Nefaya · Visible Twin Co.
Privacy Policy
Version 1.6. This version is effective on the effective date displayed at the start of this Policy and replaces version 1.5 of 8 November 2026. Orders concluded before the effective date remain governed by the terms that applied to them (Terms and Conditions, clause 26).
1. Introduction and Scope
1.1This Privacy Policy explains how Visible Twin Co. ("the Company", "we", "us", or "our") collects, uses, shares, and protects personal data when you use the Nefaya application, website, and related services (the "Platform").
1.2It applies to Customers, Providers, their personnel, and visitors to the Platform. It should be read together with our Terms and Conditions.
1.3We process personal data in accordance with the Personal Data Protection Law of the Kingdom of Saudi Arabia (the "PDPL") and its implementing regulations, which are overseen by the Saudi Data and Artificial Intelligence Authority (SDAIA), and with other data-protection laws applicable where we operate.
2. Who We Are (Controller)
2.1Visible Twin Co., of 15b, Ash Shulah Dist.1, Dammam, Saudi Arabia, is the controller responsible for your personal data, except where we act as a processor on behalf of a Provider or other business User.
2.2For privacy queries or to exercise your rights, contact our data protection officer: Mostafa Kamel, mkamel@nefaya.com, 15b, Ash Shulah Dist.1, Dammam, Saudi Arabia.
3. Personal Data We Collect
3.1Depending on how you use the Platform, we may collect the following categories of personal data:
(a) Identity and account data: name, username, date of birth or age confirmation, and profile details; for Providers, business name, commercial registration and licence numbers, and authorised-representative details; and, for Customers ordering as a business, the business's legal name, VAT registration number and national address;
(b) Contact data — email address, telephone number, and billing and service addresses;
(c) Booking and transaction data — Orders, Containers, locations, Hire Periods, history, and communications relating to Orders. For a Managed Order, this includes the phone number a Provider, business partner, or administrator supplies to invite a Customer, and the fact and time of the Customer's claim of that Order;
(d) Payment data — payment-method details processed by our payment service provider (we do not store full card numbers), billing records, and Provider payout details;
(e) Location data — precise and/or approximate geolocation from your device (where you grant permission) and the service addresses you provide, used for delivery, collection, routing, and job tracking;
(f) Device and technical data — IP address, which may be used transiently by our analytics provider to derive an approximate location such as country and city; the raw IP address is not retained with the analytics event. We also collect device identifiers, operating system, app version, and log, diagnostic, cookie, and similar data;
(g) Usage data — information about how you interact with the Platform, such as the screens and pages you open, a small set of key actions (for example signing up, choosing a delivery city, viewing checkout, placing or cancelling an Order, completing a sign-up step as a Provider, or, in the Driver app, the screens you open and the actions you take, such as accepting a job, changing its status or switching your availability), and error reports. Product-analytics events (clause 9.6) are linked to your account only by a pseudonymous account identifier and your role, and never contain your name, telephone number, email address, address, commercial registration or licence details, or Order number. If we enable Microsoft Clarity on the partner portal, and only after you accept analytics Cookies, it may also include session recordings and heat maps of how you use the portal (clause 9.5);
(h) Communications and content — in-app messages, ratings, reviews, photographs (for example of waste, sites, or Containers), and support correspondence;
(i) Verification and compliance data — KYC, licence, and insurance documents provided by Providers, and fraud-prevention signals; and
(j) Marketing preferences.
4. How We Collect Personal Data
4.1We collect personal data: (a) directly from you, when you register, place or accept Orders, communicate with us, or submit Content; (b) automatically, through your use of the Platform and your device; and (c) from third parties, such as payment service providers, identity- and licence-verification providers, analytics providers, and, for a Provider's personnel, from the Provider.
5. How and Why We Use Personal Data, and Legal Basis
5.1We use personal data for the purposes below. Under the PDPL, processing needs your consent unless an exception in Article 6 applies. The basis for each purpose is:
(a) creating and managing your account; (b) taking, performing and communicating about Orders, including Managed Order invitations and WhatsApp service messages you have asked for; (c) payments, invoices, refunds and Provider settlement; (d) delivery, collection, routing and job tracking; (f) support, complaints and disputes: processing to perform an agreement to which you are a party, or required by another law (PDPL Art. 6(2));
(e) verifying Providers and their licences, recording the insurance Providers declare, and preventing fraud; (g) securing, maintaining and improving the Platform, including the product analytics and error reporting in clause 9.6: our legitimate interests (PDPL Art. 6(4)), which we do not rely on for sensitive data or where they would override your rights and interests; where a law requires the processing (for example licence checks), Art. 6(2);
(h) legal, tax, environmental and regulatory obligations: required by another law (PDPL Art. 6(2));
(i) marketing communications: your consent, which you can withdraw at any time. We never make consent to marketing a condition of using the Platform.
Device location for (d) is collected only with your device permission (clause 6), and Google Analytics Cookies and, if enabled, Microsoft Clarity session recordings and heat maps only with your consent (clause 9.5).
6. Location and Map Data
6.1With your permission, we collect device location to show nearby Providers, enable accurate delivery and collection, route Providers, and, for Providers and drivers, track jobs in progress.
6.2You can control location permissions through your device settings. Disabling location may limit the functionality of the Platform.
6.3A Provider's or driver's location may be shared with the relevant Customer to the extent needed to fulfil an Order, and a Customer's service location is shared with the assigned Provider for the same purpose.
6.4Delivery location. When you set a delivery location, we store the map pin you place (its coordinates) and the address text you enter.
6.5Use of the map pin. We use the map pin to determine the neighbourhood and service area of the delivery location, so that we can show which Providers are available and the prices that apply. We show the map pin and the address to the assigned Provider and its driver so that they can perform the delivery.
6.6Neighbourhood boundaries. To determine the neighbourhood, we use, within our own systems, third-party district boundary data derived from OpenStreetMap through the Tabaqat geocoding project. We do not share, display or sell that boundary data; you receive only the resulting neighbourhood name.
6.7Attribution: Map data © OpenStreetMap contributors, ODbL; district boundaries from the Tabaqat geocoding project.
6.8Location data is kept with your saved addresses and Order records, and is retained in accordance with clause 10.
7. How We Share Personal Data
7.1We share personal data with:
(a) the other party to an Order: Customers and Providers receive the information needed to perform the Provider Services, such as name, contact details, address, location and Order details, and, where a Customer orders as a business, the business details needed for the Provider's tax invoice;
(b) payment service providers, for payment processing and payouts;
(c) service providers and processors, under contracts that require them to protect the data, in these categories: cloud hosting and storage; messaging (including Meta, which delivers WhatsApp messages, and SMS providers); artificial-intelligence services used to draft automated replies (currently Google's Gemini service for the WhatsApp assistant in clause 14.4 and, for the in-app support assistant available to signed-in users, OpenAI's service with Google's Gemini service as a fallback; the messages you send to the in-app support assistant are sent to that service to draft the reply, the assistant cannot grant refunds or change any contract or Order, and questions it cannot resolve are referred to our support team); IT and security; product analytics and error reporting (currently PostHog, whose EU cloud is hosted in Frankfurt, Germany, see clause 9.6); customer support; and identity- and licence-verification providers;
(d) professional advisers — including legal, accounting, and insurance advisers;
(e) authorities and regulators — where required by law, or to establish, exercise, or defend legal rights, or to protect safety and property;
(f) acquirers and investors — in connection with a merger, acquisition, financing, or sale of assets; and
(g) members of our group.
7.2We do not sell personal data.
7.3Microsoft Clarity (if enabled). On the partner portal only, and only if you consent, we may use Microsoft Clarity for session recordings and heat maps (clause 9.5). Microsoft states that Clarity operates as a data controller and processes Clarity data under Microsoft's applicable terms and privacy statement.
8. International Transfers
8.1Your personal data is transferred to and processed in countries outside the Kingdom of Saudi Arabia. At the effective date of this Policy, our database and application backend are hosted, and uploaded files are stored, in Frankfurt, Germany; Meta (WhatsApp) and Google (Gemini) process the messages described in clause 14; and OpenAI and Google (Gemini) process the messages sent to the in-app support assistant described in clause 7.1(c); PostHog stores Nefaya's product-analytics data (clause 9.6) in its EU Cloud in Frankfurt, Germany, and PostHog and its authorised subprocessors may also process or access that data from other jurisdictions as described in its applicable data-processing terms; if we enable Microsoft Clarity (clause 9.5), Microsoft may process Clarity data on its cloud services outside the Kingdom; all of this processing takes place outside the Kingdom. We transfer only the data needed for each purpose, and we protect it with encryption in transit and at rest, access controls, and the data-protection terms of the recipients.
8.2We may change our processors, cloud providers and server regions. When we do, we update this Policy or tell you through the Platform or another recorded electronic channel, and any new transfer is made in accordance with the PDPL and its regulations. You can ask us for more information about transfers at myprivacy@nefaya.com.
9. Cookies and Similar Technologies
9.1We and our partners use cookies, software development kits (SDKs), pixels, local storage, and similar technologies (together, "Cookies") on our website and within the Platform.
9.2We use the following categories of Cookies:
(a) Strictly necessary — required to operate the Platform, authenticate you, maintain your session, and keep it secure; these cannot be switched off;
(b) Functional — remember your preferences, such as language and display settings;
(c) Analytics and performance — help us understand how the Platform is used so we can improve it; and
(d) Marketing — used, where you consent, to measure and personalise communications and advertising.
9.3Strictly necessary Cookies are set on the basis of our legitimate interest in operating a secure Platform. Cookies that are not strictly necessary are set only where consent is required and you have given it.
9.4You can manage non-essential Cookies at any time through your browser or device settings. Disabling some Cookies may affect the functionality of the Platform. This does not apply to the product analytics in clause 9.6 (see clause 9.7).
9.5Our website (nefaya.com) and the partner portal (partners.nefaya.com) use Google Analytics Cookies and, if we enable it, the partner portal may also use Microsoft Clarity, in each case only after you accept them in the consent banner shown on your first visit. If enabled, Microsoft Clarity records how you use the partner portal (for example the pages you visit, clicks, scrolling and pointer movement) as session recordings and heat maps; text you type into input fields and drop-down menus is masked and is not uploaded. Microsoft states that Clarity operates as a data controller and processes Clarity data under Microsoft's applicable terms and privacy statement. Until you choose, and if you decline, Google Analytics and Clarity are not loaded and no analytics Cookies are set. To change your choice, clear the site's stored data in your browser and the banner will be shown again. We do not use advertising or marketing Cookies. We do not use Clarity or session recording in the mobile apps or the administration portals.
9.6Product analytics (PostHog). On the partner portal, on the administration portals and, from version 1.13.0 of the Nefaya customer app and version 1.11.0 of the Nefaya Driver app, in those apps, we use PostHog (PostHog Inc., EU cloud, hosted in Frankfurt, Germany) as our processor to count how the Platform is used and to find errors. We record the screens and pages you open, a small set of key actions (for example signing up, choosing a delivery city, viewing checkout, placing or cancelling an Order, and completing sign-up steps as a Provider), your app version, language and device type, your IP address, which may be used transiently by PostHog to derive an approximate location such as country and city (the raw IP address is not retained with the event), and error reports. These events are linked only to your pseudonymous account identifier and role. That identifier is pseudonymous, not anonymous: it remains personal data because we can associate it with your account. They never contain your name, telephone number, email address, address, commercial registration or licence details, or Order number. We do not use session replay in PostHog and we do not use automatic capture: we record only the events listed above, never the content you type, and not every tap. On the partner portal, PostHog starts only after you accept analytics Cookies in the consent banner (clause 9.5). The administration portals use PostHog without Cookies or any other storage on your device. We use this data to see where people stop during sign-up and ordering, in which cities customers look for a Provider, and to fix errors. PostHog keeps these events for 12 months. We do not sell it and do not use it to track you across other companies' apps or websites. In the Driver app we record only the events listed in clause 9.8.
9.7App notice. When you first open the Nefaya customer app after it is updated to version 1.13.0, or the Nefaya Driver app after it is updated to version 1.11.0, we show a one-time notice that this Policy has been updated; you continue by selecting "Got it", which acknowledges the notice; it is not consent. Neither app has an in-app switch for the analytics in clause 9.6. You may exercise your rights in relation to analytics data linked to your account, including requesting access to or destruction of that data, by writing to myprivacy@nefaya.com. We act on such a request without waiting for the end of the period in which you can restore your account. When you delete your account, we also delete the analytics identity and events linked to it; if you later restore the account, analytics starts again with a new history.
9.8Driver app. From version 1.11.0 of the Nefaya Driver app, we use PostHog in that app as described in clause 9.6 to record the screens you open (by screen type only, never order numbers or other identifiers), the actions you take in the app (for example accepting a job, changing a job's status, switching your availability on or off, completing sign-up steps and uploading documents, and whether these succeed or fail), and error reports (the error type and the affected code only, not the error text). In the Driver app we do not record your location in any form, and we do not use your IP address to derive a country or city. We use this data only to find and fix problems in the Driver app and to improve it. We never use it to rate, rank, pay or discipline you or to make any other decision about you, and we do not share it with, or show it to, the Provider you work for. Before the first event is sent, the Driver app shows the one-time notice in clause 9.7. The Nefaya apps do not use browser Cookies; the PostHog SDK keeps its identifier in device storage.
10. Data Retention
10.1We retain personal data only for as long as necessary for the purposes set out in this Policy, including to provide the Platform, to comply with legal, tax, accounting, and regulatory obligations, to resolve disputes, and to enforce our agreements. Retention criteria include the nature of the data, applicable legal requirements, and limitation periods. We then securely delete or anonymise the data.
10.2Product-analytics events held by PostHog (clause 9.6) are kept for 12 months, and are deleted earlier as described in clause 9.7.
11. Security
11.1We implement appropriate technical and organisational measures to protect personal data, including encryption in transit, access controls, and monitoring. No method of transmission or storage is completely secure. We maintain procedures to address suspected personal-data breaches. Where a breach is confirmed and notification is required by law, we will notify the competent authority (SDAIA) within 72 hours of becoming aware of it, and affected individuals without undue delay.
12. Your Rights
12.1Subject to the PDPL and applicable law, you have the right to: be informed about how we process your personal data; access your personal data; request the correction of inaccurate or incomplete data; request the deletion of your data in certain circumstances; withdraw consent where processing is based on consent; and, where applicable, request that we transfer certain data to you or another party.
12.2To exercise your rights, contact us at myprivacy@nefaya.com. We will respond within the period required by applicable law. If you are not satisfied, you may lodge a complaint with the competent authority (SDAIA).
13. Children's Data
13.1The Platform is not directed to children. As our own eligibility rule (Terms clause 4.1), you must be at least 18 years old to use it. We do not knowingly collect the personal data of anyone under 18. If we become aware that we have, we will delete it.
14. Marketing and Communications
14.1We may send you service messages that are necessary to operate the Platform. We send marketing communications only where permitted, and you can opt out at any time using the unsubscribe link in the message, or by turning off notifications in Settings inside the Nefaya app.
14.2WhatsApp service messages. If you ask for them, we send WhatsApp messages from Nefaya's own WhatsApp Business number about your Orders and your account, such as Order updates and driver assignment. These are service messages, not marketing. We send them only to the number from which you sent START, and only while it is the mobile number on your account, whether you are a Customer, a Provider or a driver.
14.3How you ask for them. We start only when you send START or ابدأ to our WhatsApp number yourself, by typing it or by using a method made available by us. We record that request as evidence of your opt-in. We do not send a first message asking you to start, and accepting our Terms is not an opt-in. See clause 28.1A of our Terms and Conditions.
14.4What we process. We process your phone number and the content of the messages through Meta's WhatsApp Business Platform, which delivers them. If you write to us on WhatsApp, we process what you send in order to reply. Replies to free-text messages may be drafted by an automated assistant that runs on Google's Gemini artificial-intelligence service; the content of your message is sent to that service for this purpose. You can ask for a person at any time and your request is then referred to our support team. The assistant cannot quote prices, grant refunds or change any contract or Order. Clause 8 explains where this data is processed. We use WhatsApp in accordance with the applicable WhatsApp platform rules and the law, as amended from time to time.
14.5What we keep. We keep a consent record: your phone number, the time you opted in, the time you opted out, and how the record was made. We keep it while your account is open and for 12 months after your account is deleted, so that we can show that you asked for the messages, and then delete it.
14.6Your choices. You can stop at any time by sending STOP or إيقاف, and resume by sending START or ابدأ. You can also ask support at support@nefaya.com, or contact us at myprivacy@nefaya.com to exercise your rights under clause 12. Stopping WhatsApp messages does not affect your account or in-app and push notifications.
15. Automated Decision-Making
15.1We do not make decisions producing legal or similarly significant effects about you based solely on automated processing without a lawful basis and appropriate safeguards. Where we use automated tools (for example, for fraud detection, matching, or the WhatsApp assistant in clause 14.4), human review is available where required by law. The WhatsApp assistant only drafts replies; it does not decide refunds, prices, Orders or account status.
16. Third-Party Links and Services
16.1The Platform may link to or rely on third-party services (for example, payment service providers and mapping services). Their processing of personal data is governed by their own privacy policies, and we are not responsible for their practices.
17. Changes to this Policy
17.1We may update this Policy from time to time with effect for the future. Each version takes effect on the effective date displayed at its start. We notify you of material changes through the Platform, by email or through another recorded electronic channel, and where the law requires your renewed consent we ask for it before the change applies to you.
17.2This Policy is issued in English and Arabic. In the event of any conflict or inconsistency, the Arabic version prevails.
18. Contact and Complaints
18.1Visible Twin Co., 15b, Ash Shulah Dist.1, Dammam, Saudi Arabia. Data protection officer: Mostafa Kamel, mkamel@nefaya.com. The competent supervisory authority is the Saudi Data and Artificial Intelligence Authority (SDAIA).