Privacy Policy

Who is responsible for your data

The data controller is Fast-Prog.

Email: info@fast-prog.com

Address: 2829 Abi Al Futuh La Khabbaz, Al Yarmuk, 8004, Riyadh 13251, Kingdom of Saudi Arabia

If you have questions about this Policy or about how we handle personal data, please contact us at the email above. We will respond in accordance with the time limits set out in the PDPL and its Implementing Regulation.

Personal data we collect

Depending on how you use SAYYAH, we may collect the following categories of personal data:

Account and identity. First name and any other name fields you provide, email address (also used as your username), mobile phone number and country code, password, account type (Tourist or Guide), and a profile photograph if you upload one.

Content you create. Text, photos, and videos in posts and highlights; attraction listings (including name, description, category, services, ratings, and location); and comments, likes, shares, and views.

Social interactions. Follow and unfollow actions, follow requests, friends lists, blocked users, and related in-app notifications.

Location. Precise GPS coordinates and place information (such as city, province, postal code, and location name) when you allow location access. This is used to show nearby guides, place attractions on the map, and display your current area. Guides may hide their location from other users.

Phone-number requests. Tourists may request a guide's phone number. The guide may approve or reject the request. If approved, that number is shared with the requesting tourist so they can arrange contact.

Device and notifications. A Firebase Cloud Messaging (FCM) push token so we can send service notifications (for example likes, comments, follow requests, and phone-number requests).

Technical and security data. IP address, session identifiers needed to keep you signed in, and server logs used to secure the service, prevent abuse, and diagnose faults.

We do not collect payment-card details. SAYYAH does not currently process payments. We do not use advertising SDKs, and we do not sell personal data.

How we collect data

We collect personal data:

Directly from you, when you register, complete your profile, post content, rate attractions, request a guide's number, or contact us.

Automatically, when you use maps, location, or notifications, subject to the permissions you grant on your device.

From other users, when they interact with your public profile or content (for example, comments on your posts).

From communications providers that deliver one-time passwords (OTP) to your email and WhatsApp for account verification.

Why we use your data

We use personal data to:

Create and manage your account, verify your email and phone with OTP, authenticate you, and reset your password.

Operate SAYYAH's travel and social features: the home feed, attractions, highlights, maps, follows, comments, likes, ratings, and sharing through links.

Connect tourists with local guides, including optional phone-number sharing after the guide approves a request.

Send the service notifications you enable on your device.

Moderate content and enforce our End-User License Agreement, Saudi public-morality standards, and CST/CITC rules, including our zero-tolerance policy for objectionable or unlawful content.

Protect the security of users and the Application, prevent fraud and abuse, and diagnose technical issues.

Comply with Saudi law and respond to lawful requests from competent authorities.

Improve the reliability of the Application. We do not use your data for third-party advertising.

Legal bases under the PDPL

We process personal data on one or more of the following bases, as applicable:

Your consent — for example location access, camera and photo-library access, and push notifications. You may withdraw optional consent at any time in your device settings or in the Application (for example, a guide hiding their location). Withdrawal does not affect processing already carried out lawfully.

Necessity to perform our contract with you — providing the SAYYAH service you registered for, including your account, feed, attractions, and social features.

Compliance with a legal obligation under the laws of the Kingdom of Saudi Arabia.

Other bases permitted by the PDPL — including processing needed to protect vital or actual interests, or for security and abuse prevention, where that is allowed and does not override your rights.

Location data

Location is an important part of discovering guides and attractions on the map. We request location permission and use it to show your position, nearby guides, and geotagged places.

You can refuse or later revoke location access in your device settings. Map and nearby-guide features will then be limited. Guides can hide their location from other users in profile settings.

Precise location is personal data. We do not sell it, and we do not use it for third-party advertising.

Photos, videos, and other content you post

If you upload photos or videos, they are stored on our servers so they can be shown in SAYYAH (profile, feed, attractions, and highlights). Public posts, attractions, and profile photos may be visible to other users of the Application.

You remain responsible for the content you publish and for having the rights to it. Content must comply with our End-User License Agreement and with Saudi law, including Islamic values and public-morality standards and the Anti-Cyber Crime Law. We may remove content and suspend or terminate accounts that violate these rules, without prior notice where appropriate.

When we share personal data

We share personal data only as needed to operate SAYYAH or as required by law:

Other SAYYAH users. Your profile name and photo, public posts and attractions, and — only after a guide approves a request — that guide's phone number with the requesting tourist.

Service providers (processors) who help us run the Application, under arrangements appropriate to the PDPL:

• Google (Google Maps and Places for maps and place search; Firebase Cloud Messaging for push notifications; Firebase Dynamic Links for sharing).

• Hosting and infrastructure for sayyah.fast-prog.com.

• Communications providers used to deliver one-time passwords by email and WhatsApp.

Competent authorities in the Kingdom of Saudi Arabia when required by law, including CST/CITC and other regulators, as described in our End-User License Agreement.

We do not sell your personal data. We do not share it with advertisers for their marketing.

Transfers outside the Kingdom

Some processors — in particular Google and Firebase — may store or process data on servers outside the Kingdom of Saudi Arabia.

Where we transfer personal data outside the Kingdom, we do so in accordance with the PDPL, including by using an adequate jurisdiction, appropriate safeguards, or another lawful transfer mechanism, and only as needed to provide the Application.

How long we keep your data

Account and profile data are kept for as long as your account remains active.

User-generated content remains published until you delete it or we remove it under our End-User License Agreement or the law.

OTP codes are kept only as long as needed to complete verification.

Server logs are kept for a limited operational and security period, unless a longer period is required by law or an investigation.

After you delete your account, we delete or anonymize personal data that is no longer needed, except where Saudi law requires us to retain it (for example, for legal claims or regulatory requests). Residual copies in encrypted backups may persist for a short rotation period.

Security

We use reasonable technical and organizational measures appropriate to the nature of the data, including encrypted transport (HTTPS), access controls on our systems, and hashing of passwords on the server.

No method of transmission or storage is completely secure. Please choose a strong unique password and do not share it with anyone. Notify us promptly at info@fast-prog.com if you believe your account has been compromised.

Your rights

Subject to the PDPL and its Implementing Regulation, you may:

Request access to your personal data.

Request correction of inaccurate or incomplete personal data.

Request destruction of your personal data when the collection purpose has ended, you withdraw consent (where consent is the basis), or the processing is unlawful, subject to legal exceptions.

Withdraw consent for optional processing (location, camera, notifications) without affecting the lawfulness of earlier processing.

Lodge a complaint with SDAIA, the competent authority for the PDPL in the Kingdom of Saudi Arabia.

You can update much of your profile in the Application and delete your account from profile settings. For other requests, email info@fast-prog.com. We may need to verify your identity before fulfilling a request, and we may refuse or limit a request where the PDPL allows us to do so.

Children

SAYYAH is intended for users who have legal capacity to enter into a binding agreement under the laws of the Kingdom of Saudi Arabia (generally 18 years of age). We do not knowingly collect personal data from children.

If you believe a child has provided us with personal data, contact info@fast-prog.com and we will take appropriate steps to delete it.

Device permissions

Depending on your device, SAYYAH may ask for:

Location — maps, nearby guides, and geotagged attractions.

Camera — capturing photos and videos to post.

Photo library / storage — choosing existing media to upload.

Notifications — likes, comments, follows, and phone-number requests.

You can deny or later revoke these permissions in your system settings. You can still browse much of the public content; posting media, using maps, and receiving push alerts require the relevant permission.

Cookies and local storage

Our public website may store a language-preference cookie so we can show Arabic or English. The mobile application stores session tokens and preferences on the device so you can stay signed in and keep your settings.

We do not use third-party advertising cookies.

Changes to this Policy

We may update this Policy to reflect changes in SAYYAH or in the law. The current version is always published at this page, and the "Last updated" date will change.

If a change is material, we may also notify you in the Application. Continued use after the effective date means you accept the updated Policy, except where the law requires a new consent.

Contact and governing law

For privacy questions or data-subject requests:

Fast-Prog

Email: info@fast-prog.com

Address: 2829 Abi Al Futuh La Khabbaz, Al Yarmuk, 8004, Riyadh 13251, Kingdom of Saudi Arabia

This Policy is governed by the laws of the Kingdom of Saudi Arabia. Any dispute arising from it shall be subject to the exclusive jurisdiction of the courts of the Kingdom of Saudi Arabia.