Privacy Policy

Mobile number: collected at registration, used for OTP verification, and shared with the service provider after their offer is accepted for direct contact.

Full name: collected at account creation and displayed within the platform interface.

Provider data: company name, city, email, commercial registration (PDF), company profile (PDF), and FAL license (PDF) if provided.

Property and request data: building details, type, address, and service requests posted by property owners.

Submitted offers: PDF files uploaded by service providers.

Technical data: session data stored locally in the browser (localStorage) to manage login and logout.

Arrival source tag: the first time you arrive via a link carrying a source tag (utm_source), we save its value and the time of arrival in your browser (localStorage), together with the medium (utm_medium) and the campaign (utm_campaign) if present. We save nothing else from the link, and later tags do not overwrite it.

Sign-up source on your account: these values are sent with the phone verification step when you create an account (not when you log in), and are stored once as your account's sign-up source; they are never overwritten.

Question card answer: your optional answer to a one-question card in the dashboard about how you heard of Emaraa.

Processing of your data is based on the following legal grounds under the Saudi Personal Data Protection Law (PDPL):

• Contract performance: to operate the platform and deliver the requested services.

• Legal obligation: to comply with Saudi regulatory requirements when applicable.

• Explicit consent: for any use beyond core platform operation, other than understanding where sign-ups come from, which rests on legitimate interest.

• WhatsApp chats with the AI assistant: answering the enquiry you started rests on providing the service you asked for; keeping your email for Emaraa news rests on your explicit consent only.

• Legitimate interest: to learn where sign-ups come from (link tags and your optional answer to the one-question card) and to improve our marketing, following a documented assessment that weighs our interest against your rights. You may object at any time at info@emaraa.app.

To operate the platform and enable communication between owners and service providers.

To send OTP verification codes via SMS to confirm user identity at registration and login.

To allow administration to review service provider registration requests and verify their documents.

To improve user experience and develop platform features based on usage patterns.

Understanding which channels bring users to us (sign-up source) to improve our marketing.

Measuring how our advertising campaigns perform, using Google tools and only with your consent, based on aggregated browsing data that does not include your name or phone number (see the Cookies section for details).

We do not sell your personal data, and we do not share it with third parties for their own marketing purposes.

We do not sell or rent your personal data to any third party for commercial or marketing purposes.

We do not send the stored sign-up source values to Google or to any advertising platform, and we do not share them with third parties for their own marketing purposes. They are stored with your account data at our hosting provider, Supabase, acting as our data processor.

Your mobile number is sent to the SMS provider (Authentica) solely to deliver the OTP code and is not used for any other purpose.

Messages from WhatsApp chats with the AI assistant are processed by a third-party AI model provider, as described in the WhatsApp AI Assistant (Wedd) section.

Data may be shared with Saudi regulatory or judicial authorities when there is a clear legal obligation.

Property owner data is visible only to approved service providers within the context of the relevant request and associated proposals, and does not include the owner's phone number.

The owner's phone number is not shown to any service provider before their offer is accepted. Once the owner accepts a provider's offer, phone numbers are exchanged between both parties (the owner and the accepted provider) for direct contact and to complete the contract.

A provider whose offer was not accepted (whether still under review or rejected) never receives the owner's phone number, under any circumstances.

Provider proposals are visible only to the relevant property owners.

Platform data is stored in Supabase databases on cloud servers in the Seoul, South Korea region (ap-northeast-2), and travels between your device and those servers over an encrypted connection.

PDF files are stored in Supabase Storage and accessed via temporary signed URLs (1-hour validity).

OTP codes are temporary and expire within 5 minutes.

Login sessions expire automatically after 30 days.

We retain your data for as long as your account is active; upon a deletion request, personal data is removed within a reasonable period in accordance with PDPL. Retention of WhatsApp chat data is described in the WhatsApp AI Assistant (Wedd) section.

The sign-up source is kept with your account for as long as your account is active, and is deleted with it when you request account deletion by email at info@emaraa.app, within a reasonable period in accordance with PDPL. The copy in your browser stays there until you clear this site's data.

Verification codes are delivered via Authentica (portal.authentica.sa), a licensed Saudi-native SMS provider.

Your mobile number is sent to Authentica solely for the purpose of delivering the code and is not used for any marketing or commercial purpose.

Creating an account constitutes consent to receiving a one-time SMS verification code (OTP).

Messages to Emaraa's WhatsApp number are answered by an AI assistant named "Wedd" (ود). Wedd introduces herself as an AI assistant at the start of the chat, her replies carry her signature, and a member of the Emaraa team can take over the conversation with you.

The data we keep from WhatsApp chats:

• Your WhatsApp number.

• The name you give us.

• Whether you are a property owner or a facility-management company.

• Your city, if you mention it.

• A short summary of your request or interest.

• The text of the chat messages.

We keep your email address only if you explicitly agree to this. We use it only to send you Emaraa news, and you can ask us to delete it at any time.

Your messages are processed by a third-party AI model provider for two purposes: generating replies, and preparing a short daily summary for the Emaraa team. This processing may take place on servers outside the Kingdom of Saudi Arabia.

The AI model provider handles these messages according to its own data retention policies.

The data from these chats is kept on a system we run on a device we own and manage, and it is not linked to the platform's account database.

We delete records after 24 months without any activity.

To ask us to delete your WhatsApp chat data from our systems, message us on WhatsApp itself or write to: info@emaraa.app

The platform uses essential cookies to maintain sessions and provide a smooth user experience. These are required to run the platform and do not need your consent.

The platform also uses Google tools (Google Ads and Google Analytics, via Google Tag Manager) to measure how our advertising campaigns perform and how visitors reach us. These tools may set analytics and advertising cookies, including remarketing cookies.

These tools store no cookies or identifiers until you give explicit consent through the banner shown on your first visit. If you choose "Essential only", no analytics or advertising cookies are stored. These tools may load with the page before you consent without storing anything in your browser, and Google may receive basic signals not tied to cookies, such as the page address, before consent.

When you arrive via a link carrying a source tag, Emaraa saves that tag in your browser (localStorage) regardless of your choice on the consent banner. This is storage by Emaraa itself, not by a third party, and the saved value is not sent to any advertising platform. You can delete it at any time by clearing this site's data.

We do not sell your personal data, and we never share your name or phone number with any advertiser.

You can change your choice at any time by clearing this site's data in your browser. You can also configure your browser to reject cookies, though doing so may affect some platform functionality.

In the event of any data security incident, EMARAA is committed to notifying the relevant regulatory authorities and affected users as required by applicable law.

We take immediate action to contain the impact of any breach and address discovered vulnerabilities.

Under the Saudi Personal Data Protection Law (PDPL) you have the right to:

• Access your personal data stored with us.

• Request correction of any inaccurate data.

• Request deletion of your account and personal data.

• Object to the processing of your data in cases where processing is not based on a legal obligation.

• Request restriction of your data processing in legally specified cases.

To exercise any of these rights, contact us via the email address below, or on WhatsApp if your request is about WhatsApp chats.

We may update this policy periodically to keep pace with regulatory or technical changes.

Any material changes will be announced on the platform or via the registered email address.

Continued use of the platform after an update constitutes acceptance of the updated policy.

Any privacy-related inquiries or requests should be sent to: info@emaraa.app

Last updated: October 2026.