Privacy policy

• Version 0.1 (draft)
• Effective date: [set on legal approval]
• Last updated: 15 November 2026

This policy explains what personal data we process in the Farrah rider app and the Farrah Captain app, why, who receives it, how long it is kept, and your rights under the Personal Data Protection Law (PDPL) of Saudi Arabia. It is based on the privacy notices inside the two apps (rider notice version 1.3, captain notice version 1.4). If something in an app differs from this page, please tell us.

1. Who we are

n2a01 ([legal name, CR number and address]) is responsible for processing your data in Farrah. For anything about privacy, write to support@n2a01.com. Data protection officer: [not yet appointed].

2. What we collect from riders, and why

• Account details: name, mobile number and an optional email, to create and verify your account. The verification code reaches you by SMS.
• Locations during a trip: pickup, destination and the live trip route, to run the service and for your safety. The app asks for location only while you use it, and never asks for background location.
• Trip history: kept to show it to you and for regulatory obligations.
• Saved places and recent destinations: kept on our servers with your account, and included in a copy of your data. Only you see them, except that a saved place's landmark note is shown to your captain when that place is your pickup. You can delete a saved place at any time. Removing a recent destination hides it from the list; the trip stays in your history.
• Trusted contacts: stored encrypted on your device only. A contact is shared only at your request, when you share a trip.
• Trip sharing: anyone you send a follow-my-ride link to sees the trip status, the captain's name, the car, its plate, the expected arrival time and the last position, for as long as the share is live.
• In-trip chat: your messages with the captain during a trip, when the feature is available.
• Ratings and reports: used for platform safety and quality, and not shared with the captain in a form that identifies you.
• Payment: trips are paid in cash for now. If we add card payment, we will never store card numbers: a payment method is kept as a token with the payment provider, and we only ever see the last four digits.

3. What we collect from captains, and why

• Phone number: your sign-in identity and the channel for the verification code.
• Precise location, while on duty only: for dispatch, live trip tracking and the safety button. Collection continues while you are on duty with the app in the background, through a service that shows a persistent notification. We do not record your location off duty.
• Documents, National ID and profile photo: required by the Transport General Authority (National ID, driving licence, istimara, insurance and profile photo, and where required the vehicle inspection and operating card). They are uploaded and do not remain on the device afterwards. We strip the photos' metadata (including location, time and device data) and store them encrypted. Only authorised staff can view them, and every view is recorded.
• Display name: our team types your name in Arabic from your National ID when verifying it, and riders see it on the captain card.
• Vehicle and plate details: for regulatory registration. Riders see the make, model, colour and plate so they can find the car. The draft is cleared from the device when the application is submitted.
• Document reading on the phone: photos of your istimara, licence and insurance, taken or chosen from your phone, are read on your phone to pre-fill the form. Only the values you confirm reach our servers. See the Google ML Kit line in section 8.
• Earnings and settlements: displayed, never stored on the device.

4. Gender

Captains

• When you sign up we ask whether you are a male or a female captain, for two purposes only: matching riders who ask for a captain of the same gender, and checking your account against your National ID.
• Our operations team checks it against your National ID photo, and the identity verification provider may confirm it too. If it differs, it is corrected to match your ID and the app tells you.
• You can change it until you submit your application; after that, only through support.
• Your gender is never sent to riders as such. But a rider who asks for a captain of their own gender sees coarse estimates of such captains nearby, such as "women captains nearby", never an exact count or position; the estimates can still show roughly how near such captains are. The matched ride shows a "Woman captain" or "Man captain" tag.
• A rider can report that a captain was not as shown; a report can put your account on review while our team checks it. Authorised staff see how many of your cancels gave "the rider isn't as booked" as the reason.
• It is kept with your account under the account-deletion terms, and audit records keep it for the compliance period.

Riders

• We ask your gender only when it is needed: when you ask for a captain of your own gender, or when the matching in force requires it, and we use it for matching only. This option may not be available in your version of the app.
• Your gender is never sent to the captain, but a captain who takes only riders of their own gender, or any captain while same-gender-only matching is in force, knows your declared gender from being offered your ride. When riders may choose, a captain offered a ride on which you asked for a captain of your own gender sees that you asked, which reveals your gender.
• You can change it once; after that, through support.
• Captains can flag a rider who isn't as booked; after flags from two different captains your gender is locked until our team reviews it, and authorised staff can see it.
• It is kept with your account under the account-deletion terms: deleting your account hides it but does not erase it. Each ride requested under a gender-matching mode keeps a copy of it for as long as trip records are kept. Your gender and your default choice are included in a copy of your data.

For everyone: gender never appears in the apps' logs or analytics. The lawful basis for this processing is under legal review.

5. For everyone

• Account id and install id: to bind your session to your device. The install id belongs to the app and is not an advertising identifier.
• Notifications: your device's push token, to send trip and account updates. Marketing messages are off by default, and you control each channel in settings.
• Crash reports: pseudonymous, with no IP address, when enabled.
• Analytics: only after your consent, and never with your number, locations, fare or trip id. Not enabled at present.
• Support: what you write to us in support requests and reports.

6. What we do not collect

• No advertising tracking, no advertising identifiers, no cross-app tracking. We do not sell your data.
• No coordinates in analytics or in application logs.
• No card data in the captain app.

7. Lawful basis

We process your data to provide the service you ask for, to meet our legal obligations (such as transport and tax rules), and for the safety of the platform. Where we rely on your consent, as for analytics and marketing messages, we ask first, and these stay off until you agree. The lawful basis for each purpose, including the processing of gender and Google ML Kit's diagnostics, is [under legal review].

8. Who receives your data

• The other party to your trip: a captain offered your ride sees the pickup, destination, fare and pickup note, and during the ride your shortened name, rating and a masked number. A rider sees the captain's name, the car and its plate.
• People you share a trip with through a follow-my-ride link.
• Our authorised staff in support and operations, by role, with access to sensitive data recorded.
• Service providers:
  • Google Maps: to draw the map and routes.
  • Google Firebase Cloud Messaging: to deliver notifications to your phone. It receives your device's push token, the notification's text and type, and the trip or offer id when the notification is about a trip.
  • Google ML Kit (captain app, document reading): the app reads document photos on your phone, and ML Kit does not send the photo or the text it reads to Google or to anyone else. Google does receive technical diagnostics from ML Kit: your phone's make, model and system version; the app's package name and version; an identifier for this installation of the app, not one for your phone; performance data such as how long a read took; the reader's settings, such as the image format and size; and error codes. Google uses them to measure, maintain and improve ML Kit, under its ML Kit terms and privacy policy, and is not given your name, number or documents. Every captain who completes onboarding photographs these documents or chooses their photos, so these diagnostics reach Google for every captain, and they cannot be switched off. The rider app does not use ML Kit.
  • Sentry (EU): pseudonymous crash reports, when enabled.
  • PostHog (EU): analytics, only after consent.
  • Our SMS provider, to send verification codes: [to be named].
  • Our hosting provider: [to be named, with the server location].
• Government authorities where the law requires it, such as the Transport General Authority and the Zakat, Tax and Customs Authority, or on the order of a competent authority.

Test builds of the two apps, distributed to testers only, may draw the map from OpenFreeMap instead of Google. That service then receives the map requests for the area on screen and the device's IP address.

9. Processing outside the Kingdom

Google (maps, notifications and ML Kit diagnostics) processes its data outside the Kingdom, and Sentry and PostHog process theirs in the EU. Our own server location: [to be confirmed]. Any transfer outside the Kingdom falls under Article 29 of the PDPL: a transfer risk assessment and approved safeguards, both being completed before live operation.

10. How long data is kept

Deleting an account hides it and keeps its data (see section 11); a deleted account's data then follows the same periods as anyone's.

Periods in force today

Automated jobs apply these every hour:

On a captain's phone, the location buffer is deleted once the server accepts it and at sign-out, and document photos do not remain on the device after upload. Expired verification codes are deleted.

Proposed periods

The periods below are proposed, pending legal ratification, and are not yet applied; until then this data is kept. We will update this page when they are ratified and in force.

11. Account deletion

You can ask for your account to be deleted in the app or on the web deletion page. When you do:

• Your account is deactivated and hidden at once from both the rider and the captain app, and you are signed out on every device.
• Your data is kept by us; it is not deleted.
• Your mobile number stays bound to the hidden account, so no new account can be made with it.
• Support can restore your account at any time after verifying who you are.

Destruction of personal data on request is not available at present. Details are on the account deletion page.

12. Your rights

Under the PDPL you have the right:

• To be informed of what we collect and why, which this policy sets out.
• To access your data and obtain a copy of it. Riders: "Request a copy of my data" in settings, where your version of the app offers it, otherwise by email. Captains: through support or by email.
• To correction of anything inaccurate or incomplete.
• To ask for deletion: today this works as described in section 11 (hidden, not erased).
• To withdraw consent to analytics and marketing messages at any time.

Write to support@n2a01.com. We may need to verify who you are. We answer rights requests within 30 days at the latest. Some records are kept by law (tax and transport). You may also complain to the Saudi Data and AI Authority (SDAIA).

13. How we protect data

• Data travels between the apps and our servers over an encrypted connection (TLS).
• The most sensitive fields are stored encrypted, including document photos, chat text and support messages.
• Your session tokens are kept in your device's secure store. Your mobile number is masked in logs, and locations never appear in them.
• Access is limited to authorised staff, and access to sensitive data is recorded.

14. This website

This website uses no cookies, no analytics and no tracking, and loads nothing from third parties. The website's access log keeps no IP address. The account deletion form sends your mobile number, the reason you choose and a device id to our servers, and the IP address is used only for abuse rate limits.

15. Changes and contact

We update this policy when our practices change, raise its version number, and tell you in the app about any material change. If the Arabic and English texts differ, the Arabic text prevails. Questions: support@n2a01.com.