Privacy Policy
This explains what data we collect from organizers and guests, why we use it, who we share it with, how long we keep it, and your rights under the Personal Data Protection Law of the Kingdom of Saudi Arabia.
Operating entity
- Legal name
- [to be added once approved]
- Commercial registration
- [to be added once approved]
- VAT number
- Not VAT-registered: no VAT is charged and receipts (not tax invoices) are issued.
- Address
- [to be added once approved]
Company details are being completed. The operating entity has not yet given us its commercial registration number, VAT number or official address. Every field in square brackets below is deliberately empty until it is approved; we do not put estimated numbers.
Who is responsible for your data?
The operating entity is responsible for your account and order data; its details appear at the top of the page (with marked empty fields until approved). For the guests an organizer adds, we process their data on the organizer’s behalf for the invitation, and the organizer remains responsible for the lawfulness of adding them.
Data we collect
- Your account
- Mobile number (encrypted), the name you enter, language, default invitation line, and an email if you add one for invoices.
- Sessions and security
- Network address and device label of each session, and an audit trail of sensitive actions (with hashed addresses, not the plain address).
- The event
- Title, date, venue, map location, invitation text and the names of the people the event is for.
- Guests
- Name, number, group and an optional note, plus invitation status, reply, number of companions and door attendance. Gender (woman/man) is optional, never inferred from a name, and never shown to scanners.
- Inviters and scanners
- Mobile number (encrypted), the inviter’s allowance, the scanner’s section and a record of what they added.
- Payments and invoices
- Orders, amounts, wallet and invoices. We never receive a card number; we keep only the card type and last four digits if the payment provider returns them.
- Recipient numbers, message status and identifiers. We keep incoming message text no longer than the period below.
- Support
- What you write to us and our replies.
- Technical data
- Operational logs without full mobile numbers, codes or message text.
Why we use it
- To provide the service: creating and sending invitations, receiving replies, issuing and checking entry codes.
- To verify who you are, prevent abuse and protect the platform and sending quality.
- To take payment, invoice, refund and meet financial and tax obligations.
- To support you and handle complaints and reports.
- We do not sell data, do not use it for advertising, and use guests’ numbers only to invite them to the event they were added to.
How long we keep it
These are the default periods currently in force. They may change once the operating entity approves them, and any material change is announced with a new version of this policy:
- Rendered invitation media
- 90 days after the event.
- Guests’ personal data
- Anonymised 180 days after the event.
- Incoming message text
- 30 days.
- Door check-in records
- The event, plus 90 days.
- Login codes
- 24 hours.
- Sessions
- Until they expire, plus 30 days.
- Support requests
- Until resolved, plus 12 months.
- Financial records, invoices and consent records
- The period the law requires, at least six years.
- Your account after a deletion request
- Deleted or anonymised within 30 days, except what must be kept by law.
Your rights
Under the Personal Data Protection Law you may:
- Be informed of the data we process and why.
- Ask to access your data and obtain a copy.
- Ask for it to be corrected or completed.
- Ask for it to be destroyed or your account deleted, subject to what we must keep.
- Withdraw your consent where processing is based on it.
- As a guest: stop messages by replying “stop”, which adds your number immediately to the platform-wide do-not-message list; you may also contact us to have your data removed from an event.
- Complain to the competent data protection authority in the Kingdom (the Saudi Data and AI Authority).
How we protect it
- Mobile numbers are encrypted in the database and connections are encrypted.
- Data is isolated: an inviter cannot reach another inviter’s guests, and a scanner sees no more than a guest’s name and last four digits.
- Entry codes are signed and carry neither a name nor a number.
- Staff access is controlled: revealing a full number needs a reason and is logged.
- A procedure to handle breaches and notify the authorities and those affected within the legal periods.
Children
The platform is for adults. We do not knowingly collect account data from minors.
Changes and contact
When a new version of this policy is published we ask you to accept it again. For privacy requests contact us through the support page and write “privacy request”.
How this document relates to your account
When you sign up we ask you to accept the Terms, the Privacy Policy and the Acceptable Use Policy in their current versions. If a new version is published we ask you to accept it again before you continue.