Privacy Policy

The YallaNow app (YallaNow.APP) and yallanow.app — an ordering and delivery platform in Riyadh, Saudi Arabia

Last updated: 2 November 2026

Our principles

• We identify the purpose of collecting any personal information before or at the time we collect it.
• We collect and use it only for that purpose and compatible purposes, unless you consent or the law requires otherwise.
• We keep it only as long as needed for that purpose.
• We collect it by lawful and fair means, with your knowledge or consent where appropriate.
• It is relevant to the purpose and, to the extent needed, accurate, complete and up to date.
• We protect it with reasonable security safeguards against loss, theft and unauthorised access, disclosure, copying, use or modification.

1. Who is responsible for your data

The controller is Qimmat Al-Mawad Trading Company (شركة قمة المواد التجارية), operator of the YallaNow platform. Privacy contact: info@material.sa. Restaurants and stores on the platform are independent businesses and receive what they need to prepare your order (section 6).

2. What we collect and why

• Account data — name, mobile number, email, password (stored hashed), app language: to create your account and contact you about orders. A mobile number verified by SMS code is required before your first order.
• Sign in with Apple / Google — the account identifier, name and email (possibly an Apple private-relay address): to sign you in.
• Delivery addresses — city, district, street, building, a precise map pin and notes for the driver: to deliver and to calculate distance and delivery fee.
• Device location — only when you tap the locate button and grant permission, to show nearby stores. No background location.
• Orders — items, add-ons, amounts and VAT, payment method, the recipient name, phone and address as entered on the order, kitchen notes, coupons, your rating and comment: to fulfil orders, invoice, support you and settle with stores.
• Wallet and loyalty points — balance, points and their history.
• Order chat — text, photos you choose from your library and voice notes (microphone), to talk to your driver. Deleted after 7 days, attachments included.
• Support tickets — subject, description and replies.
• Push token and notification preferences — order updates, and offers unless you turn them off.
• Security data — IP address and device/browser type at sign-in and when actions are performed: account protection, fraud prevention and an audit log.
• Crash and performance reports — device model, OS and error details, without your name or number.
• Purchase summary we compute from your orders (number of orders, spend, favourite store, district and items, expected next order): for customer service and relevant offers.
• Customer-service notes our team writes about your contacts with us.

We do not collect your contacts or files, any photo or recording you did not send yourself, background location, or card data. The app contains no advertising or marketing-analytics SDKs and no advertising ID. We never sell or rent your data.

3. How we use it

To fulfil and track your order; to run and secure your account (SMS verification, preventing fake orders and fraud); for customer support; to fix crashes and improve the service; and to send offers based on your past orders and district — turn these off any time: menu “More” (⋮) → “Notification settings” → “Offers and discounts”.

4. Payments

Payment is currently cash on delivery only. If we add online payment, card details will be entered directly on the licensed payment provider's page and we will not store your card number or CVV; we will update this policy first.

5. Sign-in

Mobile number + SMS code, email + password, Sign in with Apple (iPhone) or Google (Android). From Apple and Google we receive only the identifier, name and email.

6. Who we share it with

• The store you ordered from — your name, contact number, order details and notes.
• Your assigned driver — your name, number, delivery address, pin and chat, during delivery.
• Technical service providers acting for us, under contracts that require them to protect your data and not use it for their own purposes: app hosting and database (Frankfurt, Germany); website, images, chat attachments and backups (global network); push notifications (United States/global); maps — address picking, district name and driver tracking, which receive the pin location and your IP (global/Europe); app crash monitoring, without your name or number (Germany); SMS verification codes (Saudi Arabia); account emails (United States); card payments through a licensed payment provider — we never receive your card details (Saudi Arabia).
• Competent authorities — only under a binding legal request.

7. Transfers outside Saudi Arabia

Your data is stored on servers in Germany and some providers above operate outside the Kingdom. We transfer only what is needed to provide the service, over encrypted connections, as permitted by the Personal Data Protection Law and its regulations.

8. Retention

• Account data and the addresses saved in it — while your account exists; deleted when you delete it (the address on each past order stays on it — see the order record below).
• Order chat (text, photos, voice) — 7 days; immediately if you delete your account.
• Driver route during your delivery — 30 days.
• Activity/audit log — 3 years; your name, IP and device are erased from it when you delete your account.
• Database backups — 30 days, rolling.
• Sign-in sessions — expire after 30 days of inactivity; removed on sign-out everywhere or account deletion.
• The record of your past orders — including the phone number, delivery address and location on them — with invoices and wallet transactions: for as long as necessary for accounting and legal record-keeping, handling complaints and disputes, and preventing fraud and promotion abuse; kept after account deletion without your name (section 9).
• Purchase summary and customer-service notes — while your account exists; deleted with it and not rebuilt.
• Support tickets — kept as a service record; on account deletion what you wrote and your name are erased from them.
• Crash reports — a limited period at our crash-monitoring provider.

9. Deleting your account

In the app: Home → “More” (⋮) → “Delete account” → “Delete my account”. Or contact us via the account deletion page. (Not possible while your order is still on its way to you — wait for it to arrive or contact support. An order held for re-delivery is cancelled with the deletion under the usual cancellation rules, with the usual refunds.)

• Erased immediately: your name (on your account, your past orders and our records — it becomes “حساب محذوف” / Deleted account), your email, password and mobile number from your account, your Apple/Google link (we also revoke the Apple link), the addresses saved in your account, push tokens, sessions, favourite stores, your cart and your notification inbox.
• Also erased: your order chats with drivers (photos and voice notes included), your notes on orders and items and your rating comments, what you wrote in support tickets, your purchase summary and customer-service notes about you.
• Forfeited: wallet balance and loyalty points.
• Your name is erased from every text in your records: cancellation and refund reasons, our team's notes on your orders, support replies, the descriptions of your wallet and points movements, and refund approval requests.
• Kept: the record of your past orders as recorded — amounts, VAT, items, dates, the order number, and the phone number, delivery address and location — with their invoices, under “حساب محذوف” (Deleted account), for the purposes above. Your order receipts keep their amounts and your number, without your name.
• Activity log: your name, IP address and device are erased — from what you did and from what our team did on your account and orders; what was done and when stays.
• What we erase leaves our backups within 30 days.

10. Your rights

Under the Saudi Personal Data Protection Law you may access and obtain a copy of your data, correct it, request its deletion, withdraw consent (location and notifications in your device settings; offers in “Notification settings”), and complain to the Saudi Data & AI Authority (SDAIA). Email info@material.sa; we reply within 30 days.

11. Children

The service is intended for people aged 18 and over. We do not knowingly collect data from anyone younger and will delete such an account if we learn of it.

12. Security

All traffic is encrypted (HTTPS); passwords are hashed and verification codes are not stored in plain text; staff access is limited and administrative changes are logged. We protect your data in line with the controls of the Saudi Data & AI Authority (SDAIA) and the National Cybersecurity Authority. No system is perfectly secure — if a breach affects your data we will notify the competent authority within 72 hours of becoming aware of it, and notify you without delay if it may harm you, explaining what happened and the measures taken.

13. yallanow.app and cookies

Store pages on our website may set two cookies to measure ad campaigns: lx_attr (visit source, 30 days) and lx_vid (random visitor ID, 1 year). A store may enable Meta, TikTok, Snapchat, X or Google Analytics tags on its page, governed by those companies' policies. The mobile app contains none of these.

14. Changes

We update this policy when the app changes and will notify you in the app before any material change takes effect.