Privacy policy

SAAML Operations runs this delivery service. This policy explains what personal data we collect when you use our website and app, why we use it, who we share it with, how long we keep it, and your rights under Saudi Arabia's Personal Data Protection Law (PDPL).

Who is responsible for your data

SAAML Operations decides why and how your personal data is processed, and is responsible for it.

• Commercial registration: 1231223321
• Email: ali.a1@saaml.com
• Phone: 966501941143

Our service runs on a platform provided by SAAML. SAAML stores and processes your data for us and on our instructions, except where a Saudi law obliges SAAML itself to disclose it.

What we collect

• Your account: your name and mobile number. If you sign in with Google, we collect the name, email address and Google account ID that Google shares with us.
• Your shipments: sender and receiver names, mobile numbers and national addresses, the locations you pick on the map, parcel details, cash-on-delivery amounts, delivery status and proof of delivery.
• Your saved contacts: the sender and receiver of each shipment you book, which we save so you can use them again. You can delete them.
• Payments: wallet top-ups, charges, refunds, receipts and tax invoices, the proof of transfer you upload when you pay an invoice, and the IP address and browser you pay from. You enter card details on our payment provider's page.
• The shipment assistant: what you type or say to it when you use it, and the booking details it reads out of that: the sender, the receiver, their addresses and phone numbers, and the shipment itself.
• Your device: the app's notification token and phone type, your language and app version. Our website uses cookies to keep you signed in, protect your forms and remember your language.
• Support: the messages you send us.

To open an account we need your name and your mobile number, or a Google sign-in. To book a shipment we need the sender's and receiver's names, mobile numbers and national addresses and the parcel details, and to pay by card we need your email address. Without these we cannot provide the service. Allowing notifications or location on your phone is up to you.

Why we use it

• To create your account and sign you in with a one-time verification code we send to your mobile.
• To price, book, carry and track your shipments, and to contact you and the receiver about them.
• To take payments, run your wallet, pay out cash collected on delivery, and issue receipts and tax invoices.
• To answer your questions and complaints.
• To keep the service secure and prevent fraud.
• To meet our legal duties, such as tax, commercial record-keeping and postal rules, and to answer lawful requests from authorities.

We use your data because we need it to provide the service you asked for, or because a law requires it. We also rely on our legitimate interests, where they do not override the rights of the people concerned, to keep the service secure, prevent fraud, and use the details of the other people on your shipments to carry them. We will not later use your data in a way that does not fit these purposes, except where the PDPL allows it. We send you marketing messages only with your consent, and you can withdraw it at any time.

Who we share it with

• Captains and delivery partners who pick up and deliver your shipments see the names, mobile numbers and addresses on them.
• Anyone who has a shipment's waybill number or tracking link can follow its status.
• SAAML, which runs the platform for us.
• Companies that provide a service to us: SMS delivery of sign-in codes (Unifonic), email delivery of booking confirmations, payments (EdfaPay), maps, address search and website fonts (Google), national address lookup (Saudi Post), and app notifications (Google Firebase). The AI model behind the shipment assistant (Anthropic) reads the messages you send to it. Google may also use the data it receives for maps and address search under its own privacy policy, our payment provider has legal duties of its own, and some of these companies process data outside Saudi Arabia.
• Government authorities, when a law requires it: for example, trip reports to the Transport General Authority (through its WASL system), tax invoices reported to the Zakat, Tax and Customs Authority (ZATCA), reports of parcels suspected of holding prohibited items, and answers to lawful requests from competent authorities.

We do not sell your personal data.

How long we keep it

If a record is needed for a case before a court or other judicial authority, we keep it until the proceedings end. When a period ends, we must destroy the data or remove everything that identifies you.

Deleting your account

You can delete your account on our website, from your profile. You can do it once all your shipments are finished (delivered, returned, cancelled or failed), you have no unpaid invoices or wallet debt, no wallet top-up is still being processed, and any cash collected for you on delivery has been paid out to you.

• If your account has no shipments, payments or other records linked to it, we delete it completely.
• If it has, we close it and delete your sign-in details, saved contacts and device data. We keep your shipments, receipts, invoices and wallet history for the periods above, because the law requires it, and your name, mobile number and email stay on those records. You will no longer see them in the app, even if you sign up again with the same number, but you can still ask us for a copy.
• If we already had a customer record for you before you signed up, we keep that record.
• Any wallet credit stays on record, and you can ask us to refund it.

Your rights

Under the PDPL you can:

• know how we collect and use your data, which this policy explains;
• see the data we hold about you and get a copy;
• ask us to correct it;
• ask us to delete it once we no longer need it, unless a law requires us to keep it for a set period or it is needed for a case before a court or other judicial authority;
• withdraw any consent you gave.

To use these rights, email us at ali.a1@saaml.com. We act on your request within 30 days. If it needs unusual effort, or you send us several requests, we may take up to 30 more days, and we will tell you in advance, with the reason. You can also complain to the Saudi Data and AI Authority (SDAIA) within 90 days of the incident or of when you learned of it, for example if you are not satisfied with our answer or we do not reply in time.

Keeping your data safe

We protect your data with technical and organisational measures. If a breach puts your data at risk, we report it to SDAIA, and tell you when the law requires it.

Changes to this policy

When we change this policy, we update the date at the top. If we want to use your data for a new purpose, we will tell you before we do, and ask for your consent where the law requires it.