Privacy policy

Nawwarti is a Saudi platform that connects clients with makeup and hair artists. The Nawwarti app and nawwarti.com are operated by [Company name], commercial registration [CR number], [Address] (“we”). We are responsible for your personal data under the Personal Data Protection Law of the Kingdom of Saudi Arabia and its regulations.

This policy covers the app and the website, for clients and artists. Privacy contact: privacy@nawwarti.com.

Account: your Saudi mobile number, which we verify with a code sent by text message, your name, city and district, app language, and a profile photo if you add one. If you sign up with e-mail: your address and password (stored with one-way hashing). If you sign in with Apple or Google: the identifier they send us, plus your e-mail and name if you share them.

Bookings: the artist, service, add-ons and number of companions, the date and time, where you get ready (home, studio or venue) and the address you enter or save for home visits, your notes and the look photos you upload, and the status and history of the booking, including any cancellation reason.

Chats: the messages and photos you exchange with the artist in the app.

Reviews and activity: your reviews, their text and photos (with the option to hide faces), saved artists and looks, follows, likes, comments and reports, and how long you watch posts so we can rank the Discover feed.

For artists, also: profile details (display name, bio, city, the districts you serve, and your studio address and location if you have one), services, prices and availability, portfolio photos and posts with the related client consents, verification records (identity check through Nafath, CR or freelance document, health certificate and Balady permit) with their numbers and expiry dates, subscription and boost details (plan, status, store, renewal date and invoices), and the income records you enter yourself in Income.

Consents: a record of your choices about personalised ads, photo publishing and marketing messages, with the date of each choice.

Technical: IP address, app version and request logs on our servers for security, abuse prevention and troubleshooting, and your device’s notification token if you turn notifications on.

We don’t ask for your precise location and we don’t collect payment card details: clients pay the artist directly, and artist subscriptions are paid through the App Store or Google Play.

• To run the service: create your account, show artists by occasion and city, send and confirm booking requests, chat, remind you of appointments, send notifications and handle reviews.
• To verify artists and keep the platform safe: identity and document checks, fraud and abuse prevention, rate limits, and moderation of reviews, posts, comments and reports.
• To manage artist plans, boosts and plan limits.
• To answer your questions and contact you about your account and bookings.
• To improve the service with aggregated statistics, such as profile views and post ranking.
• Ads: we show promoted cards labelled “Ad” on Home, search results and Saved only, never in booking, chat or reviews. Ads are personalised only with your consent, and we don’t currently use third-party ad networks; if we add one, we will update this policy and ask for your consent.
• To comply with the laws of the Kingdom.

We process your data because it is needed to provide the service you asked for (for example, to pass your booking request to the artist), because the law requires it, for legitimate interests that don’t override your rights (such as platform security and fraud prevention), or with your explicit consent (for example, publishing a photo that shows your face, personalised ads and marketing messages). You can withdraw consent at any time; this doesn’t affect processing that happened before.

With the artist you book: your name, the request details, where you get ready and the address for home visits, your messages and look photos, only as needed for your booking. Your phone number is not shown to the artist.

Publicly: the artist’s profile, work and prices, and reviews under the reviewer’s first name only.

Service providers that process data on our behalf under contracts that require them to protect it:

• Amazon Web Services: servers, database, file storage (Amazon S3) and backups, in Frankfurt, Germany.
• Cloudflare: network, domain names, protection and delivery of the website and the app’s traffic.
• RevenueCat: artist subscriptions and in-app purchases with the App Store and Google Play. We share your account identifier only; payment details stay with Apple and Google.
• Apple and Google: when you sign in with them and when you buy through their stores.
• Unifonic: to send verification codes by text message.
• Nafath (the National Single Sign-On): to verify artists’ identity.
• An e-mail provider: to send password reset links.

We may disclose data to competent authorities when the law requires it. We never sell your data.

Nawwarti’s data is stored on Amazon Web Services servers in Frankfurt, Germany, and some of the providers above may process limited data outside the Kingdom (such as Cloudflare’s global network and RevenueCat in the United States). We transfer the minimum needed, in line with the regulation on transferring personal data outside the Kingdom and with suitable contractual and technical safeguards.

No photo showing a client’s face is published on Nawwarti without her consent. After the appointment, the client gets a consent request in the app and can accept or decline; when booking, she can also allow photos to be published only with her face hidden. Artists can blur faces and add a watermark, and a photo that needs a consent that wasn’t given is never shown.

If you see a photo of you published without your consent, or want to withdraw a consent you gave, email privacy@nawwarti.com and we will hide it promptly.

We keep your account data for as long as you use your account. When you delete it:

• We cancel your upcoming bookings automatically and notify the artists.
• We immediately delete your phone number, e-mail, name, password, profile photo, addresses, Apple and Google links, devices, saved items, follows, likes and notifications.
• We delete the messages you sent and their photos, your review photos and your comments.
• Your published reviews stay without your name (shown as “Client”).
• For artists: we delete portfolio photos, posts, document files and the studio address and location, and the profile disappears from Nawwarti.
• We keep booking records without your contact details for as long as the law requires or to settle an open dispute, then delete them.
• Deleted data leaves our backups within 30 days, and security logs are kept for a limited time.

Verification codes expire within minutes, and password reset links after 30 minutes.

Under the Personal Data Protection Law you have the right to:

• Be informed of how and why your data is collected and processed, as this policy explains.
• Access your data and get a copy of it in a clear format.
• Correct or update your data; you can edit most of it directly in the app.
• Ask us to delete your data when it is no longer needed.
• Withdraw your consent at any time.
• Complain to the competent authority (the Saudi Data and AI Authority) if you believe your data was processed against the law.

To use any of these rights, email privacy@nawwarti.com. We reply within 30 days after verifying your identity.

In the app: Account → Delete account, or on the delete account page of this site with your phone number. Your upcoming bookings are cancelled automatically and the artists are notified. For artists: subscriptions are cancelled in the App Store or Google Play; deleting the account doesn’t cancel them.

We encrypt the connection between your device and our servers (HTTPS), store passwords and verification codes with one-way hashing, limit attempts to stop guessing, restrict access to data to the team members who need it, and store files with Amazon Web Services with encryption. No system is completely secure; if a breach affects your data, we will tell you and the competent authority as the law requires.

Nawwarti is meant for people aged 18 and over, and we don’t knowingly collect data from anyone younger. If we learn that an account belongs to a minor, we delete it.

nawwarti.com uses no advertising or analytics cookies and no tracking tools. The forms on this site (account deletion and password reset) send your data straight to our servers over an encrypted connection, and we don’t keep sign-in tokens in your browser. Cloudflare processes technical data such as your IP address to deliver and protect the site, and may set strictly necessary security cookies.

If we change this policy, we will publish the new version here with its date and tell you in the app before any material change takes effect.

privacy@nawwarti.com
[Company name] · [Address]