Privacy Policy

Introduction

Najm Al Sahra, operated by alqalam alisnaai Company For Technologies (Stilus Ingenium), is committed to protecting your privacy in accordance with the Saudi Personal Data Protection Law (PDPL) and the EU General Data Protection Regulation (GDPR). This policy explains what we collect, why, and how we protect it.

Data We Collect

• Account data: mobile number (login basis), name, city, account type (client / artist / venue), and your email address if you add one (optional).
• Verification data: when you verify your account we ask for your national ID or residence permit number and its expiry date, or the commercial registration number for venues, with photos of the document and a selfie for matching. The numbers are stored encrypted, only our verification team can see them, and they are used solely to confirm identity and prevent fraud.
• Service-provider data: stage name, category, work samples (photos and video), and bank transfer details (IBAN) — stored encrypted and never displayed to any party.
• Location: used only when you activate the "Nearby" feature or share your location as an artist, while using the app — no background tracking.
• Chat messages: stored to deliver the service and protect you in disputes; automatically filtered to prevent exchanging contact numbers before booking confirmation.
• Bookings and payments: order details and amounts. Your card data never passes through our servers — it is processed directly by the licensed payment gateway (Moyasar).
• Reviews and published content: your reviews, profile bio and work samples are visible to other users of the platform.
• Reports and blocks: if you report content or an account, we keep the report and its reason for our team to review, and we never tell the content owner who reported it. If you block an account, we keep that so we can hide it from you and stop messages between you.
• Notification identifier: your device FCM token for booking notifications.
• Usage analytics: general usage events (such as signing in, starting an order, a successful payment) with your account type — without your name or mobile number — through Google Firebase Analytics, so we can see where users get stuck and improve the app. This service may read your device's advertising identifier for analytics, and we never use it for advertising.
• Crash reports: if the app crashes, a technical report (device model and OS, where the error happened, and the screen you were on) is sent through Google Firebase Crashlytics so we can fix it. The report does not carry your name or mobile number.
• Invite link data: if you reached us through an invite link, we record a random click identifier, your device platform and the time of opening, and the app store may tell us that an install originated from that click. The purpose is one thing only: to know who invited you so we can credit them — we do not build an advertising profile from it and we do not track you across other apps or websites.

How We Use Your Data

• Operating your account, completing bookings, and enabling communication between parties.
• Protecting financial transactions via an escrow system until service completion.
• Sending notifications related to your bookings and account.
• Improving the platform using aggregated, anonymized statistics that cannot identify you.

What We Never Do

• We never sell your personal data to third parties.
• We do not show ads based on tracking you.
• We only share data under a lawful order from a competent authority, or with your explicit consent.

Third-Party Sharing

• Moyasar (payment gateway licensed by the Saudi Central Bank): payment processing.
• Google Firebase: push notifications, usage analytics and crash reports — as a service provider processing data on our behalf.
• SMS provider: delivering your one-time verification code (OTP).

Each party receives only the minimum required to perform its function.

Your Rights

• Access your stored data and request a copy.
• Correct your data from within the app.
• Permanently delete your account and data from: Settings, Delete Account — or by contacting us.
• Withdraw location or notification consent anytime from your device settings.

Data Retention

We retain your data while your account is active. Upon account deletion, personal data is removed within 30 days, except records we are legally required to keep (financial records) under Saudi regulations.

Minors

The platform is intended for users aged 18 and above; we do not knowingly collect data from minors.

Contact

For any privacy inquiry or request: dev@stilus-ingenium.com