Privacy Policy

1. Our commitment

Rukkab exists to move young women safely. The data we hold about you — where you live, where you study, when you travel, and the route you take — is data about your movements and your routine. We treat it accordingly.

This Policy explains what we collect, why, who we share it with, how long we keep it, and what rights you have. It is written to comply with the Personal Data Protection Law of the Kingdom of Saudi Arabia (PDPL) and its Implementing Regulations.

Two commitments are worth stating at the outset, because they are choices we made rather than obligations imposed on us:

• We do not sell your personal data. Not to advertisers, not to data brokers, not to anyone.
• We do not give your parents or guardians access to your travel history. See Section 7.

2. Data Controller

The controller of your personal data is:

Althiqa Alzarqa Company Commercial Registration No. 7050867733 Riyadh, Kingdom of Saudi Arabia

Data protection contact: support@rukkab.app

DECIDED 2026-09-25 — no DPO is appointed. See the ratification record at the foot of this document; the line above is a contact, not an appointed officer.

3. Who this Policy applies to

This Policy applies to:

• Riders — the students who use our service; and
• Drivers — the captains contracted to drive Rukkab routes, whose personal data we process as described in section 4.4.

Where a section speaks only of Riders or only of Drivers, it says so. Everything else applies to both.

Rukkab is available only to individuals aged eighteen (18) or over. We do not knowingly collect personal data from anyone under 18. If we become aware that we hold personal data of a person under 18, we will delete it and terminate the associated account.

4. What we collect

4.1 Information you give us

4.2 Information we generate or collect automatically

4.4 Drivers

We process the following from Drivers. It is collected through the Rukkab Driver app and through the onboarding we carry out before a Driver may drive a route.

A Driver's location. Location is requested only when a Trip is in progress and stops when the Trip ends. The app does not request background location and cannot collect your position while it is closed. During a Trip your position is shared with the Riders booked on that Trip and with Rukkab safety staff — this is the same feed a Rider sees as "your bus is 4 minutes away".

Drivers see no financial data in the Driver app. Earnings, payouts and fares are not shown there. Payment to a Driver's employing transport company is handled outside the app.

4.3 A note on location

We collect the location of the vehicle during a Trip. This is necessary to run the service.

For Riders, we do not track your personal device at all — the rider app requests no device location. For Drivers, we do not continuously track your personal device outside of a Trip. We do not build a picture of your movements when you are not travelling with us.

Your home or pickup address is collected as a fixed data point for route planning — not as a live location feed.

5. Why we process your data, and on what legal basis

Under PDPL we must have a lawful basis for each purpose.

Where we rely on consent, you may withdraw it at any time (Section 10). Withdrawing consent does not affect processing carried out before the withdrawal.

6. Who we share your data with

We share the minimum necessary in each case.

6.1 Transport Suppliers and Drivers. Your Driver needs to know who to collect, from where, and when. We share your first name, pickup point, destination, and scheduled time. We do not share your national ID, your payment details, your full address history, or your academic records with a Driver.

6.2 Payment processor. Payment card details are collected and processed directly by our payment processor. Rukkab does not store your full card number.

6.3 Technology service providers. We use third-party providers for database hosting, application hosting, workflow orchestration, messaging and notification delivery, error monitoring, and customer support. These providers process data on our instructions and are bound by contract to protect it. See Section 9 on international transfers.

6.4 Educational institutions. Where an institution is a party to the arrangement, we may confirm enrolment status. We do not report your individual travel patterns, attendance, or punctuality to your institution.

6.5 Regulators and authorities. We may disclose data where required by law, by a court, or by a competent authority such as the TGA or ZATCA.

6.6 In an emergency. Where there is a serious and imminent risk to your safety or the safety of another person, we may disclose data to emergency services or law enforcement.

6.7 We do not sell your personal data, and we do not share it with advertisers.

7. Parents and guardians

Rukkab is used by adults. We treat you as one.

7.1 We do not provide parents or guardians with access to your travel history, your routes, your past trips, or your location outside of a trip you have chosen to share.

7.2 Live trip sharing is yours to control. If you choose to share a live trip — with a parent, a friend, a flatmate, anyone — you initiate it, you choose the recipient, and it ends when the trip ends. It is a feature you use, not a permission granted over you.

7.3 We will not create an account for a parent or guardian, and we will not act on a request from a parent or guardian to disclose your data, except where we are required to do so by law.

8. How long we keep your data

We keep your data only as long as we need it, or as long as the law makes us.

The last two are not our choice. Saudi tax and commercial law sets them, and they apply even if you ask us to delete your data. Where that happens, we delete everything we are allowed to delete and keep only what the law requires us to keep — and we stop using it for anything else.

After a period ends, the data is deleted, or anonymised so thoroughly that it can no longer be connected to you.

9. International transfers

We want to be straightforward with you about this, because it concerns where your data physically sits.

Rukkab is a Saudi company, operating in the Kingdom, serving students in the Kingdom. However, some of the technology providers we rely on — for database hosting, application hosting, workflow orchestration, route optimisation, notification delivery, error monitoring, and customer support — process data on servers located outside the Kingdom of Saudi Arabia.

This is common for software of this kind, but we would rather tell you plainly than leave it unsaid.

Where your personal data is transferred outside the Kingdom, we:

• transfer only what is necessary for the provider to perform its function;
• bind every provider by contract to protect your data and to process it only on our instructions;
• require security standards consistent with those described in Section 11;
• do not permit any provider to use your data for its own purposes.

PDPL restricts the transfer of personal data outside the Kingdom and permits it only in defined circumstances and subject to defined safeguards. We keep our arrangements under review to ensure they remain consistent with those requirements.

Financial records. Separately from PDPL, Saudi tax law requires that VAT and accounting records be kept within the Kingdom, or on a system that the Zakat, Tax and Customs Authority can access on request, and be maintained in Arabic. We maintain our financial records accordingly.

If you have questions about where your data is processed, contact us at support@rukkab.app.

10. Your rights

Under PDPL you have the right to:

(a) Be informed — to know what data we hold, why, and who we share it with. This Policy is part of how we meet that obligation.

(b) Access — to obtain a copy of your personal data.

(c) Request correction — to have inaccurate or incomplete data corrected.

(d) Request destruction — to have your personal data deleted, where we no longer need it for the purpose it was collected for, and where we are not required by law to keep it.

(e) Withdraw consent — where our processing is based on your consent, you may withdraw it at any time.

To exercise any of these rights, contact us at support@rukkab.app.

We will respond within the period required by PDPL. We may need to verify your identity before acting on a request — this is a protection for you, not an obstacle.

If you are not satisfied with our response, you have the right to complain to the Saudi Data & Artificial Intelligence Authority (SDAIA).

11. Security

We protect your data with measures including:

• encryption of data in transit and at rest;
• strict access controls, so that our staff and our suppliers can see only what they need to see;
• an immutable audit trail of access to sensitive records;
• secrets management, so that credentials are never stored in application code;
• monitoring and alerting for anomalous access;
• contractual security obligations on every provider that touches your data.

No system is perfectly secure. If a breach occurs that is likely to cause you harm, we will notify you and the competent authority as required by PDPL.

12. Cookies and similar technologies

Our website does not use cookies at all.

We use no analytics, no tracking tools, and no third-party scripts on the site.

The site uses a single item of session storage in your browser, whose only purpose is to remember whether you have already seen the opening animation in this session, so it is not repeated. It:

• is necessary for the site to work as intended;
• contains no personal data;
• is never sent to our servers or to anyone else;
• is erased automatically when you close the browser tab.

Because the site sets no non-essential cookie, no cookie consent mechanism is required. If that ever changes, we will update this section and provide the necessary consent mechanism before enabling any such tool.

13. Changes to this Policy

We may update this Policy. Where a change is material, we will notify you before it takes effect. The date at the top of this Policy shows when it was last updated.

14. Contact us

Althiqa Alzarqa Company Commercial Registration No. 7050867733 Riyadh, Kingdom of Saudi Arabia

Privacy and data protection: support@rukkab.app General support: support@rukkab.app

You may also complain to the Saudi Data & Artificial Intelligence Authority (SDAIA).

15. Governing language

This Policy is published in English and Arabic. In the event of any conflict between the two, the Arabic version prevails.

Ratification record

Ratified by Anas (founder), 2026-09-25. This document is cleared for public publication. It replaces the review notice that stood here, which described this text as an unreviewed draft awaiting qualified Saudi counsel. That description is no longer the state of the document, and leaving it in place while the document is live and ratified would be the more misleading of the two.

🔴 Rukkab has no external counsel. The founder is the deciding authority, and ratification here means his clearance, not a lawyer's. That is recorded plainly rather than implied, because publication_status: ratified is defined in apps/landing/src/vite/legal-pages.ts as "cleared by counsel" and a reader is entitled to know which sense is meant.

Resolved before ratification:

1. The refund policy is decided — the four-case table is a locked founder ruling of 2026-08-21 and is published at /refund-policy. The former notice called it "currently a placeholder"; it has not been one since August.
2. Arabic and English are unified, and the Arabic governs. Where the two disagreed the English was levelled UP to the Arabic, never the reverse: the Arabic already carried a consumer-protection-authority recourse clause and a fuller entire-agreement clause that the English lacked. No clause was weakened or removed in either language, and every number, timeframe and amount was checked to match across the pair.
3. No unpopulated placeholder or contact field remains — verified by search; the only surviving mentions were the retired checklist's own items.

Decided, not deferred — no data protection officer is appointed. Founder decision, 2026-09-25: there is no DPO and none will be named at present. The policy's support@rukkab.app is a data-protection contact, and the document says so rather than implying an appointed officer. Stated because PDPL requires an appointment where core activities are regular and systematic monitoring, and continuous rider and vehicle tracking plausibly meets that — so this is a known choice, recorded as one. Naming a person is all that would be needed to change it.

Accepted risks — stated in three parts, because a risk recorded as a single sentence is how an exemption outlives the condition that justified it:

the risk	the variable it is conditional on	what re-checks it
The liability channelling structure and the liability cap may not be enforceable as written under Saudi law	whether a Saudi consumer-protection authority or court is asked to rule on them	🔴 NOTHING. No gate, no dated review, no owner. Recorded as an open gap rather than closed with an invented mechanism
Saudi consumer protection law may override provisions on refunds, limitation of liability and dispute resolution	the same — an authority or a complaint testing one of them	🔴 NOTHING, as above
The E-Commerce Law's 7-day withdrawal right may reach a transport subscription already begun with the rider's consent	whether a rider asserts it, or an authority reads it that way	🔴 NOTHING

These are accepted with the reasoning that Rukkab has no counsel to resolve them and the documents are already live; they are not resolved, and this table is the honest record of that. Engaging counsel discharges all three at once.