1. About this policy

This policy explains how Fadaa Al Raqmiya Establishment (مؤسسة فضاء الرقمية), the owner of the atHome brand, collects, uses, keeps and discloses personal data through the atHome app and the provider portal. It forms part of the Terms and Conditions.

• It applies to users, service providers and their team members, and to anyone who contacts us.

• Data is processed under the Personal Data Protection Law of Saudi Arabia and its implementing regulations.

• Data a service provider enters in the portal about their own clients and staff is processed by atHome on the provider's behalf and instructions; the provider answers to those people for it, as section 13 sets out.

2. The data we collect

• From the user: name, mobile number, email, location and the address where the service is performed, order details and history, conversations with the service provider, reviews, and answers to the forms a provider asks for before booking, such as a health condition or allergy if you disclose one.

• Payment data: processed by a licensed payment gateway. We never store the full card number; we keep the transaction reference, the card type and its last four digits.

• From the service provider: business and owner name, mobile number, city and district, bank account and IBAN, VAT status and number, a copy of the commercial registration, freelance certificate or national ID, the Instagram account, and photos of the business and team.

• From a provider's team members: name, mobile number and role, and whatever the provider records about them in the portal.

• From the device and usage: device type, operating system and push notification identifier, IP address, sign-in logs, and actions in the portal, including the activity log that records who did what and when.

• From gifts: the recipient's name and mobile number, and the message attached.

3. Why we use it

• Running an order from booking to completion: sending it to the provider, locating the address, messaging, payment and invoicing.

• Verifying a provider's identity, documents and bank account before approval, and paying out what they are owed.

• Sending the notifications and text messages that concern orders, the account and support.

• Support, complaints and dispute resolution, including reading conversations when needed to keep service quality.

• Preventing fraud and misuse, keeping the platform secure, and meeting legal obligations.

• Improving the platform and its statistics using aggregated data that identifies no one.

• Marketing messages with your consent, which you can stop at any time from the account settings or the link in the message.

4. Legal basis

• Performing the contract between you and atHome: booking, payment, settlements and support.

• Your consent: location, notifications, marketing messages, and answers to health forms.

• Legal obligations: e-invoicing, financial records, and requests from the competent authorities.

• Legitimate interest: platform security, fraud prevention and service improvement, without overriding your rights.

5. Location

• The app asks for location permission to set the service address and show nearby providers. You can type the address instead, or turn the permission off in the device settings, and still book with a written address.

• The service location is shared with the provider and the assigned driver only as far as the order needs.

• Either side can share a location in the order's conversation; it is kept with the conversation record.

6. Who we share it with

• The service provider sees what the order needs of the user's data: name, mobile number, location, order details and form answers, and must keep it confidential and use it for nothing else.

• The user sees the provider's name, profile, photos and reviews, and the name of the assigned team member.

• A marketer whose referral code was used sees only the order number and its amount, never the user's name or any personal data.

• Service providers that process data on our behalf: payment gateways, the accounting system that issues invoices, the SMS provider, map services, cloud hosting and storage, and notification services, all bound to process it on our instructions and protect it.

• The competent authorities, on a formal request under the law.

• We do not sell or rent personal data to anyone.

• If ownership of the platform changes, the data passes to the new owner under the same obligations, and you are notified.

7. Storage and security

• Data may be stored and processed with providers inside or outside the Kingdom, and is transferred outside the Kingdom only under the transfer rules of the Personal Data Protection Law and its regulations.

• We apply reasonable safeguards: encryption in transit, access limited by permissions, the activity log, and sign-in by verification code.

• No security is absolute. Protect your phone and verification code, and tell us at once if you suspect unauthorised access.

• If a breach affects your data, we notify the competent authority and you as the law requires.

8. How long we keep it

• Account data is kept while the account exists. After deletion or termination it is deleted or anonymised within 30 days, except what the law requires us to keep.

• Invoices, financial records and transaction records are kept for the periods tax and commercial law require, even after the account closes.

• Conversations, form answers and reviews are kept with the order's record.

• Anonymised data that identifies no one may be kept indefinitely.

9. Your rights

• To access your data and get a copy of it.

• To correct or update it, most of it from inside the app or portal.

• To delete your account from inside the app or by email, save what the law requires us to keep.

• To withdraw consent to location, notifications or marketing messages, without affecting what was done before.

• To object to processing or ask that it be restricted where the law allows.

• We answer a request within 30 days of receiving it, and may verify your identity first.

• You may complain to the authority responsible for personal data protection in the Kingdom.

10. Minors

• The platform is for people aged 18 and over, and we do not knowingly collect data from anyone younger. If we learn of a minor's account we suspend it and delete its data; a guardian books for a minor from their own account and answers for the order.

11. Conversations and notifications

• The in-order conversation between user and provider is kept, and atHome may read it to keep service quality, resolve disputes and prevent deals outside the platform.

• Order and account notifications are needed to run the service; device notifications can be turned off in the device settings.

12. Browser storage in the portal

• The portal uses the browser's local storage to keep the session, language and preferences; it cannot work without them.

• We use no advertising cookies and no third-party tracking; any usage-measurement tool we add later will be named in this policy.

13. A provider's clients and team

• What a provider enters in the portal about their own clients, staff and suppliers is data the provider controls; atHome processes it on their behalf, only to run the portal.

• The provider must tell their clients and staff that their data is processed, get their consent where required, and answer their requests about it; atHome helps carry those out.

• The provider limits what each team member sees through permissions, and stops the access of anyone who leaves.

14. Changes to this policy

• We change this policy when needed, notify material changes in the app and portal 30 days before they take effect, and show the last-updated date at the top.

15. Data controller

• Fadaa Al Raqmiya Establishment (مؤسسة فضاء الرقمية), commercial registration 1010714754, Riyadh, Al Arid district, Asim bin Khalaf Street.

16. Contact

• For any question or request about your data: hello@athome.sa

Last updated: 8 September 2026

Fadaa Al Raqmiya Establishment, owner of the atHome brand

​