Your privacy matters as much as your beauty.

1. Who We Are and the Data Controller

Malmahi is operated by the Saudi establishment legally registered as صالون ملمحي الرقمية للتزيين النسائي under Unified National Number 7055134568. The establishment is the controller of personal data processed to operate the Platform unless stated otherwise.

Brand and Platform

Malmahi ملمحي

Legal entity

صالون ملمحي الرقمية للتزيين النسائي

Entity type

Saudi establishment

Unified National Number

7055134568

Email

support@malmahi.app

Telephone

+966 55 866 9774

National Address

Short Address GCJA3513, Building 3513, Al Saeed Street, Abu Al Tuyur District, Abu Al Tuyur, Postal Code 85375, Additional Number 6137, Saudi Arabia

2. Scope of this Policy

This Policy applies to customers, beauty experts, applicants, visitors, and other users of the website and both mobile applications. It covers data collected when you create an account, browse services, make or fulfil a booking, communicate, pay, use location and safety features, or contact support.

3. Personal Data We Collect

Depending on your role and use of the Platform, we may collect:

• Identity, account, and contact data, such as your name, mobile number, email address, profile image, preferred language, encrypted password, verification code, and login records.
• Expert profile and professional verification data, such as experience, qualifications, specialities, portfolio images, service areas, working hours, ratings, and identity, eligibility, regulatory, or professional documents required by law or the Platform.
• Booking and service data, such as the service type, time, location, requirements, price, travel fee, order status, booking parties, acceptance, cancellation or rescheduling history, ratings, and complaints.
• Location data, including approximate or precise location and background location when permission is enabled, to show nearby services, calculate distance and travel fees, guide the expert, track the service journey, and support safety and emergency features.
• Payment and transaction data, such as order value, currency, payment or refund status, transaction identifier, and limited settlement details. Malmahi does not ordinarily store full card details where these are processed by an authorised payment provider.
• Communication data, including text messages and, where the relevant features are enabled and used, voice messages, photographs, and attachments connected with a booking or support request.
• Technical data, such as IP address, device type, operating system, application and device identifiers, app version, time zone, language, and activity, performance, crash, and security logs.
• Support and safety data, such as ticket and complaint content, attachments, recorded calls where notice has been provided, and booking, location, and communication information required when the SOS feature is used or an incident is reported.
• Cookies and similar measurement data on the website, such as language and session preferences, security data, performance data, and analytics, subject to the choices made available to you.

Please do not submit personal data that we do not need. Do not share identity documents, bank details, health information, or other sensitive data in chats unless Malmahi requests it through a dedicated secure channel for a clear and lawful purpose.

4. Sources of Personal Data

We may obtain personal data from:

• Information you provide directly when registering, booking, creating an Expert profile, or contacting support.
• Your use of the website, applications, and device, including enabled permissions for location, notifications, camera, media, and microphone.
• The other party to a booking when she provides information necessary to perform a service, submits a rating, or makes a complaint.
• Payment, mapping, messaging, verification, hosting, analytics, app store, and other service providers, to the extent necessary to provide the service.
• Publicly available sources or official authorities where collection is lawful and necessary for verification or compliance.

5. Why We Process Personal Data

We process personal data to:

• Create, verify, manage, and secure accounts.
• Display services, prices, appointment times, and available Experts, and fulfil bookings and custom service requests.
• Match customers with nearby and available Experts and determine service coverage, distance, and travel fees.
• Enable necessary communication between the booking parties and provide order updates.
• Process payments, refunds, settlements, and Expert earnings, and prevent fraud.
• Verify Expert eligibility, documents, professional requirements, and payment-provider requirements.
• Operate safety features and SOS functions, investigate reports, and respond to incidents.
• Provide customer support, resolve disputes and complaints, and improve service quality.
• Personalise the experience, analyse use, measure performance, repair faults, and develop the Platform.
• Send operational notifications and, where legally permitted, marketing communications, with an option to opt out of marketing.
• Comply with applicable laws and official requests and protect the legal rights and interests of Malmahi and its users.

6. Legal Bases for Processing

Depending on the processing activity, Malmahi relies on one or more lawful bases: your consent; entering into or performing a contract with you or taking steps at your request before entering into it; compliance with a legal obligation; a legitimate interest of Malmahi or another party that does not override your rights and interests; or protection of a vital interest in an emergency. Where consent is the sole legal basis, you may withdraw it without affecting processing lawfully carried out before withdrawal.

7. Matching Ranking and Automated Processing

The Platform may use automated processes to rank results, broadcast requests, or recommend Experts based on factors such as location, service range, availability, service type, rating, and performance history. Customers remain free to choose an Expert where that feature is available, and Experts remain free to accept or reject a request in accordance with Platform rules. If automated processing is used to make a decision with a significant effect, Malmahi will apply the safeguards and rights required by applicable law.

8. How We Share Personal Data

We may share the minimum personal data necessary with:

• The Customer or Expert connected with a booking, including name, image, rating, service details, contact details, or location to the extent necessary to fulfil the request.
• Technology providers, including payment, mapping, cloud hosting, SMS, email, push notification, analytics, support, verification, and cybersecurity providers.
• Tap Payments or another authorised provider for payment processing, financial verification, and settlement of Expert earnings.
• Governmental, judicial, regulatory, law-enforcement, police, or emergency authorities where required by law or official request, or where necessary to protect safety or rights, prevent crime, or respond to an SOS report.
• Professional advisers, auditors, insurers, and other professional bodies where necessary to protect rights, resolve disputes, or comply with obligations.
• A party acquiring or merging with all or part of Malmahi's business, subject to appropriate legal safeguards.

Malmahi does not sell your personal data to third parties.

9. Expert Profiles and Content Visible to Customers

An Expert profile may display the Expert's name or professional name, image, biography, services, prices, service areas, availability, portfolio, ratings, and professional information selected by the Expert or approved by Malmahi. Home addresses, official identity details, bank account information, and confidential documents are not displayed publicly. Experts must ensure they have the right to publish any image or content added to their profiles.

10. Payments and Tap Verification

Customers or Experts may provide certain payment or verification data directly to Tap Payments or another payment provider. The provider processes that data under its own notices and policies. Malmahi may receive verification results, transaction status and identifiers, transaction value, and limited information required for accounting, support, and compliance, but does not ordinarily receive or store full card details.

11. Hosting Storage and International Transfers

Malmahi uses service providers inside or outside Saudi Arabia according to its approved technical architecture. This includes Amazon Web Services for parts of the cloud infrastructure and Hostinger for domain name, DNS, and official email services. Certain technical services may require personal data to be accessed, processed, or stored outside Saudi Arabia. Where this occurs, Malmahi will comply with the Saudi Personal Data Protection Law and its regulations and will apply the required legal, contractual, and technical safeguards, including transfer risk assessments where required and verification of the protection provided by the recipient.

12. Retention and Secure Disposal

Malmahi retains personal data for as long as necessary for the purpose for which it was collected, including account management, bookings, payments, complaints, safety, accounting and legal obligations, and the establishment or defence of legal rights. Retention periods vary according to the type of data, the relationship, and whether a dispute, incident, report, or legal obligation exists. When there is no longer a lawful or operational need, data is securely destroyed or anonymised so that it can no longer be linked to an identifiable person, unless continued retention is required by law or an official order. Backup copies may remain for a limited period under the applicable backup cycle before being automatically deleted or overwritten.

13. Data Security

Malmahi applies appropriate organisational, administrative, and technical measures to protect personal data against unlawful access, use, disclosure, alteration, loss, or destruction. Depending on the circumstances, these measures include access controls, encryption, log monitoring, backups, vulnerability management, provider due diligence, and need-to-know access for personnel. No electronic transmission or storage method is completely secure. You should protect your device, verification codes, and login details and notify us immediately of any unauthorised use.

14. Device Permissions

Depending on the feature you use, the application may request permission to access:

• Location, for matching, distance and travel-fee calculation, navigation, tracking, and safety.
• Camera, photos, and files, for profile images, Expert portfolios, booking attachments, and support requests.
• Microphone, to send a voice message where the feature is available and enabled.
• Notifications, for verification codes and booking, payment, safety, and permitted promotional updates.

You can manage permissions in your device settings. Disabling a permission that is essential to a feature may prevent that feature from working correctly.

15. Operational and Marketing Communications

Malmahi sends operational communications necessary for your account, bookings, payments, and safety. It may send offers or marketing communications where consent or another lawful basis exists. You may unsubscribe from marketing using the link or setting provided, without affecting essential operational communications.

16. Cookies

The website uses cookies and similar technologies to operate sessions, remember preferences, secure the service, measure performance, and understand use. You can manage non-essential cookies through available consent settings or your browser. Disabling essential cookies may prevent parts of the website from working.

17. Minors and the Women Only Nature of the Platform

Malmahi is a women-only services platform and is not intended for persons under 18 to create independent accounts. If a service is booked for a minor beneficiary, the booking must be made and managed by her female guardian or another responsible adult woman, with appropriate consent, supervision, legal compliance, and safety arrangements. If we learn that a minor's data has been collected without an appropriate basis, we will take steps to delete or restrict it.

18. Your Personal Data Rights

Subject to applicable legal exceptions, you have the right to:

• Be informed of the legal basis and purpose for collecting your data, how it is processed, and the parties to whom it may be disclosed.
• Access the personal data available to Malmahi about you.
• Request a copy of your personal data in a clear and readable format where provided by law.
• Request the correction, completion, or updating of your personal data.
• Request the destruction of your personal data where the legal conditions are met.
• Withdraw consent where consent is the legal basis for processing.
• Submit a complaint to Malmahi and then to the competent authority if the complaint is not resolved satisfactorily.

To exercise a right, email support@malmahi.app. We may request limited information to verify your identity and protect your data before acting on the request. We will respond within the period required by law. We may decline or restrict a request where legally permitted and will explain the reason where required.

19. Complaints and Enquiries

For privacy questions or complaints, contact us using the details below. We will record, review, and respond to the complaint in accordance with applicable requirements and time limits. If you are not satisfied with our response, you may complain to the Saudi Data and Artificial Intelligence Authority or another competent authority through its official channels.

20. Third Party Services and Links

The Platform may contain links or features provided by other organisations, including payment, mapping, and app store providers. Where those organisations act independently, their own privacy policies apply.

We recommend reviewing those policies. Malmahi is not responsible for practices outside its control, while remaining responsible for selecting and managing processors that act on its behalf as required by law.

21. Changes to this Privacy Policy

We may update this Policy when our services, practices, or legal requirements change. We will publish the updated version with a revised last-updated date and will provide additional notice through the Platform or registered contact details where a change is material or requires fresh consent.

22. Contact Us

For privacy requests, questions, and complaints:

Entity

The Saudi establishment legally registered as صالون ملمحي الرقمية للتزيين النسائي

Email

support@malmahi.app

Telephone

+966 55 866 9774

Address

Short Address GCJA3513, Building 3513, Al Saeed Street, Abu Al Tuyur District, Abu Al Tuyur, Postal Code 85375, Additional Number 6137, Saudi Arabia

23. Governing Language

This Policy is available in Arabic and English. If there is any inconsistency of interpretation, the Arabic version will prevail to the extent permitted by the laws of the Kingdom of Saudi Arabia.