A named contact
Matthew Hanna is the operator and data controller for this pilot. Privacy requests go directly to the email below.
Privacy policy
Your privacy, clearly explained.
This privacy policy explains how Mahara’s current pilot website handles personal data, what can become public, and how to contact us about your information.
Last updated / version:
Pilot-stage notice
This notice describes the current setup. It is not a claim of full Saudi compliance or an opening of children’s services or payments. Transfer, retention, safeguarding and licensing reviews remain requirements before public launch.
No advertising trackers
The application does not include advertising pixels, behavioural analytics or session recording.
A controlled pilot
Payments, children’s services and public category launches need separate approvals. This policy is not a regulatory certification.
1. Who is responsible
Mahara is the service name used by Matthew Hanna, the data controller for this pilot. Contact: maharaksa26@gmail.com. No company registration, professional licence, Saudi hosting certification or appointed data protection officer is claimed by this notice.
This notice covers the Mahara website, account sign-in, provider application and listing tools, saved services, and the booking features described below when available. Separate notices are needed before adding payments, identity verification, marketing or new uses of personal data.
2. What we collect and why
| Activity | Information and purpose |
|---|---|
| Visiting and searching | Requested URLs and search/filter terms, IP address, browser/device information, timestamps and technical/security logs may be processed by our hosting and infrastructure providers to deliver and protect the site. You do not need an account to browse. |
| Signing in | Email address, account identifier, authentication provider, session information and chosen language. If you choose Google, Google may supply your name, email, profile image and provider identifiers. Not all of these are displayed by Mahara. We do not receive your Google password. |
| Provider applications and listings | Individual/business account choice, professional name, Riyadh service area, optional working languages, category, service name, price, delivery method, description, duration and availability. Applications also contain review status, decisions and notes. |
| Saved services and bookings | Your account and saved listing references. If booking is available: provider/listing, date/time, price, delivery method, brief, city, status history and related messages. No card payment is collected by the current checkout. |
| Reviews and support | Reviews you submit for completed bookings, relevant correspondence and information you choose to include in privacy/support requests. Authorised staff may access necessary records for review, security or assistance. |
Data comes from you, the sign-in provider you choose, your interaction with the site, the other participant in a booking, and authorised reviewers. Fields marked required are needed for the action concerned; optional fields may be left blank. If required data is not supplied, that action may not be available. Unsubmitted form text is held in the current page’s memory, not saved by Mahara as a browser draft.
3. Purposes and legal grounds
We use account and service details to provide the features you request, manage applications and bookings, and answer you. Where processing implements an agreement with you, that agreement is the relevant basis. Other processing requires a valid basis under Saudi law; publishing this notice alone does not create one.
Limited, non-sensitive processing for fraud prevention and network security may rely on a documented legitimate-interest assessment. A legal obligation may require particular records or disclosure. Optional processing that requires consent must have a separate, specific choice and a way to withdraw it. We do not treat browsing, accepting this privacy notice or requesting a sign-in link as consent to advertising, sensitive-data processing or unrelated purposes.
The pilot’s processing register, basis assessments and supplier arrangements still require completion and operator/legal review before public onboarding. We do not claim these have been independently approved.
4. What is public and who can see it
- A published provider profile/listing can show the professional name, biography, category, description, city/service area, languages, price, duration, available times and specific verification indicators. Public content may be indexed or copied by others.
- Submitted applications and internal reviewer notes are not public listings. Application acceptance does not automatically publish a service or verify a provider.
- Booking details and messages are available to the relevant customer and provider, including authorised provider-business members. They are not end-to-end encrypted. Authorised administrators and infrastructure providers may access records for necessary operations, review, support or legal duties.
- A submitted review and its rating may be public. Do not include private contact details or information about another person in a review, profile or listing.
- We may disclose the minimum necessary information where lawfully required by an authority, to protect rights or investigate misuse. We do not sell personal data or share it for behavioural advertising.
5. Infrastructure and other services
| Service | Role |
|---|---|
| Vercel | Website delivery, server execution and operational/security logs. Requests and application data necessary for these operations may pass through Vercel. |
| Supabase | Account authentication, sessions, database storage and access controls for the marketplace. |
| Resend | Delivery of requested authentication emails, including recipient, subject, email content and delivery events. These emails contain sensitive, single-use sign-in links; do not share them. |
| Google — optional sign-in and contact email | If you choose Google sign-in, it authenticates your account and shares the identity information you authorise. Gmail also hosts our privacy-contact inbox: emailing us involves Google's handling of that correspondence under its own policy. Do not email sensitive details. |
Suppliers may use subprocessors and process operational data under their own applicable terms. Fonts are served from Mahara’s deployment, not requested from Google Fonts by your browser. Choosing an external link or Google sign-in takes you to a separate service.
6. Processing outside Saudi Arabia
Mahara does not currently promise Saudi-only storage or processing. Vercel uses an international delivery network and this deployment’s server region is in the United States. Authentication, database, email, supplier support and subprocessors may also involve processing outside the Kingdom; their complete country/region inventory has not yet been verified for launch.
Before opening to customers, the operator must verify destinations, supplier contracts, transfer necessity, applicable safeguards and any required risk assessments under the Saudi transfer rules. A Saudi website domain or a statement in this policy does not make those transfers compliant. Do not submit sensitive information during this pilot.
7. Storage, retention and deletion
Marketplace records are stored in Supabase; request/runtime logs and authentication-email records are also handled by the infrastructure providers above. Data is kept for its stated purpose, account administration, necessary security and resolution of requests or disputes, or a specific legal retention requirement. Retention must not be extended merely because storage is available.
The pilot does not yet have an automated, comprehensive deletion schedule or a self-service account-deletion/export button. Contact us for a manual request. We must check linked application, booking, message and audit records before deleting or anonymising data, and explain any lawful exception rather than promising immediate deletion of everything.
Account closure, record deletion, supplier-log expiry and backup expiry are different operations. Signing out or clearing cookies does not delete your account or database records. Exact supplier log/backup periods and a tested retention/destruction schedule remain launch requirements; no fixed deletion deadline for those systems is claimed here.
8. Your rights and how to ask
Subject to applicable legal conditions, you may ask to be informed about processing, access your data and obtain a readable copy, correct or complete it, request destruction when no longer needed, and withdraw consent for consent-based processing. Withdrawal does not undo lawful processing already carried out or remove a separate legal obligation.
Email maharaksa26@gmail.com with “Privacy request”, the account email concerned and the action requested. Do not attach an identity document, password, authenticator code, sign-in link or details about a child. We will use proportionate identity checks and explain if more information is necessary. Requests are handled manually, not through an automated download or deletion service.
We will respond without undue delay and normally within 30 days. If a legally permitted extension of up to a further 30 days is needed, we will tell you before the first period ends and explain why. If a request cannot be fulfilled, we will explain the applicable reason. You may also raise a personal-data complaint with SDAIA through its official data-governance platform.
9. Parents, children and tutoring
Accounts and communications are intended to be managed by adults aged 18 or over. Children must not create accounts or communicate independently with providers on this pilot. The intended future tutoring journey is parent/legal-guardian managed, not a child-account service.
Children’s booking and personal-data collection are not open during this pilot. Do not enter a child’s name, birth date, photograph, school, contact details, recordings or health information. Before enabling such services, we need a reviewed safeguarding process, proportionate guardian-authority checks, a specific privacy notice and any required documented guardian consent. A checkbox or the existence of a tutoring category alone is not verification of guardianship.
If a child has supplied data, contact the privacy email with the minimum information needed to identify the record. Do not resend the child’s sensitive details by email.
10. Sensitive information and payments
Do not submit identity-document images, bank/card details, health records, religious beliefs, denomination or other sensitive personal information in profiles, applications, briefs, reviews or messages. Quran/Islamic-studies category or booking information may itself reveal sensitive information; removing a “religion” field does not remove that risk. Such services remain subject to category-specific privacy and legal approval.
The current application has no live payment processor, identity-document upload or identity-partner integration. It may store booking amounts and internal payment-status records, not card numbers or CVVs. We will provide separate information before activating a payment or verification partner. Do not pay someone on the assumption that Mahara currently provides escrow, insurance or a payment guarantee.
11. Security and incidents
The application uses HTTPS, account authentication, access checks and private-record restrictions. Administrator access has extra authentication requirements. These measures reduce risk; no website is guaranteed free of vulnerabilities, and this notice is not an audit certificate.
Keep sign-in emails and authenticator secrets private, use a device lock, and sign out on shared devices. Report a suspected account or data incident to the privacy email without sending access tokens or unnecessary personal data. We will assess the incident and notify affected people and the competent authority when required. Internal incident-response and recovery procedures still require operational testing before launch.
12. Changes, choices and questions
The version and update date appear at the top of this page. Material changes to data uses will be explained before they apply, and separate consent will be requested when legally required. The Arabic and English notices describe the same pilot; please contact us if you identify a discrepancy. Applicable Saudi law prevails over any incompatible wording.
Read the cookie policy for storage names, purposes, expiry and browser controls. For questions or complaints about this notice, contact Matthew Hanna at maharaksa26@gmail.com.