1. Who controls your data
Haya operates the TryHaya website and platform from Riyadh, Saudi Arabia. For privacy questions or rights requests, contact care@tryhaya.com. Final legal entity and registration details must be confirmed during legal review.
2. Data we collect
Depending on the service, Haya may collect names, email addresses, phone numbers, city, identification or Iqama details, company and commercial documents, product information, banking details, account activity, quotations, orders, communications, source and campaign data, device and security logs, consent choices, and documents you choose to upload.
3. Why and how we use data
Haya uses personal data to respond to inquiries, review vendors, create and secure accounts, verify identity and eligibility, operate quotations and orders, calculate commissions, communicate service updates, prevent fraud, maintain records, measure website performance with consent, improve the platform, and comply with legal obligations. Processing is based on consent, contract steps, legal obligations, or another lawful basis available under Saudi law.
4. Sharing and processors
Data is shared only as needed with authorized Haya personnel, relevant vendors, freelancers, or clients, and service providers supporting hosting, database, authentication, email, analytics, error monitoring, security, and communications. Current core providers may include Vercel, Supabase, Google Workspace, Google Analytics when consented, and Sentry when configured. Haya does not sell personal data.
5. International processing
Some service providers may process data outside Saudi Arabia. Haya will use providers and safeguards intended to meet applicable Saudi requirements for international transfers. The final transfer assessment, processor list, and contractual safeguards remain pending owner or legal review.
6. Retention and deletion
Haya keeps data only for the purpose and period reasonably required. The working schedule is: incomplete registration records up to 90 days; vendor inquiries up to 24 months after the last meaningful contact; analytics consent and security logs up to 24 months; and account, transaction, tax, dispute, or compliance records for the period required by applicable law or a valid legal claim. Data is deleted, anonymized, or securely restricted when no longer required. This schedule is pending final legal confirmation.
7. Your rights and choices
Subject to the Saudi Personal Data Protection Law and applicable exceptions, you may request information about processing, access, correction, completion, destruction, or a copy of your personal data, and may withdraw consent where processing relies on consent. You may also choose necessary-only cookies. Haya may verify identity before completing a request.
8. Security, children, and updates
Haya uses access controls, encryption provided by its cloud services, audit practices, and restricted administrative access. No system is completely risk-free. Haya is intended for adults aged 18 or older and does not knowingly provide accounts to children. Material policy changes will be posted here and, where appropriate, communicated to affected users.