Privacy Policy
Draft, pending legal review
1. Who we are
[Legal entity name - TO BE COMPLETED] ("we", "us"), Commercial Registration No. [CR number - TO BE COMPLETED], [Registered address - TO BE COMPLETED], Kingdom of Saudi Arabia. We provide FARAH, an online service that lets a host create event invitations, send them to guests, collect RSVPs and welcome guests at the door with a QR pass.
Contact: [Privacy contact email - TO BE COMPLETED], [Registered address - TO BE COMPLETED]. No separate Data Protection Officer has been appointed at the moment; privacy requests go to the contact above.
2. Who is responsible for what
- The host is responsible for the guest information they enter (guest names, phone numbers, plus-one names, event details). We handle it only to provide FARAH to the host and on the host's instructions. If you are a guest and want your details corrected or removed, you can ask the host, or ask us and we will pass your request on and help.
- We are responsible for hosts' account and login data, for the security of the service, and for information about people who visit our website.
- We do not send WhatsApp messages ourselves. The host sends the invitation from their own WhatsApp account. WhatsApp's own privacy terms apply to that message.
3. What we collect
| Data | About | Where it comes from | Required? |
|---|---|---|---|
| Email or mobile number, password (stored only as a one-way hash) | Host | The host | Required to create an account |
| Event details, letter text, uploaded photo, uploaded background image, sub-events, venue and time | Host | The host | Required to create an event |
| Guest name, mobile number, language | Guest | The host | Required to send an invitation |
| RSVP answer (yes/no/maybe) and time | Guest | The guest | Optional |
| Plus-one names | A third person | The guest | Optional |
| Check-in time | Guest / plus-one | Door staff | Created at entry |
| Door-staff (helper) name | Helper | The host | Required to add a helper |
| Email address, page language and time, if you join the waitlist on the pricing page | Anyone who joins (usually a prospective host) | The person joining | Optional |
| Display name and preferred language (both optional). The name is shown only on your own account page; the language sets the pages and emails we send you | Host | The host | Optional |
| Email confirmation: whether and when you confirmed your address, and the single-use links we email you to confirm it, change it or reset your password (stored only as a one-way hash) | Host | Generated by us | Only if you use email |
| Counts of sign-up, waitlist and email-sending requests per connection, in a protected (hashed) form, to prevent abuse | Everyone | Automatically | Needed for security |
| One-time login code (stored hashed, expires) | Host | Generated by us | Only if you log in by mobile |
| Record of your acceptance of the Terms and Privacy Policy (document, version, time, IP address, language), kept for 6 months after you close your account to prove your consent | Host | Recorded at sign-up | Required to create an account |
| Technical data (IP address, browser, time of request), to the extent our hosting provider's servers log it. We also count login and one-time-code attempts, in a protected (hashed) form, to prevent guessing | Everyone | Automatically | Needed for security |
| Cookies: a session cookie and a notice cookie (see the Cookie Notice) | Everyone | Automatically | Session: strictly necessary |
We do not collect location tracking data, ID numbers, payment card details, health information or advertising data. If you add a plus-one, please only add someone who agrees to it.
4. Why we use it (purposes and legal bases)
| Purpose | Data | Legal basis (PDPL) |
|---|---|---|
| Create and secure the host's account | Account data, cookie | Agreement with the host |
| Show the invitation, take RSVPs, manage plus-ones, issue and scan QR passes | Guest, RSVP, plus-one and check-in data | On the host's instructions (the host is the controller); the guest's own answers are given by the guest |
| Keep the service secure and prevent abuse | IP address, logs, one-time codes, attempt counters (in a protected, hashed form) | Legitimate interest in protecting the service |
| Tell you once when paid plans open, if you joined the waitlist | Waitlist email address and page language | Your consent (you give the address for this purpose) |
| Send you the account emails you ask for: confirm your address, change it, reset your password, and tell you if someone tried to sign up with your address | Email address, confirmation status, link records, preferred language | Agreement with the host |
| Support requests | What you send us | Agreement / legitimate interest |
| Comply with law, court orders, defend claims | As needed | Legal obligation / judicial requirements |
We collect only what is needed. We do not use your data for marketing, sell it, or share it for others' advertising. If that changes we will ask for your opt-in consent first.
5. How we process it
Collected through the forms and links described above, then stored on our hosting provider's servers in [Hosting location - TO BE COMPLETED], protected in transit when the service is served over HTTPS (which we require in production), used only for the purposes above, shared only as in section 6, and deleted within the retention targets in section 7. We do not make decisions about people by automated means with legal or similar effects. The host alone decides whether a plus-one is approved; an automatic threshold is a setting the host chooses.
6. Who we share it with
| Recipient | Purpose | Location | Frequency |
|---|---|---|---|
| Our hosting provider | Hosting (and backups, if any) | [Hosting location - TO BE COMPLETED] | Regular |
| SMS provider | One-time login codes | Not in use at the moment | Not applicable |
| Email provider | Sending account emails (address confirmation, email change, password reset) | Not in use at the moment. We will name the provider and its location here before we switch email sending on | Not applicable |
| Payment provider | Paid plans | Not in use at the moment | Not applicable |
| The host and their helpers (door staff) | Running the event | Not applicable | Regular |
| Authorities and courts, professional advisers | Where required by law, or for advice | Kingdom of Saudi Arabia | Occasional |
Transfers outside the Kingdom: only as the PDPL and the SDAIA transfer regulation allow, with appropriate safeguards and a risk assessment.
Third parties reached by clicks: map links and photo links are entered by the host; opening them leaves FARAH. WhatsApp is used by the host, not by us.
7. Storage, retention and destruction
The periods below are our retention commitments and targets: we delete each kind of data no later than the period stated. Until automated deletion is in place, we do this by manual review at least monthly and on request.
| Data | Kept for | Then |
|---|---|---|
| Guest list, RSVPs, plus-ones, check-ins | We delete it no later than 90 days after the event's last sub-event, or when the host deletes it | Deleted |
| Host account | While active. When you close it, your events and guest data are deleted immediately (the uploaded invitation photo is deleted together with the event, and the old photo is deleted when you replace it). An uploaded background image follows the same rule: it is deleted together with the event, and the old one is deleted when you replace or remove it. The stub account record and the record of your acceptance of the Terms and Privacy Policy (kept to prove your consent) are deleted no later than 6 months after the account is closed | Deleted |
| One-time codes | Used codes are deleted when the login completes. We commit to deleting expired unused codes within 24 hours of expiry (by manual purge until this is automated) | Deleted |
| Security logs | Where our hosting provider keeps server logs, we keep them no longer than 90 days (longer only to investigate an incident) | Deleted |
| Login and one-time-code attempts | We keep a record of each attempt only in a protected (hashed) form for 24 hours to prevent password and code guessing, then delete it | Deleted |
| Pricing waitlist | We delete each address no later than 12 months after you join, or sooner on request. We use it only to send one message when paid plans open | Deleted |
| Email links and abuse counters | Confirmation, change and reset links work once and expire within 1 to 48 hours; we delete them 24 hours after they expire. The counters of sign-up, waitlist and email-sending requests are kept in a protected (hashed) form for 24 hours, then deleted | Deleted |
| Backups | If we keep backups, we keep them no longer than 35 days | Deleted |
| Support messages | We will keep them no longer than 24 months after the support request is closed | Deleted |
| Contract and billing records | We will keep them no longer than 10 years (tax and commercial law) | Deleted |
Security measures: hashed passwords, separation between hosts' data, unguessable invitation links, protection against common web attacks, and access limited to staff who need it. When the service is served over HTTPS, which we require in production, data is protected in transit. If a breach may harm you we will tell the Saudi Data & AI Authority within 72 hours where required, tell hosts without undue delay (we aim for 24 hours), and tell affected people where required.
8. Your rights
You may: be informed; access your data; get a copy in a readable format; correct it; ask for it to be destroyed; withdraw consent where consent was the basis; complain; and seek compensation for damage from a breach of the law. Hosts can use the tools in the app under Account: Download my data gives you a copy of your account data as CSV files, and Close my account deletes your events and guest data immediately. We keep a stub account record and the record of your acceptance of the Terms and Privacy Policy for 6 months to prove your consent, and then delete them. Guests can also remove their own details at any time with the Remove my details link on their invitation page: their name, phone number, RSVP answers, plus-one names and check-in codes are deleted immediately, their invitation link stops working, and the host keeps only an anonymous entry, “Guest removed at their request”, in the guest list. This does not reach copies the host has already exported or messages already sent. It also does not reach backups (kept for up to 35 days) or server logs that may hold your old invitation link (kept for up to 90 days), as described in section 7. Guests can also ask the host, and anyone can write to [Privacy contact email - TO BE COMPLETED]. We answer within 30 days (one extension, with reasons). It is free unless the law says otherwise. We may verify your identity. If we cannot fully comply we explain why (for example a legal retention duty).
9. Cookies
See the Cookie Notice. We set one essential session cookie and one cookie that remembers you have seen the notice, and nothing for tracking or advertising.
10. Complaints
Write to [Privacy contact email - TO BE COMPLETED]. We acknowledge within 5 days and answer within 30 days. If you are not satisfied, you may complain to the Saudi Data & AI Authority (SDAIA), Riyadh, https://sdaia.gov.sa, National Data Governance Platform https://dgp.sdaia.gov.sa.
11. Other points
FARAH is for adults. Hosts must be 18 or older. Guests who are children appear only because a parent or guardian gave the name. Language: Arabic and English are provided; Arabic prevails. Changes: this policy is reviewed at least yearly; we tell hosts before material changes take effect and list every version below.
12. Update history
| Version | Date | Summary |
|---|---|---|
| 1.7 | 2026-09-25 | Sections 3, 4, 6 and 7 updated: account emails (confirmation, change and reset links), display name and preferred language, and the email provider |
| 1.6 | 2026-09-25 | Sections 3, 4 and 7 updated: the pricing-page waitlist (email address only, deleted within 12 months) |
| 1.5 | 2026-09-19 | Data table and retention updated: uploaded background image |
| 1.4 | 2026-09-19 | Sections 3, 4 and 7 updated: login and one-time-code attempts are counted in a protected (hashed) form for 24 hours to prevent guessing |
| 1.3 | 2026-09-19 | Section 8 updated: guests can remove their own details from their invitation page; the host keeps only an anonymous placeholder |
| 1.2 | 2026-09-19 | Section 7 updated: uploaded invitation photos are deleted together with the event, or when replaced |
| 1.1 | 2026-09-19 | Rights and retention updated: account export and account closing are now available in the app |
| 1.0 | 2026-09-19 | First publication |