Privacy Policy
Version 1.1 — effective 2 October 2026 (supersedes version 1.0 of 29 August 2026)
Last updated: 2 October 2026 — referral programme added to sections 4 and 5.
This policy describes exactly what the Fixora apps and platforms collect, why, who we share it with, how long we keep it, and how you control it. It was written to match what the system actually does — not as a generic template.
1. Who we are
Fixora is a Saudi platform connecting customers with home-service providers, stores and delivery partners. The data controller is Khat Al Wosool Trading Company, the legal operator of the platform.
This policy covers the customer app, the service-provider app, and the web platforms on the
fixora.sh domain.
2. What we collect
We collect only what the service needs to function. We do not sell your data, and we do not use it for targeted advertising.
Information you provide
| Data | Who provides it | Required? |
|---|---|---|
| First and last name | Everyone | Yes |
| Email address | Everyone | Yes — it is how you sign in |
| Mobile number | Everyone | Yes |
| Address and city | Everyone | Yes, to fulfil an order |
| Preferred language | Everyone | No (defaults to Arabic) |
| Business name, national ID or Iqama number, nationality | Service providers | Yes — for eligibility and verification |
| Commercial registration number | Stores and business clients | Yes |
| Bank account details (IBAN) | Providers and stores | Yes, to receive payouts |
Information created by using the service
- Orders: problem description, attached photos, invoices, amounts, order status and timestamps.
- Messages: text, voice notes and images exchanged between you and the other party to an order.
- Ratings and reviews you write or that are written about you.
- Wallet and financial records: balances, transactions, commissions, payouts.
Location
- Customer app: we use your location while you are using the app to set the service address, show nearby providers, and track a provider on the way to you.
- Provider app: we use your location to route nearby orders to you and to let the customer track you during an active order.
- You can decline or withdraw the location permission at any time in your device settings. The app still works, but you will need to enter addresses manually, and — as a provider — you may stop receiving distance-based dispatch.
Device and diagnostic data
- A push-notification token (FCM) so we can alert you about orders.
- A device identifier, OS type and app version — for account protection and troubleshooting.
- Crash and error reports.
3. Why we collect it
| Purpose | Legal basis |
|---|---|
| Creating your account and signing you in | Performance of our contract |
| Matching your order to a suitable nearby provider and fulfilling it | Performance of our contract |
| Issuing invoices, collecting payment, paying out providers | Contract + legal obligation |
| Retaining tax invoices as required by ZATCA | Legal obligation |
| Verifying provider identity before approval | Legitimate interest — user safety |
| Detecting fraud and abuse, protecting accounts | Legitimate interest |
| Support and answering your questions | Performance of our contract |
| Improving the service and fixing faults | Legitimate interest |
4. Who we share it with
We share the minimum necessary, and only with the following:
The other parties to your transaction
- When a provider accepts your order they see your first name, mobile number, service address, problem description and attached photos — they cannot do the job without them.
- The customer sees the provider's name, trade, rating, contact number, and location while en route.
- The supervisor assigned to the order can review its details for follow-up and dispute resolution.
Referral programme
- If you signed up with an invitation code, the referrer sees a short name for you (first name and the first letter of the family name), your stage in the programme, the number of your completed orders, and the reward they earned from them.
- The invitation page shows only the referrer's first name.
- We do not disclose to either of you the other's mobile number, email, full name or order details — see section 14 of the Terms & Conditions.
Authorities
We disclose data to competent government or judicial authorities where legally compelled, or where necessary to protect people's safety or our legal rights.
5. How long we keep it
- Account data: for as long as your account exists.
- Orders, invoices and financial records: retained after account deletion for at least six years, to comply with Saudi invoicing and tax regulations. They are separated from your identity on deletion (see below).
- Referral data: for the length of the referral period, then as long as the financial and accounting records above require.
- Messages: for as long as the related order is retained.
- Crash reports: up to 90 days.
6. Your rights and deleting your account
Under the Saudi Personal Data Protection Law (PDPL) you have the right to:
- Access your data and obtain a copy of it.
- Correct inaccurate data — most of it is editable directly from your profile screen.
- Delete your account and personal data.
- Object to specific processing, or withdraw your consent.
- Complain to the competent authority if you believe we have not complied.
- Customer app: Settings → Delete account
- Provider app: My account → Delete account
On deletion, identifying personal data (name, email, mobile, address, ID number) is removed and the account is permanently deactivated. Financial and order records remain, separated from your identity, for the statutory period above — an obligation we cannot override. The action is irreversible.
If you cannot access the app, contact us at the address below and we will delete your account within 30 days.
7. Children
The platform is not directed at anyone under 18 and we do not knowingly collect their data. If we learn of a minor's account we delete it. If you are a parent and believe your child created an account, contact us and we will act immediately.
8. Security
- All traffic between our apps and servers is encrypted with TLS.
- Passwords are hashed, never stored in plain text, and cannot be read by anyone here.
- Access to production data is limited to a small number of staff on a need-to-know basis.
- Verification codes expire within minutes, and accounts lock temporarily after repeated failed attempts.
No system is 100% secure. If a breach materially affects your data, we will notify you and the competent authority as required by law.
9. Changes to this policy
We may update this policy. We record the policy version you accepted against your account, and we will notify you in the app before any material change takes effect. Continuing to use the platform after that date constitutes acceptance of the updated version.
10. Contact us
- Email: info@fixora.sh
- In-app support: the help icon on any screen
We respond within 30 days at the latest.