Privacy policy

What we collect

When you create an account we collect your name and email address. We use the email to send you a one-time sign-in code; there is no password. A phone number is optional and we hold it only if you add it to your profile. For each child you add, we collect their first name, grade and school, so the canteen can match a purchase to the right wallet.

When you use the wallet we record top ups, purchases and refunds: the amount, the time, the child's name and the canteen. We also keep device tokens so we can send notifications, and basic technical logs to keep the service secure.

What we never collect

We do not collect or store biometric data. Palm templates are created and kept only on the school reader system in Saudi Arabia, and the parent app never receives them. We do not collect a child's surname, national ID, photo or location.

We do not store full card numbers. Payments are processed by licensed providers, and we only receive a confirmation and a masked reference.

How we use it

To run the wallet: approve purchases within the limits you set, keep balances accurate and show you activity. To notify you of purchases, top ups, low balance and declined attempts. To support you when you contact us. To keep the service secure and to meet legal obligations.

We do not sell personal data and we do not use it for advertising.

Who we share it with

Your child's school and its canteen see the child's first name, grade, palm enrollment status and the purchases made at that canteen. Licensed payment providers process your top ups. Infrastructure providers host our service under contracts that protect your data. We share data with authorities only when the law requires it.

Your rights under the PDPL

Under the Saudi Personal Data Protection Law you have the right to know what we hold about you, to access and correct it, to request deletion, and to withdraw consent where processing is based on consent. Write to privacy requests at the address below and we will respond within the period the law sets.

Where data is stored and for how long

Account, wallet and transaction data is stored in Saudi Arabia. We keep it for as long as your account is active. Transaction records are kept after deletion only where financial regulations require it, and then removed.

Deleting your account

You can delete your account at any time from the app, under Settings, Delete account. This removes your profile, your children's profiles and device tokens. Any remaining wallet balance is refunded through the school canteen before deletion.

Payments

During the pilot, wallet top ups are made at the school and recorded in the app. When in-app top ups launch after the pilot, they will be processed by a payment provider licensed in Saudi Arabia (Moyasar); card details are entered directly with the provider and never pass through our servers.

Children

The app is for parents and guardians. Children do not create accounts, do not log in and do not see the app. A child's data is added and controlled only by their parent.

Changes and contact

If we change this policy in a meaningful way we will tell you in the app before the change takes effect. Questions and privacy requests: privacy@rahapay.app or support@rahapay.app.