Draft — under legal review. This text is preliminary and must be approved by a legal professional before launch.
This English version is a translation provided for convenience. If it differs from the Arabic version, the Arabic version prevails.
Maseh respects your privacy and is committed to protecting your personal data in accordance with the Personal Data Protection Law (PDPL) of the Kingdom of Saudi Arabia. This policy explains what data we collect, how we use it, and your rights regarding it.
1. Data we collect
We collect only the data needed to run the service:
- Account data: name, email address, mobile number.
- Inspector data: license number and license photo, service areas, categories, geographic location, years of experience (for inspectors).
- Request data: inspection request details, address, notes, budget, photos and reports.
- Chats: chat messages and the photos attached to them, between the two parties to a transaction.
- Ratings: the ratings and comments you write or receive.
- Usage and security data: your push notification token (push token), the IP addresses of sign-in attempts (for security purposes), and basic security logs.
2. Legal basis for processing
We process your data on the basis of:
- Performance of a contract: to provide the service of connecting clients with inspectors and to complete transactions. This includes essential (operational) service notifications — such as an offer arriving, an offer being accepted, an appointment approaching, a cancellation, an extension, or ratings becoming visible. These are necessary for the service to work, always reach you, and do not stop if you withdraw consent.
- Your consent: for marketing notifications only (offers, updates and re-engagement). These are optional and off by default, and you can turn them on or withdraw consent at any time in Settings, completely independently of essential service notifications.
- Legal obligation and legitimate interest: to secure the platform, prevent fraud, and keep compliance records and ratings.
3. How we use your data
| Purpose | Data used |
|---|---|
| Creating your account and signing in | Name, email, mobile number |
| Matching requests with inspectors | Service areas, categories, location |
| Communication between the parties | Name, mobile number, chats |
| Essential service notifications (operational — always) | Push notification token |
| Marketing notifications (only with your consent — optional) | Push notification token |
| Mutual ratings and reputation | Ratings and comments |
| Security and abuse prevention | IP addresses, security logs |
4. Data sharing and transfers outside the Kingdom
- Your data is shown only to the other party in a transaction (the client and the inspector involved in the request). Ratings shown on a public profile are anonymous — the name of the person who wrote them is not shown.
- Sub-processors outside the Kingdom: we use service providers through which your data is processed and whose servers may be located outside the Kingdom: Supabase (hosting, database and storage), Resend (email), Expo (notifications), Mapbox (maps), and Cloudflare Turnstile (preventing bots and fraud at sign-in and sign-up). These transfers are subject to the regulatory controls of the Saudi Data & AI Authority (SDAIA).
- We do not sell your personal data to any third party.
5. Your rights and how to exercise them
Under the Personal Data Protection Law, you have the following rights. We carry out your request within 30 days at most, and we record every request and its outcome:
- Access and a copy (portability): “Settings → My data & privacy → Export my data” — we create a JSON file containing your data.
- Correction: “Settings → My data & privacy → Correct my data”, or edit your profile details directly.
- Withdrawing consent (marketing notifications): “Settings → My data & privacy → Marketing notifications” — stop marketing notifications immediately. This does not affect essential service notifications, which continue on the basis of performance of a contract.
- Deletion: “Settings → Delete account” — permanent deletion of your account and your data.
6. Data retention periods
We keep data only for as long as its purpose requires:
| Data | Retention period |
|---|---|
| Account and profile data | While the account is active; permanently deleted when the account is deleted |
| Chats and their photos | 90 days after the request is closed, then deleted automatically (extended if the request is the subject of a dispute under review, by up to 30 additional days) |
| In-app notifications | Up to 3 days |
| IP addresses of sign-in attempts | Deleted within a short window (periodic cleanup) |
| Security logs | Up to 18 months |
| Ratings and comments | While the account is active, as a reputation record; shown publicly without the author’s identity, while the full link (who rated whom) is kept internally on the basis of fraud prevention and legitimate interest. Permanently deleted when the account is deleted, both the ratings you wrote and the ratings written about you |
| Consent and rights-request records | Kept as evidence of regulatory compliance, even after the account is deleted |
7. Data security
We use encryption and strict access controls (row-level security policies) to protect your data. Sign-in sessions are stored in your device’s secure storage, and we keep a security log of sensitive events so we can detect and deal with any breach.
8. Contact us
For any question about your privacy, or to exercise your rights, contact us through the Support & help section in the app.