Privacy Policy — “Jisr — Qiwa Login” extension

Last updated: 2026-10-06

What it is

A helper browser extension for the Jisr business-management system. Its single purpose is to sign the user in to the Qiwa platform from inside Jisr, then open Qiwa already signed in.

Data handled

• Qiwa sign-in credentials (ID number, password, SMS code): typed by the user into the Jisr page and sent directly to Qiwa's official servers (sso-api.qiwa.sa) to complete sign-in. They are never stored by the extension, by Jisr or anywhere else, and are cleared from memory after use.
• Qiwa session (session cookies): after a successful sign-in the extension receives the Qiwa session cookies from the server's response and saves them in the user's own browser, so Qiwa opens already signed in. It is the user's own session and is not sent to any other party.

What we do not do

• We do not sell or share data with any third party.
• We do not use data for anything other than the sign-in described above (no ads, no analytics, no profiling).
• We do not read any site other than the Jisr site and Qiwa (*.qiwa.sa).
• We do not load remote code; all extension code ships inside the package.

Permissions

• Qiwa domains (*.qiwa.sa): sending the sign-in requests to Qiwa's official servers and opening the Qiwa portal after success.
• Cookies: saving the Qiwa session cookies in the browser after sign-in (the user's own session).
• Web requests: reading the session cookies returned in the Qiwa server's response in order to save them.
• Storage and modifying the extension's own request headers: attaching the sign-in session to the extension's requests to Qiwa only.
• A script on the Jisr site only: receiving the sign-in details from the Jisr page and passing them to the extension.

Contact

For privacy questions contact your organization's Jisr administrator.