Privacy policy

1. Who we are

Mutrafa is an online platform for bookings and for managing centers, salons, and freelancers. It is owned and operated by Khuwarizm Technology. The entity's details (commercial registration, address, and contact channels) are shown at the top of this page, in the site footer, and on the Contact page.

2. Scope of this policy and our role

We handle personal data in two different roles:

• Controller: for data about visitors to our website, anyone who sends a trial or contact request, subscribers (center owners and their staff), and billing data. This policy applies to that data in full.
• Processor: for data about the centers' clients inside the app (name, mobile number, appointments, payments, and notes). The center is the controller of that data, and we process it on the center's behalf, under its instructions and the Data processing agreement.

If you are a client of a center that uses Mutrafa, the center is responsible for your data, and requests about your rights go to the center. Each center has its client policies in its account and a form on its page for data subject requests. If you cannot reach the center, write to us through the Contact page and we will forward your request to it.

3. Data we collect as a controller

• Request and contact data: name, business name, mobile number, business type, your message, and the request type (trial or inquiry). Name and mobile number are required to contact you; the rest is optional.
• Account and subscription data: name, email, mobile number, staff permissions, and subscription and invoice history.
• Payment data: processed through the payment gateway once it is enabled (coming soon). We do not store card numbers in Mutrafa.
• Limited technical data: to prevent abuse we store an irreversible salted hash of your IP address, not the address itself, along with your browser type, the page you sent the request from, and the campaign source (UTM) if any.
• Cookie consent record: your choice, an anonymous random identifier, the policy version, and the time of the choice (see the Cookie policy).

Chat box

Our website offers a chat box to answer your questions about Mutrafa. The conversation is kept in your browser for the session only, and we do not keep its content on our servers. We may use a trusted technical service provider, whose servers may be located outside the Kingdom, to process your messages solely to reply to them, under commitments that protect your data. Please do not share sensitive data such as passwords, card numbers, or health information.

4. Purposes of processing and legal bases

• Replying to your request and contacting you: based on your consent, given by ticking the consent box in the form, and to take pre-contract steps at your request.
• Creating the account, providing the service, support, and billing: to perform the subscription contract and to comply with the law.
• Security, abuse prevention, and service improvement: based on our legitimate interest, without prejudice to your rights.
• Measuring our ads (Meta, Snapchat, and TikTok pixels): only with your prior consent through the cookie banner, which you can withdraw at any time.
• Marketing messages about Mutrafa: only with your prior consent, with a clear way to opt out.

We do not sell your data, and we do not use it for any purpose that conflicts with the purpose for which it was collected.

5. Client data inside the app, including sensitive data

The app lets a center record notes about its client, which may include health information or skin sensitivities. This is sensitive data under the Personal Data Protection Law. Accordingly:

• The center, as controller, is responsible for obtaining the client's explicit consent and for informing her how her data is used.
• We limit access to client data to those who need it to provide the service or support, and we process it under the Data processing agreement.
• We do not use client data to market our services or to train artificial intelligence models, and we do not sell it.
• We advise centers to record only the minimum health information needed.
• Booking verification code: we send it to your email to confirm your booking, and we do not store the email with the booking. We keep an irreversible fingerprint of it for 48 hours only, to prevent abuse, and then delete it.
• Booking page statistics (depending on the center's plan): on the center's behalf we process a counter that is not linked to the visitor's identity: a temporary random visit identifier, the booking step the visitor reached, and the referring site. We do not link it to a name or mobile number, we do not store an IP address with it, and we delete it after 13 months. It is the center's data as controller, and it is mentioned in the privacy notice the center's clients see.

6. Who we share data with

Only as needed, including:

• The hosting and technical infrastructure provider to run the platform.
• The payment gateway to process payments, once it is enabled (coming soon).
• Meta, Snapchat, and TikTok: to measure ads, and only if you consent to ad measurement cookies.
• Competent government authorities upon a lawful request.

7. Transfers outside the Kingdom

Some data may be processed by providers outside the Kingdom (such as ad measurement tools, if you consent). We transfer only the minimum necessary, in line with Article 29 of the Personal Data Protection Law and the Regulation on Personal Data Transfer outside the Kingdom. We set out where sensitive client data is processed and the names of sub-processors in the Data processing agreement.

8. Retention

• Contact and trial requests that did not become a subscription: no more than 12 months, then destroyed automatically.
• Account data: for the duration of the subscription and, after it ends, for a period that allows you to export your data, then destroyed, unless the law requires keeping it.
• Invoices and accounting records: for the period required by tax and commercial laws.
• Cookie consent record: 24 months to prove consent, then deleted.

9. Data protection

We apply appropriate technical and organizational controls to protect data, including limiting permissions to what is needed and collecting only the minimum data. No system is completely secure; if an incident affects your data, we will notify the competent authorities and those affected as the law requires.

10. Your rights

Under the Personal Data Protection Law you have the right to:

1. Be informed of how your data is processed and on what basis.
2. Access your data.
3. Obtain a copy of it in a clear format.
4. Correct, complete, or update it.
5. Request destruction of data that is no longer needed.
6. Withdraw your consent at any time.

How to exercise them: through the Contact page by choosing "Inquiry", or through the published contact channels. We verify your identity and reply within 30 days, and we may extend this by another 30 days after telling you the reason in advance. These rights concern the data we hold ourselves; for data about the centers' clients, they are exercised with the center.

11. Marketing

We will not send you marketing messages without your prior consent. You can stop them at any time, easily, and we stop as soon as we receive your request.

12. Minors

Our services are aimed at businesses and their adult owners, and we do not knowingly collect data from anyone under 18.

13. Changes to this policy

We may update this policy. We publish the update date and version number above, and we notify subscribers of any material change at least one week before it takes effect.

14. Complaints

For questions or complaints, contact us through the Contact page or the published contact channels. If your complaint is not resolved, you may file it with the Saudi Data and Artificial Intelligence Authority (SDAIA) at https://dgp.sdaia.gov.sa within 90 days of the incident or of when you became aware of it.