Privacy Policy

Halaa is the event and invitation-management platform owned and operated by Afaq hala Company For Communications and Information (افاق هلا للاتصالات والمعلومات), registered with the Ministry of Commerce in the Kingdom of Saudi Arabia. A User is anyone who uses the platform or its services, including a personal or business host, vendor, guest, or event staff member. Personal Data means information relating directly or indirectly to an identified or identifiable natural person under applicable Saudi law.

This policy applies to personal data processed through Halaa's website, mobile applications, APIs, support operations, and service-related messaging channels. Acceptance of this policy is not treated as consent to unrelated optional purposes such as marketing; separate consent is requested where consent is the appropriate legal basis. Material changes are presented appropriately before they take effect where required.

We may collect account and contact data (name, email, and mobile number); business/vendor profile and verification documents; event, guest, RSVP, check-in, venue/location, and staff data; uploaded content, documents, photos, videos, comments, and support tickets; and purchase, subscription, and refund history. Guest information supplied by a user may include dietary restrictions or other sensitive information; users must provide only what is necessary and lawful.

With optional permission, the app reads names and phone numbers from the device address book to display them locally. It does not upload the whole address book; only contacts the user explicitly selects to add as guests are sent to Halaa. With optional permission, the app may use the device location or a point selected on a map to choose an event venue, and it accesses only photos or documents selected for upload.

We also collect account and transaction identifiers, push tokens, device/OS/app version, IP address, browser and access time, product interactions, crash data, and performance diagnostics. Halaa does not store full card numbers or security codes. The payment provider or store processes payment credentials; Halaa may retain limited payment-method details such as type, last four digits, and transaction identifiers for accounting and support.

Personal data is processed to enable users to benefit from platform services, execute event-related requests, provide technical support, improve service quality, enhance system performance, and communicate with users regarding updates, inquiries, or operational matters.

Marketing communications may be sent only to users who have explicitly consented or voluntarily subscribed to mailing lists.

Processing is carried out based on lawful grounds, including user consent, contract performance, compliance with legal obligations, or the protection of Halaa's legitimate interests.

Halaa is committed to implementing appropriate technical and administrative measures to protect personal data from unauthorized access, disclosure, alteration, loss, or destruction. These measures include encryption systems, secure communication channels, access control management, monitoring systems, and intrusion prevention tools.

Authorized employees are subject to strict policies governing their access to and handling of personal data.

Halaa does not sell personal data and does not use it to track users for advertising across other companies' apps or websites. Depending on the feature used, data may be processed by MongoDB Atlas and AWS/S3 for hosting and storage; Moyasar for web payments; Apple, Google, and RevenueCat for in-app purchases; Expo, APNs, and FCM for notifications; Sentry for diagnostics; Google Maps for maps; Taqnyat and email/SMS providers; and Meta/WhatsApp as a user-selected messaging channel. Data is disclosed only as needed for service delivery, security, compliance, or support, and a provider may act as a processor or independent recipient under its own terms. Data may also be disclosed to satisfy law or a competent-authority order, protect rights, or prevent fraud and abuse.

Account, event, and content data is retained while needed to provide the service or until deletion or the purpose ends, then deleted or anonymized unless retention is legally required. After account deletion, personal data is deleted or anonymized under the Account and Data Deletion Policy. The current working schedule retains pseudonymized financial, subscription, and business-contract records for six years and security/abuse audit records for two years, or longer where a legal obligation, dispute, or investigation applies.

Halaa does not currently promise that every incomplete request is automatically deleted after three months because that timer is not implemented across every request path. This policy will be updated when a final automated deletion schedule is approved and implemented. Exact periods remain subject to Saudi-counsel approval before this draft is published.

Users can access and correct much of their information through account settings and can request account deletion in the app or on the public account-deletion page. For access, correction, objection, or withdrawal of optional consent, contact support@halaa.com.sa. We verify the requester's identity and handle rights within the scope and periods required by applicable law. Deleting a Halaa account does not cancel an Apple or Google subscription; renewal must be cancelled in the store.

The Halaa Platform may contain links to external websites or services not managed by Halaa. Halaa is not responsible for the privacy practices or content of such external sites, and user interaction with them is subject to their respective independent policies.

Halaa reserves the right to amend or update this Privacy Policy at any time. The updated version shall become effective upon publication on the platform. Continued use of the platform after such publication constitutes explicit acceptance of the revised policy.

For privacy inquiries or rights requests, contact support@halaa.com.sa or +966 55 261 9282, or use the Support or Account Deletion page. Halaa does not claim to record calls unless that practice is enabled and an appropriate notice is given before recording.