Policies & terms

Privacy Policy

At Nashati, we are committed to protecting your privacy and your children's data in line with the Saudi Personal Data Protection Law (PDPL) and its Implementing Regulations. This policy explains what we collect, how we use it, our legal basis, and your rights as a data subject.

Who We Are (Data Controller)

Nashati is a Saudi platform that connects parents with children's activities. We act as the "Data Controller" under the PDPL. Bookings and payments happen directly between you and the activity provider. Nashati is not a party to any payment.

Who Creates an Account

Accounts may be created only by adult parents or legal guardians. Children may not register themselves. By creating an account, you confirm that you are the child's parent or legal guardian and you consent, on the child's behalf, to processing their data under this policy.

Data We Collect

• Parent data: name, mobile number, email, city.
• Child data: age or age group, gender (optional), interests and preferred activities. We do not request a child's full name or photo unless necessary and with your explicit consent.
• Usage data: saved and preferred activities, in-platform browsing history.
• Technical data: device type and security logs (for protection and fraud prevention only).

Legal Basis for Processing

We process your data based on: your explicit consent, performance of the requested service, compliance with our legal obligations, and our legitimate interest in securing and improving the platform without overriding your rights.

Children's Data

We treat children's data with special care. We do not process any child's data without their parent or guardian's consent. A guardian may withdraw consent at any time, or request access, correction, or deletion of their child's data.

Where Data Is Stored

Your data is stored inside Saudi Arabia in the Firebase regional zone (me-central2, Dammam), in line with the data localization principle. The infrastructure provider (Google) acts as a "Processor" under a data processing agreement with the required safeguards. We do not transfer your data outside the Kingdom except where permitted by law and with the required safeguards.

Retention

We retain your data while your account is active. On account deletion, we erase your personal data within no more than 30 days, except where we are legally required to retain it (such as financial or security records) and only for the period prescribed by law.

Data Sharing

We do not sell your data. We share only the minimum necessary with: the activity provider you choose (to complete a booking), trusted technical service providers under processing agreements, and competent government authorities upon lawful request.

Your Rights

• To know how your data is processed.
• To access your data and obtain a copy.
• To request correction or update of your data.
• To request deletion of your data or full account.
• To withdraw your consent at any time.
• To file a complaint with the Saudi Data and AI Authority (SDAIA).

To exercise any right, contact legal@nashati.sa. We respond within the period prescribed by law.

Data Protection and Breach Notification

We apply technical and organizational measures to protect your data. In the event of a breach that may harm you, we notify the competent authority (SDAIA) within 72 hours and inform you without undue delay where the law requires.

Changes

We may update this policy and will post the last-updated date and version number at the top of the page. We notify you in advance of material changes.