Last updated: 7 October 2026
1. Who we are and the scope of this policy
Tanaqul Precious is a platform for buying physical precious metals, keeping them in vaults, and selling, granting and collecting them. It is owned and operated by Exit Finance, CR 1010843884, registered with the Ministry of Commerce ("we"), which is the controller of the personal data described in this policy.
This policy covers: the platform on the web (investor.tanaqul.app), its mobile and tablet version, and the public Tanaqul Explorer (explorer.tanaqul.app).
Browsing Tanaqul Explorer does not require providing any personal data. When you open an account and use the platform, we collect the data described below.
2. The data we collect
2.1 Identity
If you hold a Saudi national ID or a residence permit (iqama), we verify your identity through the National Unified Access service (Nafath), and we receive from it: your ID or iqama number, your full name in Arabic and English, your nationality, your date of birth in both the Gregorian and Hijri calendars, your sex, and the issue and expiry dates of your ID.
2.2 Contact data
Your mobile number, your email address, your language, and your notification preferences.
2.3 Sign-in and security
- Your password, stored only in one-way encrypted form, the temporary verification code, and your two-factor authentication settings.
- Data about your devices that we use to recognise them and protect your account: the device fingerprint (a value derived from the properties of the browser or device), the device's name, type, operating system and browser, the IP address, the time of each sign-in and session, and the device's push notification identifier if you enable push notifications.
- Your electronic signature when a document requires it.
2.4 Bank and payment data
- The numbers of your bank accounts (IBANs) that you add so that your balance can be transferred to them.
- Cards: card payments are made on the page of the Noon Payments payment gateway. We do not see or store your full card number or its security code; we store only the card type, its last four digits, its expiry date, the name printed on it, and a reference from Noon Payments, so that you can pay with a saved card.
2.5 Custody and transactions
The bars and grams registered in your name, your vault key (a pseudonymous identifier that links your records in the custody record), your appointments at the vault, your offers, your purchase, sale, grant and collection transactions, your recurring purchase plans and contracts, your balance movements and their transfer to your bank account, invoices, storage fees, and subscriptions.
2.6 Messages, support and the Smart Hub AI Assistant
- Support requests and our replies to them, and the notifications we send you by text message, by email or as push notifications.
- The Smart Hub AI Assistant (for subscribers): when you ask it a question, your message is sent, together with a summary of your account — your name and account number, your holdings, your balance, your last three purchases or sales, and the applicable fees — to Anthropic in the United States of America to answer it, and we do not store your questions or the answers in our systems.
2.7 Company accounts and linked accounts
For a company account: the company's name, its commercial registration number, its unified national number, the name and ID number of the authorised person, and the authorisation document. For an account managed on behalf of another person (under a power of attorney or guardianship): the nature of the relationship and its supporting document.
3. Why we use your data
- To provide the service (the contract between us): opening and managing your account, keeping and recording your metals, carrying out purchase, sale, grant, collection and transfer transactions, vault appointments, invoices, and support.
- To meet our legal obligations: identity verification, anti-money laundering and counter-terrorism financing procedures, reporting to the competent authorities, zakat, tax and e-invoicing, and keeping records for the periods required by law.
- To protect accounts (our legitimate interest): recognising new devices, and preventing fraud and misuse.
- With your consent: push notifications, and the Smart Hub AI Assistant that you choose to use. You can turn off push notifications at any time from the platform settings, and stop using the assistant whenever you wish.
We do not display advertisements, we do not use advertising or tracking tools, and we do not sell your data.
4. What is public
- Tanaqul Explorer displays the custody record to the public: vault keys against bars, the metal and grams, the bar's weight and purity, the vault, the prices and times of purchases and sales, and the time the vault key was created. It never displays your name, your ID number or your mobile number. The vault key is a pseudonymous identifier, but anyone who knows that a particular key is yours can see its records.
- Delivery certificates carry a link and a QR code that open a public verification page showing the full name of the certificate's owner and their full ID number, and the bar and the metal; so share the certificate only with someone you want to see this data.
- Invoices carry a link and a QR code that open the invoice, and show the buyer's name and the amounts.
- Records in the custody record are permanent, because the record is linked by digital fingerprints and cannot be amended; so the records of a vault key remain in it even after your account is deleted.
5. Who receives your data
We do not sell, trade or rent your data. We share it only with the service providers we need to operate the platform, each of which works on our instructions and only to the extent its service requires, and with official authorities when the law requires it:
- Nafath — identity verification for holders of a national ID or an iqama, through our gateway.
- Msegat — text messages.
- Twilio SendGrid — email (United States of America).
- Google Firebase Cloud Messaging and Apple's notification service — push notifications (United States of America).
- Noon Payments — card payments.
- The bank through which we carry out the transfer of your balance to your bank account.
- Anthropic — the Smart Hub AI Assistant (United States of America).
- Hosting and network providers: Railway (the platform's servers and its database), Vercel (the web pages of the platform and the Explorer), and Cloudflare (network protection and delivery) — outside the Kingdom.
- The validators who confirm the custody record receive only pseudonymous records — vault keys, grams, prices and digital fingerprints — and never receive names, ID numbers or contact data.
- Official authorities when the law requires it: the Saudi Central Bank, the General Directorate of Financial Investigation, the Zakat, Tax and Customs Authority, and the courts or other competent authorities.
6. Transfer of data outside the Kingdom
Some of the providers named in section 5 process data outside the Kingdom of Saudi Arabia, as shown there. We transfer personal data abroad only as permitted by the Personal Data Protection Law and its implementing regulations, and only to the extent the service requires.
7. Data retention periods
- Identity records, documents, and custody, transaction and payment records: at least ten years from the end of your relationship with us, as required by anti-money laundering laws.
- Expired sign-in sessions: deleted 90 days after they end.
- Delivery records of emails sent to you: deleted after 90 days.
- Registration requests that were started but not completed: deleted after 30 days.
- References to Nafath verification sessions: deleted after 30 days.
- Pseudonymous records in the custody record: permanently (section 4).
8. Deleting your account
You can delete your account yourself from any browser, without needing to download anything: sign in at investor.tanaqul.app (or from the platform on your phone), then open Settings → Danger Zone → Delete Account.
Then enter the verification code sent to you by text message to your registered mobile number; it is valid for 5 minutes.
Before deletion: deletion does not go ahead while you have open offers, a balance, amounts reserved for a recurring purchase plan or a contract, managed accounts linked to your account, bank transfers in progress, or existing appointments at the vault; the platform shows you what must be closed first.
What happens after deletion: your account stops immediately, you cannot sign in to it, and all your sessions end. We keep your identity data and the records of your transactions, your payments and the custody of your metals, protected, for the period stated in section 7, and we use them only to meet our legal obligations. The pseudonymous records in the custody record remain permanently.
If you cannot sign in: write to us at support@tanaqul.sa from your registered email address, stating your registered mobile number, and we will verify your identity and reply to you within 30 days.
For full details: the "Account Deletion" page.
9. Your rights
Under the Personal Data Protection Law in the Kingdom, you have the right: to be informed of how your data is used, to access it and obtain a copy of it, to correct any of it that is inaccurate or incomplete, to request its destruction when it is no longer needed and the law does not require us to keep it, and to withdraw your consent where we rely on it. You have the right to file a complaint with the Saudi Data and Artificial Intelligence Authority (SDAIA).
To exercise any of these rights, write to us at Policy@exit.sa from the email address registered in your account. We may ask you to confirm your identity, and we will reply within 30 days. Some rights are restricted where the law requires us to keep records, such as anti-money laundering records.
10. How we protect your data
All communications with the platform are encrypted. IBANs, electronic signatures and two-factor authentication secrets are encrypted in our database, and passwords are stored only in one-way encrypted form. Access is limited to the employees who need it, and administrative actions are logged. We notify the Saudi Data and Artificial Intelligence Authority and those affected of any leak of their personal data, as required by law.
11. On your device
The platform does not use cookies.
The platform stores in the local storage of your browser or device your sign-in session, a copy of the account data it shows you, and your settings (such as language and appearance), and signing out removes the session and the account data. Fonts are loaded from Google Fonts, jsDelivr and Online Web Fonts, and our location map from Google Maps, and these providers receive your IP address when they are loaded.
12. Minors
The platform is intended for adults. We do not open accounts for anyone under 18 years old, and identity verification rejects them.
13. Other sites and pages
When you move to a page or site of another party — such as the Noon Payments payment page or Google Maps — the data you provide there is subject to that party's own privacy policy.
14. Changes to this policy
We publish any change to this policy on this page with its date, and we notify you within the platform before any material change takes effect.
15. Contact us
Exit Finance, CR 1010843884, registered with the Ministry of Commerce.
For enquiries and privacy requests: Policy@exit.sa
16. Governing language
This policy is published in Arabic and English. In case of any discrepancy, the Arabic version prevails.