Nefaya · Visible Twin Co.
Privacy Policy
Version 1.4. This version is effective on the effective date displayed at the start of this Policy and replaces version 1.3 of 6 October 2026. Orders concluded before the effective date remain governed by the terms that applied to them (Terms and Conditions, clause 26).
1. Introduction and Scope
1.1This Privacy Policy explains how Visible Twin Co. ("the Company", "we", "us", or "our") collects, uses, shares, and protects personal data when you use the Nefaya application, website, and related services (the "Platform").
1.2It applies to Customers, Providers, their personnel, and visitors to the Platform. It should be read together with our Terms and Conditions.
1.3We process personal data in accordance with the Personal Data Protection Law of the Kingdom of Saudi Arabia (the "PDPL") and its implementing regulations, which are overseen by the Saudi Data and Artificial Intelligence Authority (SDAIA), and with other data-protection laws applicable where we operate.
2. Who We Are (Controller)
2.1Visible Twin Co., of 15b, Ash Shulah Dist.1, Dammam, Saudi Arabia, is the controller responsible for your personal data, except where we act as a processor on behalf of a Provider or other business User.
2.2For privacy queries or to exercise your rights, contact our data protection officer: Mostafa Kamel, mkamel@nefaya.com, 15b, Ash Shulah Dist.1, Dammam, Saudi Arabia.
3. Personal Data We Collect
3.1Depending on how you use the Platform, we may collect the following categories of personal data:
(a) Identity and account data: name, username, date of birth or age confirmation, and profile details; for Providers, business name, commercial registration and licence numbers, and authorised-representative details; and, for Customers ordering as a business, the business's legal name, VAT registration number and national address;
(b) Contact data — email address, telephone number, and billing and service addresses;
(c) Booking and transaction data — Orders, Containers, locations, Hire Periods, history, and communications relating to Orders. For a Managed Order, this includes the phone number a Provider, business partner, or administrator supplies to invite a Customer, and the fact and time of the Customer's claim of that Order;
(d) Payment data — payment-method details processed by our payment service provider (we do not store full card numbers), billing records, and Provider payout details;
(e) Location data — precise and/or approximate geolocation from your device (where you grant permission) and the service addresses you provide, used for delivery, collection, routing, and job tracking;
(f) Device and technical data — IP address, device identifiers, operating system, app version, and log, diagnostic, cookie, and similar data;
(g) Usage data — information about how you interact with the Platform;
(h) Communications and content — in-app messages, ratings, reviews, photographs (for example of waste, sites, or Containers), and support correspondence;
(i) Verification and compliance data — KYC, licence, and insurance documents provided by Providers, and fraud-prevention signals; and
(j) Marketing preferences.
4. How We Collect Personal Data
4.1We collect personal data: (a) directly from you, when you register, place or accept Orders, communicate with us, or submit Content; (b) automatically, through your use of the Platform and your device; and (c) from third parties, such as payment service providers, identity- and licence-verification providers, analytics providers, and, for a Provider's personnel, from the Provider.
5. How and Why We Use Personal Data, and Legal Basis
5.1We use personal data for the purposes below. Under the PDPL, processing needs your consent unless an exception in Article 6 applies. The basis for each purpose is:
(a) creating and managing your account; (b) taking, performing and communicating about Orders, including Managed Order invitations and WhatsApp service messages you have asked for; (c) payments, invoices, refunds and Provider settlement; (d) delivery, collection, routing and job tracking; (f) support, complaints and disputes: processing to perform an agreement to which you are a party, or required by another law (PDPL Art. 6(2));
(e) verifying Providers and their licences, recording the insurance Providers declare, and preventing fraud; (g) securing, maintaining and improving the Platform, including analytics that do not need consent under clause 9: our legitimate interests (PDPL Art. 6(4)), which we do not rely on for sensitive data or where they would override your rights and interests; where a law requires the processing (for example licence checks), Art. 6(2);
(h) legal, tax, environmental and regulatory obligations: required by another law (PDPL Art. 6(2));
(i) marketing communications: your consent, which you can withdraw at any time. We never make consent to marketing a condition of using the Platform.
Device location for (d) is collected only with your device permission (clause 6), and analytics Cookies only with your consent (clause 9.5).
6. Location and Map Data
6.1With your permission, we collect device location to show nearby Providers, enable accurate delivery and collection, route Providers, and, for Providers and drivers, track jobs in progress.
6.2You can control location permissions through your device settings. Disabling location may limit the functionality of the Platform.
6.3A Provider's or driver's location may be shared with the relevant Customer to the extent needed to fulfil an Order, and a Customer's service location is shared with the assigned Provider for the same purpose.
6.4Delivery location. When you set a delivery location, we store the map pin you place (its coordinates) and the address text you enter.
6.5Use of the map pin. We use the map pin to determine the neighbourhood and service area of the delivery location, so that we can show which Providers are available and the prices that apply. We show the map pin and the address to the assigned Provider and its driver so that they can perform the delivery.
6.6Neighbourhood boundaries. To determine the neighbourhood, we use, within our own systems, third-party district boundary data derived from OpenStreetMap through the Tabaqat geocoding project. We do not share, display or sell that boundary data; you receive only the resulting neighbourhood name.
6.7Attribution: Map data © OpenStreetMap contributors, ODbL; district boundaries from the Tabaqat geocoding project.
6.8Location data is kept with your saved addresses and Order records, and is retained in accordance with clause 10.
7. How We Share Personal Data
7.1We share personal data with:
(a) the other party to an Order: Customers and Providers receive the information needed to perform the Provider Services, such as name, contact details, address, location and Order details, and, where a Customer orders as a business, the business details needed for the Provider's tax invoice;
(b) payment service providers, for payment processing and payouts;
(c) service providers and processors, under contracts that require them to protect the data, in these categories: cloud hosting and storage; messaging (including Meta, which delivers WhatsApp messages, and SMS providers); artificial-intelligence services used to draft automated replies (currently Google's Gemini service for the WhatsApp assistant in clause 14.4 and, for the in-app support assistant available to signed-in users, OpenAI's service with Google's Gemini service as a fallback; the messages you send to the in-app support assistant are sent to that service to draft the reply, the assistant cannot grant refunds or change any contract or Order, and questions it cannot resolve are referred to our support team); IT and security; analytics; customer support; and identity- and licence-verification providers;
(d) professional advisers — including legal, accounting, and insurance advisers;
(e) authorities and regulators — where required by law, or to establish, exercise, or defend legal rights, or to protect safety and property;
(f) acquirers and investors — in connection with a merger, acquisition, financing, or sale of assets; and
(g) members of our group.
7.2We do not sell personal data.
8. International Transfers
8.1Your personal data is transferred to and processed in countries outside the Kingdom of Saudi Arabia. At the effective date of this Policy, our database and application backend are hosted, and uploaded files are stored, in Frankfurt, Germany; Meta (WhatsApp) and Google (Gemini) process the messages described in clause 14; and OpenAI and Google (Gemini) process the messages sent to the in-app support assistant described in clause 7.1(c); this processing may take place outside the Kingdom. We transfer only the data needed for each purpose, and we protect it with encryption in transit and at rest, access controls, and the data-protection terms of the recipients.
8.2We may change our processors, cloud providers and server regions. When we do, we update this Policy or tell you through the Platform or another recorded electronic channel, and any new transfer is made in accordance with the PDPL and its regulations. You can ask us for more information about transfers at myprivacy@nefaya.com.
9. Cookies and Similar Technologies
9.1We and our partners use cookies, software development kits (SDKs), pixels, local storage, and similar technologies (together, "Cookies") on our website and within the Platform.
9.2We use the following categories of Cookies:
(a) Strictly necessary — required to operate the Platform, authenticate you, maintain your session, and keep it secure; these cannot be switched off;
(b) Functional — remember your preferences, such as language and display settings;
(c) Analytics and performance — help us understand how the Platform is used so we can improve it; and
(d) Marketing — used, where you consent, to measure and personalise communications and advertising.
9.3Strictly necessary Cookies are set on the basis of our legitimate interest in operating a secure Platform. Cookies that are not strictly necessary are set only where consent is required and you have given it.
9.4You can manage non-essential Cookies at any time through your browser or device settings. Disabling some Cookies may affect the functionality of the Platform.
9.5Our website (nefaya.com) and the partner portal use Google Analytics analytics Cookies only after you accept them in the consent banner shown on your first visit. Until you choose, and if you decline, analytics is not loaded and no analytics Cookies are set. To change your choice, clear the site's stored data in your browser and the banner will be shown again. We do not use advertising or marketing Cookies. The administration portals set no analytics Cookies, and the mobile apps contain no analytics SDK and use device storage rather than Cookies.
10. Data Retention
10.1We retain personal data only for as long as necessary for the purposes set out in this Policy, including to provide the Platform, to comply with legal, tax, accounting, and regulatory obligations, to resolve disputes, and to enforce our agreements. Retention criteria include the nature of the data, applicable legal requirements, and limitation periods. We then securely delete or anonymise the data.
11. Security
11.1We implement appropriate technical and organisational measures to protect personal data, including encryption in transit, access controls, and monitoring. No method of transmission or storage is completely secure. We maintain procedures to address suspected personal-data breaches. Where a breach is confirmed and notification is required by law, we will notify the competent authority (SDAIA) within 72 hours of becoming aware of it, and affected individuals without undue delay.
12. Your Rights
12.1Subject to the PDPL and applicable law, you have the right to: be informed about how we process your personal data; access your personal data; request the correction of inaccurate or incomplete data; request the deletion of your data in certain circumstances; withdraw consent where processing is based on consent; and, where applicable, request that we transfer certain data to you or another party.
12.2To exercise your rights, contact us at myprivacy@nefaya.com. We will respond within the period required by applicable law. If you are not satisfied, you may lodge a complaint with the competent authority (SDAIA).
13. Children's Data
13.1The Platform is not directed to children. As our own eligibility rule (Terms clause 4.1), you must be at least 18 years old to use it. We do not knowingly collect the personal data of anyone under 18. If we become aware that we have, we will delete it.
14. Marketing and Communications
14.1We may send you service messages that are necessary to operate the Platform. We send marketing communications only where permitted, and you can opt out at any time using the unsubscribe link in the message, or by turning off notifications in Settings inside the Nefaya app.
14.2WhatsApp service messages. If you ask for them, we send WhatsApp messages from Nefaya's own WhatsApp Business number about your Orders and your account, such as Order updates and driver assignment. These are service messages, not marketing. We send them only to the number from which you sent START, and only while it is the mobile number on your account, whether you are a Customer, a Provider or a driver.
14.3How you ask for them. We start only when you send START or ابدأ to our WhatsApp number yourself, by typing it or by using a method made available by us. We record that request as evidence of your opt-in. We do not send a first message asking you to start, and accepting our Terms is not an opt-in. See clause 28.1A of our Terms and Conditions.
14.4What we process. We process your phone number and the content of the messages through Meta's WhatsApp Business Platform, which delivers them. If you write to us on WhatsApp, we process what you send in order to reply. Replies to free-text messages may be drafted by an automated assistant that runs on Google's Gemini artificial-intelligence service; the content of your message is sent to that service for this purpose. You can ask for a person at any time and your request is then referred to our support team. The assistant cannot quote prices, grant refunds or change any contract or Order. Clause 8 explains where this data is processed. We use WhatsApp in accordance with the applicable WhatsApp platform rules and the law, as amended from time to time.
14.5What we keep. We keep a consent record: your phone number, the time you opted in, the time you opted out, and how the record was made. We keep it while your account is open and for 12 months after your account is deleted, so that we can show that you asked for the messages, and then delete it.
14.6Your choices. You can stop at any time by sending STOP or إيقاف, and resume by sending START or ابدأ. You can also ask support at support@nefaya.com, or contact us at myprivacy@nefaya.com to exercise your rights under clause 12. Stopping WhatsApp messages does not affect your account or in-app and push notifications.
15. Automated Decision-Making
15.1We do not make decisions producing legal or similarly significant effects about you based solely on automated processing without a lawful basis and appropriate safeguards. Where we use automated tools (for example, for fraud detection, matching, or the WhatsApp assistant in clause 14.4), human review is available where required by law. The WhatsApp assistant only drafts replies; it does not decide refunds, prices, Orders or account status.
16. Third-Party Links and Services
16.1The Platform may link to or rely on third-party services (for example, payment service providers and mapping services). Their processing of personal data is governed by their own privacy policies, and we are not responsible for their practices.
17. Changes to this Policy
17.1We may update this Policy from time to time with effect for the future. Each version takes effect on the effective date displayed at its start. We notify you of material changes through the Platform, by email or through another recorded electronic channel, and where the law requires your renewed consent we ask for it before the change applies to you.
17.2This Policy is issued in English and Arabic. In the event of any conflict or inconsistency, the Arabic version prevails.
18. Contact and Complaints
18.1Visible Twin Co., 15b, Ash Shulah Dist.1, Dammam, Saudi Arabia. Data protection officer: Mostafa Kamel, mkamel@nefaya.com. The competent supervisory authority is the Saudi Data and Artificial Intelligence Authority (SDAIA).