Privacy Policy

1. Who is responsible

• For dashboard users (our customers' staff), Lafta is the controller.
• For end users of our customers' apps, the customer is the controller and Lafta is a processor acting on the customer's instructions. Questions or requests from end users should go to the app that sent the message; we help our customers answer them.

2. What we collect

From dashboard users:

• name of the organization, email address, password (stored only as a one-way hash), role, two-factor settings;
• records of important actions in the account (for example changes to keys, team members and campaigns) for security.

About end users, sent by our customers' apps through our SDKs and API:

• an anonymous identifier generated in the app, and the customer's own user id if the customer provides it;
• device data needed to deliver messages: push token, platform, app version, language and time zone;
• events and attributes the customer chooses to send (for example "purchase" or "city"), and consent choices;
• message history: what was sent, delivered, opened or clicked, and when.

3. Why we use it

We do not sell personal data and we do not use end-user data for our own advertising.

• to provide the service: deliver messages, apply the customer's rules, and show reports;
• to secure the service, prevent abuse and fix problems;
• to bill our customers and meet legal obligations;
• to send dashboard users service messages (verification, password reset, invitations, important changes).

4. Where the data is kept and who receives it

• Data is stored on servers in the Kingdom of Saudi Arabia ([hosting provider and region]).
• To deliver a notification, its content and the device token pass through the push service of the device's maker: Google (Firebase Cloud Messaging), Apple (Apple Push Notification service) or the browser's push service. These services may process the data outside the Kingdom. We rely on this transfer only as far as needed to deliver the message, under the conditions of the PDPL and its transfer regulations.
• Our email provider ([provider]) for service emails to dashboard users.
• Authorities, when the law requires it.

5. How long we keep it

• Events and message history: for the retention period of the customer's plan (for example 30 days on the Free plan), then deleted automatically.
• Account data: while the account is open, and for up to [90] days after closure (and longer where the law requires, such as invoices).
• When a customer deletes an end user through the API, that person's data is deleted at once from the live system.

6. Security

We use encryption in transit (TLS) and at rest, encrypt customers' push credentials separately, keep each customer's data isolated at the database level, require strong passwords and offer two-factor authentication. We will notify the competent authority (SDAIA) and affected customers of a personal data breach within the periods the law requires.

7. Your rights

Under the PDPL you have the right to be informed, to access your data, to obtain a copy, to correct it, and to ask for its deletion, and you can withdraw consent at any time. Dashboard users can write to us at privacy@getlafta.com. End users should contact the app that holds their data; we will help it respond. You may also complain to the Saudi Data and AI Authority (SDAIA).

8. Cookies and local storage

The Lafta dashboard uses your browser's local storage only to keep you signed in and remember your language and theme. We do not use advertising or tracking cookies. Our web SDK stores an anonymous identifier and unsent events in the browser of the customer's site.

9. Children

The dashboard is for businesses and not for children. Customers whose apps target children are responsible for any guardian consent the law requires.

10. Changes

We will post any change here with its date, and tell customers of material changes in advance.

11. Contact

Data protection contact: privacy@getlafta.com. [Company legal name], a company registered in the Kingdom of Saudi Arabia under commercial registration no. [CR number], with its address at [address].