Privacy Policy

This policy applies to the personal data we process when you browse hayyizapp.com, create an account, list or book a space, or contact us. It should be read together with the Terms of Use and the Cookie Policy.

The controller of your personal data is Maysour Company For Communications and Information Technology, registered in the Kingdom of Saudi Arabia under Commercial Registration No. 7042575444.

For any question or request about your personal data, contact us through the contact page as described under "How to exercise your rights".

3.1 Account and profile data

• Your email address, which you use to sign in with a one-time verification code; we do not use passwords.
• Your name, gender and age; we store age as an approximate year of birth, not a date of birth.
• Your mobile number, which is required to complete your profile and is used to contact you about bookings; we do not verify it by SMS.
• Your national ID or Iqama number, which individuals must provide before sending a booking request or publishing a space because it appears in the rental agreement to identify the parties; we store it encrypted and show you only its last four digits.
• Business account details, if any: legal name, commercial registration number, VAT number where applicable, and the business contact mobile number and optional email.
• Records of your acceptance of legal documents: the document, its version, the time of acceptance, IP address and browser type.

3.2 Space and booking data

• Listing data: the type of space, its dimensions, its exact location on the map, photos, price, uses and features, and the detailed address. We remove location data embedded in photos when they are uploaded.
• Booking data: the space, period, declared items, booking status, payments, handover confirmations and disputes.
• Electronic agreement acceptance records: the party's name, time of acceptance, IP address, browser type and the version of the agreement accepted.

3.3 Support and contact requests

When you contact us we create a ticket with a reference number containing your name, email, mobile number if provided, the topic and messages, any related booking or space, and the IP address, country and browser type to protect against abuse. Attachments are kept in private storage that is not publicly accessible and can be opened only by the ticket owner and the support team, or through temporary signed links; we re-encode images and remove location data from them.

3.4 Payment data

The licensed payment service provider processes card and bank account details directly, and we do not store payment card details. We receive from the provider what is needed to manage the booking, such as the transaction status, amount and reference, and details of host payouts.

3.5 Technical and security data

When you open your account, at every sign-in, and with every action on the platform, such as publishing or editing a space or uploading its photos, requesting, accepting, paying for or confirming handover of a booking, accepting an agreement, writing a review or contacting us, we record the IP address, the approximate country and city inferred from the network, the device type, operating system and browser, the time of the action, and verification code attempts.

3.6 Usage and analytics data

We run analytics ourselves and store them in the platform's own database. After you consent to analytics, we collect the following to improve the service and prevent fraud:

• The pages you visit, visit duration and source, such as a link or campaign.
• Clicks and their approximate position on the page, and scroll depth.
• Searches and filters used, and searches that returned no results.
• Error messages shown in forms, technical errors and page load speed.
• IP address, approximate city, device and browser type, and a random visitor identifier stored in a cookie.

Without your consent, analytics only count page views with the country, device type and general traffic channel (such as WhatsApp or Google search), without an IP address, visitor identifier or clicks.

3.7 How you reached us

When you create an account we record your channel to the platform, such as WhatsApp, X, LinkedIn, Instagram, Snapchat, TikTok, a search engine or a direct link, the campaign tag in the link if any, the site that referred you, and the first page you opened. Share links from the platform carry a tag showing the app they were shared through, so we know which channels people come from.

3.8 Your current location on the map

When you tap the “My location” button your browser asks for permission, and we use your location to show it on the map as a blue dot and to sort spaces by distance from you; we do not save it to your account. When you use it in the listing form, it becomes the saved location of the space.

3.9 What we do not collect

• We do not record what you type into fields, such as messages or personal details, in analytics.
• We do not collect passwords or store payment card details.
• We do not knowingly collect sensitive personal data, and we do not require it to use the platform.

We process your data for the following purposes, on the legal bases shown for each:

We do not sell your personal data, use it for targeted advertising, or make decisions with legal effect about you based solely on automated processing.

We share your data only as necessary and with the following:

• The other party to a booking: the host sees the renter's name and booking details, the renter sees the host's name, and the electronic agreement shows each party's name and business details where applicable, and for individuals their national ID or Iqama number and mobile number. The ID number stays partly hidden and the mobile number withheld from the other party until both parties accept the agreement. The exact address of the space is shown to the renter only after the booking is accepted.
• The licensed payment service provider: to process payments, hold, release and refund funds, and pay hosts.
• Hosting and infrastructure providers: who host the platform and its databases and are contractually bound to protect data, including the network provider through which connections to the platform pass.
• Email: we send emails through our own mail server, without relying on an external marketing provider.
• Analytics tools: we store analytics in the platform's own database. If Microsoft Clarity is enabled for session recording and understanding the user experience, it runs only after your consent, with field contents masked.
• Government and judicial authorities: where required by law or upon a lawful request from a competent authority.
• On transfer of the business: in a merger, acquisition or transfer of the business, subject to this policy and the law.

We aim to keep data within the Kingdom of Saudi Arabia where possible. Some data may be processed outside the Kingdom by technical service providers, such as Microsoft Clarity when enabled and consented to. In that case, transfers take place only under the conditions and safeguards set by the Personal Data Protection Law and the Regulation on Personal Data Transfer outside the Kingdom, and only to the minimum extent necessary.

• We show the detailed address and exact location of a space only to the renter after the booking is accepted, and show an approximate location on the map and in search.
• We store national ID or Iqama numbers, the detailed address of spaces and bank account details encrypted, and only those who need them can access them.
• We use one-time sign-in codes with limited lifetime and attempts, with short sessions that renew securely and are revoked on sign-out or if reuse is detected.
• We restrict access to data to authorised staff on a need-to-know basis and log administrative actions.
• If a breach affects your data, we notify the Saudi Data and Artificial Intelligence Authority and you within the time limits and under the rules set by law.

Please do not share verification codes with anyone.

The Personal Data Protection Law gives you the following rights:

• Right to be informed: of the legal basis and purpose for collecting your data, as explained in this policy.
• Right of access: to the personal data we hold about you, and to obtain a copy in a clear, readable format.
• Right to correction: to have your data corrected, completed or updated. You can edit your name, gender, age, mobile number and business contact details directly in your dashboard.
• Right to destruction: to have your data deleted and your account closed when it is no longer needed, unless the law requires us to keep it, such as booking, financial and acceptance records.
• Right to withdraw consent: at any time for processing based on consent, such as analytics, without affecting the lawfulness of earlier processing.
• Right to complain: to the Saudi Data and Artificial Intelligence Authority (SDAIA) if you believe your data is processed unlawfully.

9.1 How to exercise your rights

1. Open the contact page, choose "Support & problems" and then the topic "Account & sign-in" (or "Something else" if you have no account).
2. State your request clearly: a copy of your data, a correction, deletion and account closure, withdrawal of consent, or an objection.
3. Send the request while signed in or from the email registered to your account; we may ask for what is needed to verify your identity before acting.
4. We respond within the statutory period, usually no more than thirty (30) days, and tell you if part of your request cannot be fulfilled and why.

You can withdraw your analytics consent immediately using the "Privacy settings" button:

The platform is intended for people aged eighteen (18) and over, and we do not knowingly collect data from anyone younger. If we learn that we have collected a minor's data, we delete it as soon as possible.

We use essential cookies to run the platform and analytics cookies only after your consent. Details, durations and how to control them are in the Cookie Policy.

We may update this policy from time to time and will publish the updated version on this page with its version date. For material changes, we notify you by email or on the platform and ask you to accept the new version at your next visit.

For any question about this policy or request about your data, contact us through the contact page.