Privacy Policy

Last updated: 8 September 2026

1. Scope and who we are

This Privacy Policy explains how Mahal Saleh (محل صالح) collects, uses, stores, and shares personal information when you use the Azhar Wasal / Azhar Tawseel (أزهر وصل) mobile app, website, delivery service, customer support, and related features (the “Service”).

2. Information we collect

• Account and contact information: Name, Saudi mobile number, email address, verification status, and saved delivery details.
• Order information: Products, quantities, custom item requests, substitutions, notes, prices, delivery fees, order status, support messages, reviews, and complaint details.
• Delivery and location information: Address, village or service area, map pin, and location shared during checkout or delivery. With permission, the app may use precise device location to help select or confirm the delivery point.
• Payment information: Selected payment method, payment status, transaction references, and bank-transfer proof you upload. Card or buy-now-pay-later credentials are processed by the relevant payment provider; we do not receive your complete card credentials.
• Verification information: Phone and email verification requests, delivery channel, masked destination, attempt and lockout records, timestamps, and provider references. We do not store plaintext phone verification codes.
• Device and technical information: Device type, operating system, app version, language, IP address, push-notification token, request logs, error details, and security or fraud signals.
• Communications: Messages and information you provide to customer support, drivers, or through order-related communication features.

3. How we use your information

• create and manage your account, including guest and verified account states;
• verify phone numbers and email addresses and protect sensitive account actions;
• accept, prepare, deliver, track, modify, cancel, and support orders;
• process payment choices, refunds, wallet points, offers, and payment confirmation;
• send essential OTP, order, delivery, security, and support communications;
• provide optional notifications and promotional communications where permitted;
• operate, troubleshoot, secure, analyze, and improve the Service and product catalog;
• prevent spam, fraud, abuse, unauthorized access, and unsafe activity; and
• comply with legal, accounting, tax, dispute-resolution, and regulatory obligations.

4. When we share information

We do not sell your personal information. We may share only what is reasonably necessary with delivery drivers; hosting, database, analytics, messaging, email, map, notification, and security providers; Authentica or another configured OTP provider; Tabby and other payment providers you select; professional advisers; and government or regulatory authorities where legally required. Providers process information under their own terms and privacy notices where applicable.

5. OTP, email, and payment providers

Your mobile number, selected language, delivery channel, and verification request are sent to the configured OTP provider to deliver and verify a code. Your email is sent to our email provider when you request email verification. If you choose Tabby, information required to assess and process that payment may be sent to Tabby, including contact, order, amount, and transaction information. Tabby’s approval decisions and services are governed by Tabby’s own terms and privacy policy.

6. Location and device permissions

Location, notification, camera, or photo permissions are used only for the feature you request, such as choosing a delivery point, receiving order updates, or uploading payment proof. You may manage permissions in your device settings, but disabling them may limit related features.

7. Retention

We retain personal information only for as long as reasonably needed for orders, account services, support, fraud prevention, legal compliance, accounting, disputes, and enforcement. OTP challenges expire after a short verification period, although limited delivery and security audit records may be retained. Retention periods may differ by record type and legal requirement. Information is deleted, anonymized, or securely restricted when no longer required.

8. Security

We use reasonable administrative, technical, and organizational safeguards, including access controls, limited credential exposure, verification controls, request limits, and monitoring. No internet or storage system is completely secure. Keep your device and verification codes secure and notify support if you suspect unauthorized activity.

9. Your choices and rights

Subject to applicable law, you may ask to access, correct, update, or delete personal information; withdraw optional consent; object to or restrict certain processing; or ask questions about retention and sharing. Some information may be retained where required for legal obligations, completed transactions, fraud prevention, or disputes. You can update available profile details and notification or permission choices in the app or device settings.

10. Children

The Service is intended for users who can legally place an order. A parent or legal guardian should supervise use by a minor and is responsible for orders placed through the minor’s device.

11. International processing

Some service providers may process information in other countries. Where required, we use reasonable contractual or legal safeguards for such processing.

12. Changes and contact

We may update this policy to reflect legal, security, or Service changes. The current version and update date will be published here. For privacy questions or requests, contact us using the phone, WhatsApp, or other support options shown in the app Settings. We may need to verify your identity before completing a request.