Aamalak Platform Terms & Conditions

A subscription is formed by accepting these terms through the electronic method provided for that purpose or by signing a service agreement. By accepting on behalf of a business, you confirm that you hold valid authority to bind it to the subscription and to use its data and the services within your permissions. If you are not authorized, you may not create an account in its name, connect its accounts or upload its data.

Users must have full legal capacity. Simply visiting the website does not create a paid subscription or an authorization to access a bank account. Accepting these terms is also not blanket consent to the processing of personal data, to marketing, or to sharing data with other parties; separate consents are requested where the law requires them.

Aamalak is a financial analysis and business decision-support platform. Depending on the plan and the features available, its services include importing bank statements and financial statements; viewing balances, transactions, cash flows and indicators; analysing risk and financing readiness; reviewing Etimad tenders and assessing their fit and the financial readiness of projects; and preparing reports and managing team members and their permissions.

The availability of bank connections, data sources and integrations varies with the account type, bank, service provider, authorization and regulatory requirements. Showing a feature as coming soon is not a promise to enable it by a particular date. The subscription order or a separate agreement sets the scope of custom integrations, support services and any service level.

A subscription is not a licence to provide a regulated financial service, nor evidence that any particular feature is licensed. Any service subject to the supervision of the Saudi Central Bank or another competent authority is limited to the scope permitted by law and is offered only after the required licences and approvals are obtained. These terms do not authorize the Company to move funds, make payments or enter into financing on the Customer’s behalf.

The Customer must provide accurate, up-to-date information about the business and its authorized representatives, manage user permissions according to job need, and revoke them as soon as the reason for them ends. Sharing sign-in credentials between people, or giving unauthorized people access to the business’s data, is prohibited.

Users must protect their sign-in method and devices, use the additional verification methods that are available or required, and notify us without delay if they suspect unauthorized access or lose an authentication method. These obligations do not relieve the Company of its responsibility for platform security or for fixing shortcomings within its control.

The Customer is responsible for the lawfulness of collecting the data it uploads or makes available, for being properly authorized to use it, for informing the people it concerns, and for identifying the appropriate legal basis for processing it. This includes data about employees, customers, suppliers, owners and other individuals contained in statements, financial statements and attachments.

Only the data needed for the service should be provided, and excess data should be redacted before upload where possible. Uploading passwords, verification codes or bank sign-in secrets is prohibited, as is uploading images of official identity documents without a necessity and legal basis that permit it, or data the Customer has no right to process. A business’s ownership of a document does not entitle it to override the rights of the individuals named in it.

The Customer reviews automatically extracted data, transaction categories and results before using them in a material decision. If a material error appears, both parties cooperate, each within its role, to correct it or to pause the related processing until it is verified.

A connection is made only on valid authorization from the account holder or their authorized representative, through the approved consent journey for the service, stating the scope of data, the purpose and the duration of access. Use is limited to that scope, and the authorization is renewed when needed. Bank sign-in secrets may not be shared with platform staff or entered into any form other than one provided by the party authorized to verify them.

Disconnection can be requested through the available connection-management feature or through the contact channel, subject to the procedures of the service provider. Disconnection stops future access under the revoked authorization; data collected earlier is handled under the Privacy Policy and the legal deletion and retention requirements. Disconnection alone does not mean all earlier records are deleted immediately.

Data may be delayed or interrupted because of the source, an expired authorization or maintenance. Check with the bank or the original source to verify a balance or transaction before making a financial decision. External services are also subject to their providers’ terms, which are explained on activation; this does not relieve the Company of its duties in selecting and contracting with processing providers.

The platform helps you discover tenders and review their requirements and fit for your business. The Etimad platform and the issuing entity remain the reference for verifying tender documents, dates, amendments, and submission and award conditions. A listed opportunity does not guarantee that the Customer meets its conditions or will be awarded it.

Reviewing a tender does not amount to submitting a bid, buying tender documents, issuing a guarantee or making any commitment in the Customer’s name. Any such executive action, if offered in the future, will require a separate authorization and agreement and compliance with legal requirements.

Readiness results, risk indicators, forecasts and recommendations are support tools based on the data available and the analysis assumptions. They are not an accredited credit rating, a report issued by a credit bureau, a financing approval, or a guarantee of returns or financial performance. The financing institution alone assesses financing and its terms.

Some features may use automated processing or artificial intelligence to extract, categorize or summarize information. Outputs may contain errors or incomplete information, so they must be checked and reviewed by a person before being relied on. They are not a substitute for specialist accounting, legal or investment advice.

A subscription does not permit the Customer’s personal data or confidential documents to be used to train general-purpose models, and does not grant permission to send the Customer’s report to a financier or partner. Any optional sharing requires the recipient, the data, the purpose and the necessary authorization or consent to be specified. Where personal credit data is processed, its specific controls apply, including explicit consent where the law requires it.

The EFM Bridge portal lets a business link with a partner it chooses to discuss its financing needs. Before a link is completed, the partner’s identity and capacity, the intended services and the data that will be made available to the partner must be shown, including monthly obligations, financing gaps and the contact details needed, depending on the scope of the feature. Access is not activated merely because a partner creates an account or obtains a referral code.

Linking requires an explicit affirmative action by the business’s authorized representative, as well as a valid basis for disclosing any personal data and any consents the law requires. The Customer can unlink at any time; this stops future access, and the handling of anything already disclosed is governed by the law, the agreement and the notice shown before sharing. Unlinking does not mean a copy already received can be recalled; instead, the recipient must delete or restrict it once the purpose ends, unless there is a legal reason to retain it.

Partners must use the data only for the services the Customer linked them for, and may not sell it, re-share it, or use it for unauthorized marketing or any other purpose. Partners are subject to separate terms and to verification of their identity and legal standing before customer data is made available to them. A partner’s appearance in the portal is not an endorsement, a guarantee of its offer or a financing approval, and its data-protection role is determined by what it actually does.

Plan details, usage limits, fees, taxes and the billing cycle are shown before a paid subscription is completed or in the accepted quotation. No undisclosed fees are charged. Custom services are subject to a written agreement setting out the scope of work, the fee and any additional costs.

Free or trial use does not turn into a paid subscription, and automatic renewal or recurring charges are not enabled, without clear disclosure and explicit acceptance. Where automatic renewal is available, how to stop it and when it falls due are explained before you agree to it.

Changes to recurring subscription prices take effect from a later cycle, after the Customer is notified far enough before renewal to make a decision. Fees for a period already paid are not changed retroactively without agreement. The Customer may dispute an invoice or charge it believes is incorrect through the contact channel, providing the necessary transaction details without sending payment secrets.

Cancellation of a subscription or stopping renewal can be requested through the subscription settings, where available, or the official contact channel. The cancellation confirmation states the date service ends, the effects of cancellation and any amount owed or refunded. The refund terms announced before purchase or agreed in writing apply, without reducing any mandatory rights granted by law.

No cancellation fee is charged unless disclosed in advance, and no refund right required by law or arising from the Company’s breach of its obligations is withheld. Fees for services that could not be provided for reasons attributable to the Company are settled in accordance with the agreement and applicable law.

Before closing an account, the Company coordinates with the Customer to export the data available within its permissions or to return it under the service and data-processing agreements. Access is then removed and deletion is carried out under the retention policy, except for records that must be kept by law. A financial dispute does not justify preventing the exercise of legal rights relating to personal data.

The platform may not be used for fraud, impersonation, or breaching the law or the rights of others; to upload malware; to exceed access permissions or plan limits; to collect other users’ data; to disrupt the service; or to penetration-test it without written permission specifying the scope and duration.

Reports must not be published in a misleading way or attributed to a government body, a financier or an accredited rating agency. The Company’s name or trademark may not be used in a way that suggests a partnership or accreditation that has not actually been granted.

Rights in the platform, its software, designs and marks belong to their owners. A subscription grants the Customer a limited right of use for its business purposes for as long as the service is active and within its plan. The Customer’s rights in its data and documents are preserved, subject to the rights of personal-data subjects and of third parties.

The Company’s right to handle Customer data is limited to what is needed to provide the agreed service and meet its legal obligations. Uploading files grants no right to sell, publish or exploit them for an independent, unlawful purpose. Both parties must protect confidential information and disclose it only to authorized persons or on a legal basis, and confidentiality continues after the relationship ends.

The Privacy Policy explains the purposes and legal bases of personal-data processing, the categories of recipients, retention and rights. The Data Protection Policy explains the organizational and technical protection requirements. Neither of them takes away individuals’ rights or the Company’s legal obligations.

When the Company processes individuals’ data uploaded by the Customer on the Customer’s behalf, a data-processing agreement governs the scope of instructions, data categories, processing duration, confidentiality, security, sub-processors, international transfers, incident response, rights, and return and deletion of data. The Company does not use that data for an independent purpose merely because it is in the service. If the Company sets an independent purpose for a particular processing activity, it assumes a controller’s obligations for it.

We exercise professional care in operating and protecting the platform and fixing faults. Maintenance, security risks or orders from competent authorities may require the service to be restricted temporarily. Any suspension is limited to what is necessary, and the Customer is told the reason and effects where the law and security circumstances allow, with the opportunity to remedy or object as appropriate.

If the Customer commits a material breach, the affected part may be suspended or the subscription terminated after notice and a reasonable opportunity to remedy, where that is possible. Urgent action may be taken if continued access puts the data or the service at real risk. Data-recovery rights and legal rights remain subject to their own provisions.

Each party is liable for its own breach and for compensating any damage due under the law and the agreement. Assessing liability takes into account the cause of the damage, its link to the breach and how far each party contributed to it, including the accuracy of data, the review of outputs and the security measures within each party’s control.

Notices about the limits of the analysis or of external services are not to be read as an exemption from fraud, gross negligence, breaches of confidentiality and data protection, or rights that cannot legally be excluded. The Company does not guarantee uninterrupted service or that every output is free of error, while remaining committed to due care and to fixing faults.

We publish the updated version with its effective date and notify customers of material changes a reasonable time before they take effect. If a change requires new contractual acceptance or separate consent to data processing, the Company obtains it before applying the change. Continued browsing is not consent to a new purpose for processing personal data.

Mandatory legal provisions take precedence, then any special terms agreed within their scope, then these terms. On data processing, the data-processing agreement and the Privacy Policy must be observed, but may not be used to reduce legal rights. If any provision is invalid, the remaining applicable provisions are unaffected.

Service provider: Seen Tarbi Financial Technology Company. Commercial registration number: 4030473795. National address: Arab Business Center, Al-Rawis District, Jeddah, Kingdom of Saudi Arabia. For service enquiries and requests: https://efm.seentarbi.sa/contact. For privacy requests: complaint@xsquare.sa.

The relationship is governed by the laws of the Kingdom of Saudi Arabia, and disputes fall under the jurisdiction of the competent judicial authority or committee. The parties may try to settle a dispute amicably, but this is not a condition that blocks the right to go to the competent authority or file a complaint. Data subjects may file complaints about the protection of their data with the Saudi Data and AI Authority (SDAIA) in accordance with the legal procedures and deadlines.