Your Privacy, Our Responsibility

When you create an AHAAR account, place an order, or contact our support team, we collect: • Account data: your full name, email address, phone number, and password (stored as a salted hash — never in plain text). • Delivery information: your delivery address(es), building access notes, and preferred time windows. • Payment data: tokenised card details processed by our PCI-DSS certified payment provider. AHAAR never stores raw card numbers on its servers. • Dietary preferences and health goals: the dietary track you select, any allergens you declare, calorie targets, and meal preferences. This data is used exclusively to personalise your menu and is never sold to third parties. • Communications: messages you send to our support team via email, WhatsApp, or in-app chat.

When you use the AHAAR website or mobile app, we automatically collect: • Device and browser data: IP address, browser type and version, operating system, screen resolution, and device identifiers. • Usage data: pages visited, features used, time spent, click paths, and session duration. • Location data: approximate location derived from your IP address for city-level delivery eligibility checks. We request precise GPS location only if you use the live-tracking delivery feature, and only with your explicit permission. • Cookies and similar technologies: see Section 8 (Cookies) for full details.

We may receive information about you from: • Payment processors (e.g. Checkout.com, STC Pay) confirming transaction status. • Social login providers (Google, Apple) when you choose to sign in with those accounts — we receive only your name and email address, never your social media password. • Marketing partners, where you have consented to data sharing with those partners independently.

We use your data to: • Prepare and deliver your meals accurately and on time. • Process payments and issue invoices. • Manage your subscription, including pauses, skips, and plan changes. • Personalise your menu based on your dietary preferences and order history. • Provide customer support and resolve disputes.

We analyse aggregated, anonymised usage data to: • Optimise delivery routes and reduce wait times. • Identify popular menu items and retire underperforming recipes. • Improve the app and website user experience. • Train our internal kitchen and logistics teams. This analysis uses data that cannot be used to identify you individually.

If you opt in, we may send you: • Weekly menu previews and seasonal offers by email or push notification. • Personalised recommendations based on your order history. • Surveys and feedback requests. You can opt out of marketing communications at any time via the Unsubscribe link in any email, or under Account → Notifications in the app. Opting out of marketing does not affect transactional messages (order confirmations, delivery notifications).

We process data when required to: • Comply with Saudi Food & Drug Authority regulations and mandatory food traceability requirements. • Respond to lawful requests from Saudi government authorities. • Detect, investigate, and prevent fraud, abuse, and security incidents.

AHAAR does not sell, rent, or trade your personal information to any third party for their own marketing purposes. This is an absolute policy, not qualified by any legal exceptions.

We share data with trusted third-party providers who process it exclusively on our behalf under strict contractual obligations: • Logistics partners: delivery address and contact number to coordinate your delivery. • Cloud infrastructure: Amazon Web Services (Frankfurt and Bahrain regions) for data storage and application hosting. • Payment processors: Checkout.com and STC Pay for transaction processing. • Communications platforms: Twilio for SMS delivery notifications; SendGrid for transactional email. • Analytics: Mixpanel (anonymised, aggregated data only) for product analytics.

We may disclose your data to law enforcement or regulatory authorities when required by Saudi law, court order, or to protect the safety of AHAAR users or the public. We will notify you of any such request where legally permitted to do so.

We implement industry-standard security measures including: • TLS 1.3 encryption for all data in transit. • AES-256 encryption for sensitive data at rest (passwords, payment tokens, health information). • Multi-factor authentication enforced for all AHAAR staff accessing production systems. • Regular third-party penetration testing (at minimum annually) and continuous vulnerability scanning. • Role-based access controls ensuring staff can only access the data necessary for their role.

In the event of a data breach that poses a risk to your rights and freedoms, we will notify you and the relevant Saudi regulatory authority within 72 hours of becoming aware of the incident, in accordance with the Saudi Personal Data Protection Law (PDPL).

• Active account data: retained for the duration of your account. • Order and transaction records: retained for 5 years for tax and regulatory compliance, per Saudi ZATCA requirements. • Marketing preferences: retained until you withdraw consent. • Support communications: retained for 2 years from the date of resolution. • Anonymised analytics data: retained indefinitely (it cannot be linked back to you). When you delete your account, all personally identifiable information is purged within 30 days. Anonymised and aggregated records may remain in our analytics systems.

Under the Saudi Personal Data Protection Law, you have the right to: • Access: request a copy of the personal data we hold about you. • Correction: ask us to correct inaccurate or incomplete data. • Deletion: request erasure of your data, subject to our legal retention obligations. • Portability: receive your data in a structured, machine-readable format. • Objection: object to processing based on legitimate interests or for direct marketing. • Withdrawal of consent: withdraw consent at any time where processing is consent-based. To exercise any of these rights, email privacy@ahaar.sa with the subject line "Data Rights Request". We will respond within 30 days. If you are unsatisfied with our response, you may escalate to the Saudi Data and AI Authority (SDAIA).

• Essential cookies: necessary for the website and app to function (session management, cart persistence, authentication). Cannot be disabled. • Analytics cookies: help us understand how users navigate our platform. Anonymised and aggregated. You can opt out via our cookie banner. • Marketing cookies: used to show you relevant AHAAR advertising on third-party platforms (e.g. Instagram, Google). Only placed with your explicit consent. You can manage your cookie preferences at any time via the Cookie Settings link in the footer. Note that disabling non-essential cookies will not affect your ability to use AHAAR's core service.

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. When we make material changes, we will: • Display a prominent notice on the AHAAR website and app for at least 30 days. • Send an email notification to all registered account holders. • Update the "Last Updated" date at the top of this page. Continued use of AHAAR after the effective date of a revised policy constitutes acceptance of the revised terms.