Privacy Policy

This Privacy Policy explains how Al-Azl Al-Haseen Contracting Est. (Commercial Registration No. 1010824507 — Unified No. 7030694488, Kingdom of Saudi Arabia), owner of the “Kashf” brand, the domain kashf.com.sa and the Kashf app on the App Store and Google Play (“Kashf”, “we”), collects, uses and protects personal data. We are the data controller under the Saudi Personal Data Protection Law (Royal Decree M/19) and its Implementing Regulations, and under the EU General Data Protection Regulation (GDPR) where it applies to visitors in the European Union.

1. Scope and the “Guest” principle

Neither the website nor the app requires an account or a password. You request a service as a guest using only your mobile number, which is the sole identifier linking your requests and the number we call to confirm your identity and appointment. We therefore treat your mobile number with the heightened protections described in section 6.

2. Data we collect

• Contact data: the name and mobile number you enter when sending a service request, and your email address if you choose to enter it yourself (optional; required only when you choose instalments, because the instalment provider sends the payment schedule to it). We never generate data on your behalf.
• Request data: the requested service and your answers to its questions, city, district, address, preferred time and notes.
• Location (optional): only when you tap “Locate me”, while using the app or site, to guide the technician. We never track customers’ location in the background (technician mode for Kashf technicians: section 5-a).
• Photos (optional): only the photos you take or choose of the problem area. Metadata (EXIF, including GPS) is stripped automatically on upload, and photos are visible to our technical team only through a signed, unguessable link.
• Payment data: if you choose to pay the inspection fee online (mada, Apple Pay or cards), the transaction happens entirely on the licensed payment gateway’s pages. Your card details never pass through or are stored on our servers. We keep only the gateway’s transaction reference, amount, currency (SAR), status (paid/refunded) and the method type (e.g. “mada”, “Apple Pay”) for accounting.
• Push token (optional): if you enable notifications, Apple or Google issues a random device token that we link only to your requests to send status updates. It is never used for marketing and is deleted when you disable notifications or uninstall the app.
• Limited technical data: OS type and app version, browser type, IP address and a random device identifier generated by the app or browser, for the security purposes in section 7.
• Advertising click identifiers: if you arrived through a Google ad, the link may carry a click ID (e.g. gclid). We keep it with your request solely to measure the ad under section 6.

We do not collect data about other people, do not read your contacts, messages or files, and do not use any cross-app or cross-site tracking tools.

3. Purposes and legal bases

Purpose	Legal basis
Fulfilling your request, confirming the appointment, dispatching the technician, invoicing	Performance of a contract
Collecting the inspection fee and supplementary invoice; proof of payment and refunds	Contract and legal obligations (tax and accounting law)
Showing request status when you track by request number and mobile	Contract
Push notifications about your request	Your consent (enabling notifications)
Security, preventing fake requests and invalid ad clicks	Our legitimate interest in protecting the service and ad budget, balanced against your rights
Measuring advertising conversions	Your explicit consent via the cookie banner (website); the Kashf app does not track you across other apps and websites and sends no advertising identifier
Responding to your rights requests	Legal obligation

4. Sharing with third parties

We never sell, rent or trade your data. It is shared only as needed with:

• Our technicians: the assigned technician sees your name, mobile, address and problem photos.
• Licensed payment and instalment providers: online payments are processed by the gateway (e.g. Stripe, or Moyasar for mada and Apple Pay) and, if you choose instalments, by the instalment provider (Tabby or Tamara). These are PCI DSS compliant and licensed by the Saudi Central Bank or their home regulator. We send the gateway the amount, currency, service description and request number; the instalment provider additionally receives your name, mobile number, the email you entered and your city, because the instalment assessment is performed by them under their own policy. They return only the result.
• Notification services: Apple Push Notification Service and Firebase Cloud Messaging; a notification contains only a short title and status text.
• Advertising platforms (Google Ads): only as described in section 6 and only with your consent.
• WhatsApp: if you choose “Send via WhatsApp”, the WhatsApp app opens on your device with your request details; the conversation is then governed by WhatsApp’s privacy policy.
• AI provider (only when enabled from the control panel): on the “Smart Preliminary Diagnosis” page, your selected symptoms and short description — and photos if you attach any — are sent through our server to the connected AI provider (Claude by Anthropic, ChatGPT by OpenAI, or Gemini by Google) to produce the preliminary estimate; photos are processed in memory and never stored, and the page asks for no name, phone number or account. In the in-chat “Smart Assistant”, conversation messages are sent to the same provider to draft the automated reply, and the assistant discloses that it is automated from the first message. We never send these providers your account data or order history.
• Authorities: where a law, court order or competent authority requires disclosure.

Hosting and gateway providers may process data outside Saudi Arabia under appropriate contractual safeguards and to the extent permitted by law.

5. App permissions

• Location: for customers only when you tap “Locate me”, while using the app (technician mode: section 5-a).
• Camera: only when you tap “Camera” to photograph the problem.
• Photos: the system picker opens and you choose the photos yourself.
• Notifications: only when you tap “Enable notifications”.
• No tracking permission: The Kashf app does not track you across other apps and websites and sends no advertising identifier, so it does not ask for the iOS App Tracking Transparency permission.

All permissions are optional, the full request can be sent without them, and each can be revoked at any time in your device settings.

5-a. Technician mode (Kashf technicians with an account only)

The Kashf app includes a mode for Kashf technicians whose sign-in account is provided by their account administrator. Customers do not see this mode. Only while it is used:

• Location during an active task: used to check in at the work site and to track the route to the customer, from task acceptance to closure within working hours, after the technician’s explicit in-app consent. This may continue in the background during that task only, with a visible notification on Android and the blue indicator on iPhone. Location is never collected outside the task.
• Microphone / audio input: the connected leak-detection sensor (or the phone microphone) is analysed on the technician’s device while the detection screen is open. Nothing is recorded in the background, and no audio is uploaded unless the technician turns on “save raw recording” for a specific case.
• Fingerprint / Face ID: used for attendance and quick sign-in. The device verifies locally; face or fingerprint data never reaches us, and only a digital signature is sent.
• Device compatibility report: phone model and audio capabilities, used to tune the audio engine.
• Inspection results: photos, thermal images and notes the technician saves for a case.

This data is kept to perform the work and manage the team, and is never used for advertising. Technicians can delete their account in Technician mode → Account → Delete account.

6. Advertising measurement and how we protect your data before sending it to ad platforms

We advertise on Google Ads. To learn whether an ad led to a real request (a “conversion”), we send statistical signals to Google under the following rules:

(a) Consent first. On the website a cookie banner appears before any advertising measurement is activated; choosing “Necessary only” keeps every site function working and sends no personal identifier to any ad platform. The Kashf app on iPhone, iPad and Android does not track you across other apps and websites and sends no advertising identifier, so it shows no tracking prompt.

(b) SHA-256 hashing before transmission. With your consent, we never send your raw mobile number to Google. It is first normalised to international (E.164) format and then hashed on our servers with SHA-256, a one-way function that cannot be reversed to recover the number. Only the hash is sent, following Google’s official Enhanced Conversions procedure, and Google compares it with its own identically hashed records solely for statistical measurement. We do not send your name, address, photos or request details.

(c) Timing and content. The conversion signal is sent after the event (booking or payment) with a delay, carries the true event time, the conversion type (call, WhatsApp chat, pay-on-service booking, online-paid booking) and the inspection fee value in SAR, and nothing else.

(d) Retention. Hashed conversion records are deleted from our database within 90 days of sending.

You can withdraw consent at any time via the cookie banner on the website, and manage ad personalisation in your Google Ads Settings.

7. Security and abuse prevention

• All data is transmitted over HTTPS (TLS) and stored on secured servers with role-based access; sensitive access is logged.
• Credentials for payment gateways and ad platforms are stored encrypted with AES-256-GCM using a key kept separate from the database.
• To protect the service and our ad budget from automated or abusive clicks and requests, we count contact-button clicks per device within a short time window using a non-reversible hashed fingerprint (HMAC-SHA256 with a periodically rotated secret) and do not store raw IP addresses for ordinary visitors. If a device clearly exceeds normal limits, we may store its IP address encrypted for a limited time and may add it to our Google Ads IP exclusion list (an official Google feature) so that our ad is temporarily not shown to it. This never changes website content or blocks anyone from browsing, and it lapses automatically 48 hours after the abnormal activity stops.
• Links to request photos and payment pages are signed, randomly generated and excluded from search engines.

8. Retention

• Request and contact data: for the duration of the service and warranty, then deleted or anonymised within 24 months of the last completed request, unless you ask for deletion earlier.
• Payment records and invoices: as required by Saudi tax and accounting law (up to ten years), limited to necessary accounting data.
• Photos: deleted with the request or on your request.
• Push tokens: until notifications are disabled or the app is uninstalled.
• Security logs and hashed fingerprints: 90 days maximum.
• Hashed conversion records: 90 days.

9. Your rights

Under the Saudi PDPL, and under the GDPR if you reside in the EU, you may: access and obtain a copy of your data; rectify inaccurate data; request erasure (except records we must keep by law, such as financial records); object to or restrict processing based on legitimate interest; withdraw consent at any time without affecting prior processing; receive your data in a machine-readable format where applicable; and lodge a complaint with the Saudi Data & AI Authority (SDAIA) or your local data protection authority.

You can request deletion directly in the app (Settings → Delete my data), on the data deletion page, or by emailing support@kashf.com.sa. We act within 30 days and may verify your identity by calling the registered mobile number.

10. Cookies

The website uses strictly necessary cookies (e.g. remembering your consent choice and protecting forms) which need no consent. Advertising measurement cookies (Google Ads / Google Analytics) are activated only after your explicit consent, which you can change at any time via “Cookie settings” in the site footer or your browser settings.

11. Minors

The site and app are intended for adults (18+) requesting property services. We do not knowingly collect data from minors and will delete it promptly if we learn it was collected without parental consent.

Optional “My account” and sign-in

Ordering does not require an account. If you create a “My account”, we process your mobile number or email, your password stored as a non-reversible hash, and sign-in records (date, IP address, device type) for security and fraud prevention. Verification codes are sent through our approved SMS or email provider and we do not keep their text. We verify your mobile with a code before showing your orders and documents. You can sign out devices or delete your account at any time from “My account” on the website and in the app (with a request to delete your linked data); we keep only what the law requires, such as tax invoices and accounting records. Partners who register with a CR / unified number or national ID / iqama have the number stored encrypted and shown masked.

12. Changes

We may update this policy as our services or the law change. The date at the top shows the latest version; material changes are announced in the site and app.

13. Contact

Al-Azl Al-Haseen Contracting Est. — “Kashf”
CR No. 1010824507 — Unified No. 7030694488 — Kingdom of Saudi Arabia
Email: support@kashf.com.sa — Phone/WhatsApp: +966 54 402 7180
Website: kashf.com.sa