessing, using or creating an account on the Services, you fully and unconditionally accept these Terms. If you do not agree, you must immediately stop using the Services.

2.2. You confirm that you have reached the legal age (18 years or older) and possess the legal capacity to contract under Applicable Laws.

2.3. If you accept these Terms on behalf of an Organization, you represent and warrant that you are legally authorized to bind that Organization, which then becomes party to this agreement.

3. Description of Services

3.1. The Services are provided on an “as is” basis (SaaS / Cloud) over the Internet from local infrastructure and servers located within the Kingdom of Saudi Arabia.

3.2. The Services include — without limitation — case & client management, accounting, invoicing, e-invoicing & ZATCA integration, and customer communication channels via WhatsApp, Instagram and Facebook (Meta), and management of other social-media accounts (X, YouTube, Snapchat, TikTok), each enabled by the user explicitly per channel.

3.3. The Company may at any time, without an obligation to give prior notice: add, modify, remove or suspend specific features; perform maintenance; apply fair usage quotas; or update interfaces.

3.4. The Company does not itself provide legal or accounting advice; the Services are operational tools, and technical and legal responsibility for content rests with the User.

4. Registration & Account

4.1. Registration requires accurate, up-to-date information (name, email, mobile, commercial registration for organizations, VAT number where applicable). The Company may request verification of such information.

4.2. You are solely responsible for the confidentiality of your password and any single sign-on (SSO) tokens, and for all activity carried out through your account. You must notify the Company immediately of any suspected unauthorized access.

4.3. Accounts may not be transferred, sold or granted to third parties outside the Organization without the Company’s written consent.

4.4. The Services use Single Sign-On between Murafaah portals (the Organization’s subdomain and the main portal); you acknowledge that sessions may be renewed automatically between these portals in accordance with our security policies.

5. Subscription & Payment

5.1. The Services are offered through paid monthly or annual subscriptions, or on a pay-as-you-go basis for certain services (such as WhatsApp messages). Prices are displayed inclusive of VAT in accordance with Applicable Laws, and a ZATCA-compliant tax invoice is issued for each payment.

5.2. Payments are final and non-refundable except where Applicable Laws state otherwise or in documented cases of technical error by the Company. Auto-renewal applies unless cancelled by the User before the renewal date.

5.3. In the event of late payment, the Company may suspend or restrict the Services after giving a notice period of no less than seven (7) business days.

5.4. Secure payment methods licensed by the Saudi Central Bank (SAMA) are used. Card data is not stored by the Company; this is handled by authorized payment providers.

6. Acceptable Use

You agree not to do any of the following through the Services:

• Violate any Applicable Law in the Kingdom of Saudi Arabia, third-party rights, or public morals.
• Send content that is fraudulent, misleading, defamatory, inciting, or hate speech.
• Use the Services to send unsolicited (spam) or marketing messages without the recipient’s explicit consent under the Anti-Cyber Crime Law and PDPL.
• Attempt to breach the systems, bypass security controls, reverse-engineer, or distribute malware.
• Use the Services for activities that are prohibited or unlicensed under Applicable Laws.
• Use third-party customer data hosted with the Company for any purpose without explicit and documented authorization.
• Resell the Services or make them available to third parties without a written partnership agreement with the Company.

7. User Content & License

7.1. The Organization retains full ownership of any content it inputs or uploads. The Company does not claim any intellectual property rights over your content.

7.2. The Organization grants the Company a non-exclusive, limited, royalty-free license to use the content solely for the purpose of providing the Services (storage, transmission, backup, display, processing).

7.3. The Organization represents that it owns the necessary rights to the content, that it does not infringe any third-party rights, and that the Organization alone is responsible for its legality.

7.4. The Company maintains content backups in line with continuity-of-service requirements, for up to ninety (90) days after the Organization’s deletion of its content.

8. Intellectual Property

8.1. All rights in the software, interface designs, databases, logos and technical documentation belong to Encrypted Code Information Technology Co. or its licensors.

8.2. No intellectual property is transferred to the User merely by subscribing. The User is granted a limited, non-exclusive, non-transferable license to use the Services in accordance with their plan during the subscription period.

8.3. The “ECIT” mark and the “Murafaah” mark belong to the Company. They may not be used, nor may any similar logos or trademarks, without written consent.

9. Confidentiality

9.1. The Company treats the data of the Organization and User with strict confidentiality, and applies technical and administrative protection controls including encryption in transit (TLS) and at rest, access auditing, and separation of duties.

9.2. No data is disclosed to third parties except, exclusively, in the following cases:

• Pursuant to a judicial order or an official request from a competent governmental authority in the Kingdom of Saudi Arabia.
• With the Organization’s explicit written consent.
• To deliver a service that you have explicitly requested (such as sending an invoice via ZATCA integrations, or sending a WhatsApp message).

9.3. All data is stored on local servers inside the borders of the Kingdom of Saudi Arabia, and is not transferred outside the Kingdom.

10. Social-Media Integrations

Integrations cover: Meta (WhatsApp, Instagram, Facebook), X (Twitter), YouTube/Google, Snapchat and TikTok. Each connection is optional and follows the same OAuth + instant-revocation model.

a. Meta (WhatsApp & Instagram)

10.1. The Company allows the Organization to connect WhatsApp Business and Instagram Business accounts via official integrations from Meta Platforms, Inc. Connection is optional and activated by the User’s explicit consent from within the platform dashboard.

10.2. Once connected, your data sent to Meta is also subject to Meta’s terms and platform policies (Meta Platform Terms, Meta Business Tools Terms). The Organization acknowledges that it is responsible for compliance with Meta’s requirements, including the prohibition of marketing messages without recipient consent.

10.3. Data received from Meta (such as OAuth access tokens) is invalidated as soon as the connection is revoked by the User or by Meta.

10.4. The User may at any time revoke the connection from the Facebook settings:
facebook.com/settings?tab=business_tools, or from the integrations settings inside Murafaah. For more details, please see the Data Deletion Policy.

b. Other channels (X, YouTube, Snapchat, TikTok)

10.5. Each connection is subject to the original platform’s terms alongside these Terms. You are responsible for compliance with the publishing policies of those platforms (Twitter Developer Agreement, YouTube API Services Terms, Snap Kit Developer Terms, TikTok Developer Terms of Service).

10.6. OAuth tokens are stored encrypted and invalidated immediately upon revocation from within Murafaah or from your account settings on the original platform.

10.7. We do not use your data on those platforms for any purpose other than what you specifically request (post, comment, analytics) and do not share content with any third party.

11. Suspension & Termination

11.1. The Organization may terminate its subscription at any time from the account settings or by written notice. Payments for the current period are non-refundable unless explicit provisions state otherwise.

11.2. The Company may suspend the account immediately and without notice in the event of: a material breach of these Terms, late payment, abuse of the Services, or an official request from a competent authority.

11.3. After termination: your data is retained for thirty (30) days, extendable upon written request up to sixty (60) days, then permanently deleted, except for data that must be retained by law (invoicing records, for ten years per ZATCA requirements).

12. Disclaimers & Warranties

12.1. The Services are provided “as is” and “as available”. The Company makes no express or implied warranties regarding fitness for a particular purpose, uninterrupted service, error-free operation, or accuracy of content entered by the User.

12.2. The Company does not guarantee continued availability of third-party integrations (Meta, ZATCA, payment providers, etc.) and is not liable for their interruption or policy changes.

12.3. The Company exercises reasonable care to secure the Services, but no digital system is entirely risk-free.

13. Limitation of Liability

13.1. To the maximum extent permitted by Applicable Laws, the Company is not liable for any indirect or consequential damages, loss of profits, loss of opportunity, or reputational damage.

13.2. In any event, the Company’s maximum liability for any claim arising out of these Terms or the Services is limited to the fees paid by the Organization in the twelve (12) months preceding the event giving rise to the claim.

13.3. This clause does not exclude liabilities that cannot lawfully be excluded (fraud, gross negligence, bodily injury).

14. Indemnification

The Organization agrees to indemnify the Company against any damages, losses or costs (including reasonable legal fees) arising from its use of the Services in violation of these Terms, its infringement of third-party rights, or third-party claims caused by its content.

15. Force Majeure

The Company is not liable for any delay or breach resulting from causes beyond its reasonable control, including: internet or power outages, natural disasters, governmental orders, large-scale cyber attacks, or interruptions of third-party services.

16. Modifications

16.1. The Company may update these Terms at any time; the updated version is published on this page with an updated “effective date”.

16.2. Material changes take effect after at least seven (7) business days’ notice to the User by any means (email, in-platform notice).

16.3. Your continued use of the Services after such changes take effect constitutes implied acceptance of them.

17. Governing Law & Disputes

17.1. These Terms are governed by and construed in accordance with the laws of the Kingdom of Saudi Arabia.

17.2. Any dispute arising out of these Terms or the Services shall first be attempted to be resolved amicably within thirty (30) days.

17.3. If amicable resolution is not achieved, the dispute shall be referred to the competent courts in the city of Riyadh, Kingdom of Saudi Arabia.

18. General Provisions

18.1. No waiver: failure by any party to enforce any right under these Terms does not constitute a waiver of that right.

18.2. Severability: if any provision of these Terms is held invalid, the remaining provisions continue in force.

18.3. Assignment: the Organization may not assign this agreement without the Company’s written consent. The Company may assign to any affiliated or successor entity.

18.4. Entire agreement: these Terms together with the Privacy Policy and the Data Deletion Policy constitute the entire agreement between the parties.

18.5. Language: the Arabic version prevails in the event of any conflict with the English version.

19. Contact