Privacy Policy

The operator of the platform is the controller of personal data processed to operate customer and technician accounts, orders, kitchen requests, payments, invoicing, and support. Staff access data from the web dashboard under role-based permissions. We do not sell personal data and we do not license it for third-party marketing.

Depending on your role we may collect: mobile number; name; national ID or iqama; date of birth; email; secondary phone; password hashes (never the password itself); language preference; saved addresses and map coordinates used to resolve a district; order, cart, appointment, and kitchen-request history; photos or files you or a technician upload as job evidence; device tokens for notifications; and technical logs needed to secure the service.

Technicians also have workforce profile fields such as nationality and gender as recorded by operations. Card PAN and CVV are collected by the payment provider, not by us. Job photos may show parts of a dwelling; they are processed as operational evidence, quality control, and legal defence records, not as a public gallery.

We process data to perform the contract (accounts, OTP, coverage checks, pricing, scheduling, assignment, evidence, collection, invoices, complaints, and limited workmanship handling), to meet legal and audit duties (including zakat, tax, e-commerce, and law-enforcement requests that are valid under Saudi law), and, where applicable, on the basis of legitimate operational interests that do not override your rights, such as securing the service and defending claims. We do not rely on silence as consent for optional marketing.

We do not use live technician GPS in the current product. Location is used to place an address inside an activated district, not to broadcast a live map to the customer.

We share the minimum needed with assigned technicians so they can perform the job. Customer and technician phone numbers are not shown to the other party except where product rules allow it for that job. Payment data required to charge or refund is sent to the payment gateway. SMS OTP is sent through the messaging provider. Hosting, telemetry, or notification providers may process technical identifiers as processors under contract.

Authorities receive data only when Saudi law requires or permits it. Staff see only what their permissions allow. Support cannot execute refunds; finance does. Sharing with a technician or processor is not a sale of data and is not an admission of any claim.

Some processors (for example payment, messaging, hosting, or notification vendors) may store or access data outside the Kingdom. Where that occurs, we do so only as PDPL allows, including an adequate protection level, SDAIA-approved safeguards, or another lawful ground, and only for the purposes in this policy.

We keep account, order, payment, complaint, warranty, and audit records for as long as needed to provide the service, resolve disputes, and meet statutory retention, including commercial-book and ZATCA periods. When an account is closed we retain what the law or an open complaint, payment, or tax file still requires, then delete or anonymise the rest according to our retention schedule. Job photos follow the order and complaint file to which they belong.

We use encrypted transport, hashed passwords, scoped API keys, session expiry, and role-based access on the dashboard. Media downloads use time-limited links. No security measure is perfect; you must also protect your device and OTP. Tell us through the app if you believe your account was misused. A security incident is handled under PDPL notice rules where they apply; notice is not an admission of legally recognised harm.

Subject to the PDPL, you may request access, correction, or deletion of your personal data, and you may object to or restrict some processing, and you may withdraw consent where consent was the basis, without affecting processing already lawfully completed. Operational records (paid orders, invoices, tax files, complaints) may need to be kept even if you ask for erasure. Use in-app support or the complaints channel to exercise these rights. We will respond within the periods required by law. You may also contact the competent authority (SDAIA) where the PDPL so provides.

The app stores your language choice on the device so the next launch does not ask again. It sends that language on API calls. Device tokens are stored so we can deliver order and assignment notifications. You can disable notifications in the operating system; operational SMS (such as OTP) may still be required to use the account. Website cookies or similar files, if used, are limited to operation, security, and language, unless a separate marketing consent is obtained.

The platform is not directed at children under 18. We do not knowingly create customer accounts for minors. If you believe we have collected a child's data, contact support so we can delete it where the law allows.

Operational messages about an order, appointment, payment, or security are part of the service. Promotional messages, if any, require a separate lawful basis and can be stopped through the means we publish, without affecting service messages required to perform the contract.

We may update this policy. The date at the top of the page is the latest publication. Continued use after an update is acknowledgement of the new text. Questions about privacy can be raised through in-app support, complaints, or the contact area on this website.