Privacy Policy
Last updated: May 2025
Effective date: May 2025
Madyra ("we", "us", or "our") operates the Madyra mobile application and website (the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you use our Service. Please read it carefully. By using the Service you consent to the practices described in this Policy.
1. Information We Collect
1.1 Information You Provide Directly
• Phone number — required for account creation, authentication, and account recovery • Email address — optional, used for support communications • Restaurant suggestions — restaurant name and location you submit to us, if any
1.2 Information Collected Automatically
• Approximate or precise location — used to show partner restaurants near you on the map • Device identifiers (device model, OS version) — used for app functionality and debugging • App usage data — used to improve the Service and detect abuse • IP address — used for security monitoring and abuse prevention
1.3 Information from Restaurant Partners
• Listing details provided by partner restaurants (name, brand, cuisine type, location, contact) — used to show partner restaurants to users
2. How We Use Your Information
We use your personal data solely for the following purposes: • To verify your identity and authenticate your account • To show you partner restaurants near your location • To enable account recovery via your registered phone number • To detect, investigate, and prevent fraudulent or abusive activity • To respond to support requests and communicate service-related information • To comply with applicable Saudi Arabian laws and regulations We do not use your data for advertising, profiling, or sale to third parties.
3. Data Retention
We retain personal data only as long as necessary for the stated purpose or as required by law: • Phone number: Stored as an irreversible one-way cryptographic hash — the original number cannot be recovered from the stored value • Location data: Retained only as needed to show nearby restaurants, then discarded • Device & usage data: Retained for 90 days for abuse detection, then deleted • Email address: Retained until you request deletion or close your account • Restaurant partner data: Retained for the duration of the partnership and for a reasonable period after termination for record-keeping
4. How We Protect Your Information
We implement industry-standard technical and organisational security measures: • All data in transit is encrypted using TLS 1.2 or higher (HTTPS) • Phone numbers are stored only as one-way cryptographic hashes (no plain-text storage) • Access to systems containing personal data is restricted to authorised processes only • We conduct regular security reviews of our infrastructure
5. Sharing of Your Information
We do not sell, rent, or trade your personal data. We share data only in the following limited circumstances: • Legal compliance: We may disclose data when required by Saudi law, court order, or regulatory authority • Business transfers: In the event of a merger or acquisition, your data may transfer to the successor entity under the same protections as this Policy In all cases, third parties are contractually required to process your data only for the stated purpose and in compliance with applicable law.
6. Your Rights Under Saudi PDPL
Under Saudi Arabia's Personal Data Protection Law (PDPL), you have the following rights: • Right of Access — Request a copy of the personal data we hold about you • Right of Correction — Request correction of inaccurate or incomplete data • Right of Deletion — Request deletion of your personal data, subject to mandatory legal retention periods • Right to Withdraw Consent — Withdraw consent for processing where consent is the legal basis • Right to Data Portability — Request your data in a structured, machine-readable format • Right to Object — Object to processing in certain circumstances To exercise any of these rights, submit a written request to support@madyra.com. We will acknowledge your request within 5 business days and respond in full within 30 days. We may request verification of your identity before processing sensitive requests.
7. Account and Data Deletion
You may request deletion of your account and all associated personal data at any time by contacting support@madyra.com. Upon verified request: • Your account will be deactivated immediately • Phone hash, email, and device data will be permanently deleted within 30 days • You will receive email confirmation once deletion is complete
8. Children's Privacy
The Service is not directed to individuals under the age of 18. We do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data, please contact us at support@madyra.com and we will delete it promptly.
9. No Social Login
Madyra does not use Google Sign-In, Apple Sign-In, or any third-party social login mechanism. Your phone number is the sole method of account authentication and is never stored in plain text.
10. Third-Party Services
The Service does not integrate third-party analytics, advertising SDKs, or tracking tools. Any future integration of third-party services will be disclosed in an updated version of this Policy prior to deployment.
11. Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will notify you via the app or email at least 14 days before the changes take effect. The updated Policy will always be available at madyra.com/privacy. Continued use of the Service after the effective date constitutes acceptance of the updated Policy.
12. Contact & Data Controller
If you have questions about this Privacy Policy or wish to exercise your data rights, contact us: Madyra Email: support@madyra.com Website: madyra.com We are committed to resolving any privacy concerns promptly and transparently.