Privacy Policy

1. Who we are

This policy explains how the Request (مطلب) platform, operated by [operator's legal name] (Unified National Number [ ], National Address [ ]), collects, uses and protects personal data, in accordance with the Personal Data Protection Law of the Kingdom of Saudi Arabia and its regulations.

To ask about your data or exercise your rights: "Contact support" on the Platform, or the email support@requestsouq.com.

2. Data we collect

• Account data: your email address (required to create an account and sign in), your name (required to place orders), your username, and your photo, bio and mobile number if you add them (optional).
• Provider and consultant data: their professional profile, services and portfolio, the certificates they upload to appear on their profile, the verification documents they choose when applying for the badge (a freelance document, a commercial registration or a professional certificate), and licence details for licensed professions. We ask for a picture of a national ID or iqama only once, before the first withdrawal (see "The identity picture before the first withdrawal"); verification documents and the ID picture are never published, are seen only by the team concerned, and are given to no one except on a lawful request.
• Payout data: the account holder's name, the IBAN and the IBAN certificate if uploaded; needed only to transfer earnings, shown masked, and seen in full only by the withdrawals team.
• Activity data: services, orders, bookings, offers, reviews and reports, and the chats and their attachments on the Platform.
• Technical data: browser type and last-seen time, and the IP address in security and sign-in logs, for security and to improve the service.
• How you arrived: how your browser first reached the Platform (a campaign link, a referring site or app, a search engine, or directly), and the first page you opened and when. It is kept in your browser for 90 days and, if you create an account, with your account.
• Invite link: if you open a provider's invite link, its code is kept in your browser for 30 days, and if you create a new account in that time, your account is linked to that provider.
• Searches without results: only the search phrase and how many times it was searched, not linked to you or your account, and not kept if it is a long number, contact details or a link.

We do not collect card details; they are processed directly by the licensed payment provider. Required data is needed to provide the service; leaving out optional data only means losing what it is for, such as the photo on your profile.

3. Why we use it, and on what basis

• To perform our agreement with you (the terms of use and the order): creating your account and signing you in, running orders, bookings and chats, holding, releasing and refunding amounts, transferring earnings, sending notifications about your account and orders, and applying the fee discount to your orders from the provider who invited you for the invite period (currently 12 months).
• Legal obligation: keeping contract and financial records, and answering requests from competent authorities.
• Legitimate interest: preventing fraud and protecting users, the automatic message scan, deciding disputes, and learning which channels bring users and what people search for and do not find, in aggregate counts, to improve the Platform. We never rely on legitimate interest to process sensitive data.
• Your consent: any marketing messages, and any other use we ask your explicit consent for; you can withdraw it at any time as easily as you gave it.

4. Automatic message scanning

Messages and text fields are scanned automatically to hide phone numbers, email addresses, contact links and bank accounts. The automatic scan only hides the offending text; restricting an account is a decision the moderation team takes after review. The Platform team views chats only in case of a dispute, a report, or a request from a competent authority.

5. The identity picture before the first withdrawal

Before their first withdrawal, a provider or consultant uploads a picture of their national ID or iqama and its last four digits so that their name can be matched with the bank account holder (the basis is performing the agreement and the legal duty to verify the identity of the person money is transferred to). The picture is kept in a private store that only the withdrawals reviewer can access, and is permanently deleted once the verification is approved; only the verification record stays: the last four digits, who approved and when. We do not ask for the full ID number and we do not keep the picture after verification.

6. AI and voice

When the Platform enables the "agreement summary" and "post by voice" features (both are off until enabled): the text of an order chat as its parties see it, or the voice clip, is sent to a language-processing provider working on our behalf solely to produce a draft agreement or the request text, and the result comes back to you to review before use. We do not store the voice clip anywhere, we keep no processing output except what you choose to publish, and your data is not used to train any model. The resulting text goes through the automatic contact-details scan like any text on the Platform. The basis of this processing is your explicit request for the feature each time.

7. Exchange rates

The currency switcher shows approximate rates from a public rates source that our server reads without sending any personal data about you, and your currency choice is kept in your browser only.

8. Who sees your data

• The other party to an order: only what is needed to fulfil it (name, public profile and the chat).
• The provider who owns an invite link: if you created your account from their link, they are notified that a new client signed up from it and see how many signed up from it; this does not include your name or email.
• Public authorities, when there is a lawful request.

And the technical service providers that process data on our behalf, committed to protecting it:

• Supabase: database, sign-in and file storage (Germany).
• Vercel: running the website (Germany).
• Resend: sending emails (Ireland).
• Tap Payments: payments and refunds; a payment provider licensed by the Saudi Central Bank.
• Cloudflare: domain management, and the check that you are not a bot at sign-in when it is turned on.
• Google: if you choose to sign in with your Google account.

We do not sell your personal data to anyone.

9. Where your data is kept, and transfers outside the Kingdom

Platform data is stored and processed with the providers above outside the Kingdom (Germany, and Ireland for email) to perform our agreement with you and provide the service. We handle this transfer in accordance with the Personal Data Protection Law and the Regulation on Personal Data Transfer outside the Kingdom, limit it to what is needed to provide the service, and protect it with encryption in transit and access controls. If where we host changes, we will update this section.

10. Retention

• Account and profile data: for the life of the account.
• The identity picture: until the verification is approved, then deleted; the verification record (last four digits and date) with the bank account data.
• Voice clips for "post by voice": not stored.
• When you delete your account: your name and email are replaced with "Deleted account", and your photo, bio, portfolio, certificates, verification documents, payout data, notifications and preferences are deleted, as are the first-visit source stored with your account and its invite link.
• Order records, chats and their attachments, and financial records: kept after the account is deleted without your name, because they are the record of the agreement with the other party and the evidence, for as long as the law requires, and contract records for at least three years from the contract date.
• The financial ledger, the audit log and the acceptance log are append-only and are never edited.
• The first-visit source is kept in your browser for 90 days, and an invite link's code for 30 days.
• Searches without results: deleted 180 days after they were last searched.

11. Your rights

• To know how your data is processed, which this policy explains.
• To access your data and get a copy of it in a clear format.
• To correct or update your data.
• To ask for your data to be destroyed once it is no longer needed and no legal duty to keep it exists.
• To withdraw your consent at any time.
• To delete your account yourself from its settings.

Send your request through "Contact support" or to support@requestsouq.com. We answer within 30 days, which may be extended by another 30 days with the reason told to you in advance, and we may check that the request comes from the account holder before acting on it. You may complain to the Saudi Data and AI Authority (SDAIA) if you believe your data is processed in breach of the law.

12. Security

We enforce access controls at the database level, keep sensitive documents in private storage with temporary links, and record administrative actions in an audit log. If a data breach that may harm you happens, we notify the competent authorities within 72 hours of learning of it, and tell you without delay what happened and what you can do to protect yourself.

13. Marketing messages

We send marketing messages by email or phone only with your prior consent, and you can stop them at any time. Account and order notifications are not marketing, and you can choose your email notifications in your settings.

14. People under the age of majority

The Platform is for people who have reached the age of majority (eighteen Hijri years). We do not knowingly collect data from anyone younger, and we suspend any account we learn belongs to a minor.

15. Cookies

We use only what is needed to run the Platform and remember your preferences, and internal measurement with no third parties, as detailed in the cookie policy.

16. Changes to this policy

Any changes are published as a new version with its effective date, you will be asked to read it and accept it where needed, and earlier versions stay in the Platform's records.