Privacy policy

Nashati (nashati.ai) is a Saudi platform that helps families find and book kids’ activities, and gives activity providers a system to run their programs called “Nashati for Business”. This policy explains what we keep about you and your kids, why, who we share it with, and how you control it.

For any question or request about your data, write to us from the Contact us page. We reply within 30 days at most.

This policy covers the family site and family accounts. What a provider keeps in its own system about the families it serves is the provider’s responsibility; we run the system for them.

What we collect

We only keep what you add yourself, and we never buy data from other sources.

• Account details: your name, mobile number, email, and how you’d like to be addressed if you chose it. Collected when you create or edit your account. A provider you send a request to gets only your name and mobile number.
• Kids’ profiles: name, gender, birth month and year, and interests. Collected when you add a kid to your account or while booking. A provider you book or enroll with gets only the kid’s name and age.
• Family homes: the home’s name, its spot on the map, and the days the kids are there, if you add them on the family page. Only the people you invite to share your family plan see them; no provider does.
• People sharing your family plan: their name and role (co-parent or caretaker) once they accept your invite. Seen by your family only; a caretaker sees the schedule only.
• Bookings and enrollment requests: with any notes you write, which may include health notes such as allergies. Seen by the provider concerned.
• Transfer receipts: the receipt image you upload from My bookings when paying a provider. Seen by that provider only.
• Reviews: your rating, text and photos, written after an activity your kid took part in. Public, with your first name only; photos appear after our team checks them.
• Saved activities and providers you follow: seen by no one but you.
• Your messages and reports to the Nashati team: seen by the Nashati team only.
• Your approximate location: only when you ask to sort activities near you. We round it to about a kilometre, keep it in your browser for 30 minutes, and never store it on our side.
• Technical logs: IP address, browser type and errors, recorded automatically and seen by our technical team for security and fixing faults.

We use no third-party analytics or advertising tools, and we never sell your data.

Kids’ data and guardian consent

Accounts belong to parents, not kids, and we keep no data about a kid before their guardian agrees. When you add your first kid, in your account, while booking a trial or sending an enrollment request, we ask you to confirm:

“I am this child’s guardian or authorized by them, and I agree that Nashati keeps the child’s details and shares only what is needed with the provider I book or enroll with, as the privacy policy explains.”

• We record the date and the version of the text you agreed to. If the text or this policy changes materially, we ask again when you add your next kid.
• We keep only the month and year of birth, to work out the age and suggest suitable activities.
• We never ask for photos of kids in their profiles. Photos you attach to a review are checked by our team before they appear, and we don’t publish a photo showing a recognizable child’s face.
• A provider you book with sees only the kid’s name and age and the notes you write on the booking, never their interests or your family homes.
• You can edit or delete any kid’s profile at any time from your account.

Why we use data

We use your data to run the service you asked for, never for targeted advertising:

• Creating your account and signing in with your mobile number or email, to provide the service.
• Suggesting activities that fit your kid’s age and interests from kids’ profiles, with guardian consent.
• Working out driving time from your home or approximate location, with your consent when you ask for it.
• Sending a booking or enrollment request to the provider: your name and mobile, the kid’s name and age, and your notes, to provide the service.
• Service messages by email or mobile, such as request received, offers, acceptance, decline and password reset.
• Sharing your family plan and calendar with the people you invite.
• Publishing reviews to help other families, with your consent when you publish.
• Answering questions and following up reports, including child protection.
• Security and abuse prevention from technical logs and the team’s action log, a legitimate interest.

We send marketing messages (new activities and offers from Nashati, and news from businesses you signed up with) only if you agree to them, when you sign up or from your account page. Every one carries a one-click link to stop them, and you can turn them off from your account any time.

Who we share data with

We share your data with two kinds of parties only: the provider you choose to book with, and the technical service providers that run the site for us.

Activity providers. When you book or ask to enroll, the provider receives your name and mobile, the kid’s name and age, your notes, and the transfer receipt if you upload one. The provider keeps these in its records to serve you and becomes responsible for them. It never sees your email, your family homes, or your other kids.

Technical service providers. They process data on our instructions and never for their own purposes:

• Google Firebase: hosting, database, photo storage, sign-in and verification codes. Receives all account data.
• Google Maps Platform: maps and driving times. Receives the rounded starting point and the activity’s location, with no name or account.
• Resend: sending email. Receives your email, name and the message text.
• Sentry: error monitoring. Receives error details and browser type.
• Unifonic: text messages once we turn them on. Receives the mobile number and the message text.

Some of these providers process data on servers outside Saudi Arabia, including Firebase sign-in, email delivery, Google Maps and error monitoring.

Authorities. We disclose data to a government body when it requests it under the law, or when it is needed to protect a child from harm.

Where data is kept and for how long

The database and photos are kept on Google Cloud servers through Firebase, and Firebase keeps sign-in details (mobile or email) on Google servers outside Saudi Arabia.

We keep your data while your account exists. What remains after deletion has a set period:

• Account, kids’ profiles, homes, saved items and reviews: until you delete your account; deleted immediately when you do.
• Bookings and enrollment requests held by a provider: stay with the provider, no longer linked to your account; the provider deletes them on your request.
• Your messages and reports to the Nashati team: 3 years, without your name, mobile or email after you delete your account, because some are safety reports.
• The Nashati team’s action log: 3 years, carrying only the account number with no contact details.
• The log of messages sent (email, date and result): 90 days, to know whether a message arrived.
• Server technical logs: 30 days.
• Backups: deleted data leaves them when each backup expires.

Your rights

You exercise most of your rights yourself, without waiting, from the “Privacy and your data” section of your account.

• Access and a copy: “Download my data” gives you one JSON file with your account, kids, family, saved items, bookings, enrollment requests, reviews and your messages to our team.
• Correction: edit your name, kids’ profiles and homes from your account and the family page.
• Deletion: “Delete my account” deletes it immediately once you type the confirmation word. If you last signed in more than 15 minutes ago we ask you to sign in again, for your protection.
• Withdrawing consent: delete a kid’s profile, a home or a review whenever you like, or delete the whole account.
• Complaints: write to us first; you also have the right to complain to the Saudi Data and AI Authority (SDAIA).

When you delete your account we immediately delete your name, mobile, email and sign-in, your kids’ profiles, family homes, invites and calendar link, saved items and follows, and your reviews and their photos, recounting the activity’s rating. What stays, no longer linked to your account: providers’ records of bookings and seats (deleting doesn’t cancel an enrollment), your messages and reports to the Nashati team without contact details, and one line in the action log saying the account was deleted.

An account that runs a provider on Nashati for Business, or belongs to the Nashati team, can’t be deleted from the button because the provider’s data is tied to it. Its owner writes to us and we delete it within 30 days once the provider is sorted out.

Security

Your browser never reaches the database directly; every read and write goes through our servers after we check who you are.

• The connection is always encrypted, and your session lives in a cookie that pages can’t read.
• The Nashati team opens families’ data only when needed, such as following up a report or a support request, and its actions are logged under each person’s name.
• We strip location and camera details from review photos before saving them.
• Deleting an account asks for a recent sign-in, so someone using your device can’t delete it without you knowing.

If a breach affects your data we tell you and the competent authority within the period the law sets. To report a security issue, write to us from the Contact us page.

Cookies and browser storage

Everything we put in your browser is needed for the site to work or to remember your choices. We use no tracking or advertising cookies. Details are on the Cookies page.

Changes to this policy

If we change something material, such as a new kind of data or a new service provider, we tell you by email or on the site 30 days before it takes effect, and we ask for guardian consent again if what you agreed to changes.