Privacy Policy
Effective date: 11 October 2026 Controller: MIRABK Company, a company registered in the Kingdom of Saudi Arabia, CR No. 7054866681, registered address National short address RHOA6468. Contact / Data Protection queries: support@mirabk.com, +966 50 326 1464
This Privacy Policy is issued in compliance with the Saudi Personal Data Protection Law (PDPL) and its Implementing Regulations, as regulated by the Saudi Data & Artificial Intelligence Authority (SDAIA).
1. Scope
Applies to Mirabk’s customer app, driver app, and related services (the “Platform”), operated by MIRABK Company (“we”, “us”).
2. Data We Collect
Fill this table from the team’s actual data inventory before publishing — Google/Apple disclosures must match exactly.
| Category | Examples | Collected from | Purpose |
|---|---|---|---|
| Identity data | Name, national ID/Iqama number (drivers), profile photo | User input | Account creation, driver verification |
| Contact data | Phone number, email | User input | Account, notifications, support |
| Location data | Real-time GPS, pickup/drop-off addresses | Device (with permission) | Matching, live tracking, routing |
| Vehicle & license data | Driving license, vehicle registration (Istimara), TGA carrier license (if applicable) | Driver input/upload | Regulatory verification, trust & safety |
| Payment data | Card token (not full card number — held by payment processor), transaction history | Payment processor, app | Billing, payouts |
| Usage data | App interactions, device identifiers, crash logs | Automatically | Product improvement, security |
| Communications | In-app chat/support messages | User input | Support, dispute resolution |
We do not store full payment card numbers; these are handled and stored solely by our PCI-compliant payment processor, Moyasar.
3. Legal Basis for Processing
Processing is based on: performance of the contract with you (booking/matching services), your consent (location, marketing communications), and our legitimate interest (fraud prevention, platform security), consistent with PDPL Art. 5-6.
4. How We Use Data
- Matching customers with available drivers
- Real-time trip tracking and ETA calculation
- Payment processing and payout to drivers
- Regulatory/driver verification (license, vehicle, TGA carrier registration where applicable)
- Customer support and dispute resolution
- Fraud prevention and platform safety
- Legal compliance and responding to lawful government requests
5. Data Sharing
We share data only with:
- Drivers/customers directly involved in a trip (name, phone, location) — necessary to complete the service
- Payment processor (Moyasar) — to process payments/payouts
- Maps/routing provider ([Google Maps / Mapbox]) — to enable navigation
- SMS/notification provider ([Twilio / other]) — to deliver OTPs and trip notifications
- Government authorities — where legally required (e.g., TGA, law enforcement, court order)
We do not sell personal data to third parties.
6. Cross-Border Data Transfer
7. Data Retention
- Account data: retained while the account is active, plus [X years] after closure for legal/tax/dispute purposes
- Trip/location history: retained for [X months/years] for safety and dispute resolution
- Payment transaction records: retained per Saudi tax/commercial record-keeping requirements (commonly 10 years for commercial books)
8. Your Rights (PDPL)
You have the right to:
- Access the personal data we hold about you
- Request correction of inaccurate data
- Request deletion of your data (subject to legal retention obligations)
- Object to certain processing
- Request a copy of your data (data portability)
- Withdraw consent at any time where processing is consent-based
To exercise these rights, contact support@mirabk.com. We will respond within the timeframe required by PDPL.
9. Data Security
We apply technical and organizational measures (encryption in transit, access controls, [others]) to protect your data. In the event of a data breach, we will notify SDAIA within 72 hours as required by PDPL and notify affected individuals without undue delay.
10. Children
The Platform is not directed at individuals under 18. We do not knowingly collect data from minors.
11. Changes to this Policy
We may update this policy; material changes will be notified via the app or email before taking effect.
12. Contact
Data Protection queries: support@mirabk.com Postal address: National short address RHOA6468
TODO before publishing:
- Confirm exact data inventory with engineering team (table above)
- Confirm data residency of every third-party vendor (Section 6) — needed for PDPL cross-border compliance
- Confirm retention periods with finance/legal (Section 7)
- Legal review by Saudi-licensed counsel before publishing