Privacy Policy

Last updated: 20 October 2026

This Privacy Policy explains how Shaj3 ("Shaj3", "we", "us") collects, uses, shares and protects personal data when you use the Shaj3 mobile app and website (the "Services").

It applies to football fans who book seats ("Users") and to cafe owners and their staff who list venues and manage bookings ("Cafes"). We process personal data in accordance with the Saudi Personal Data Protection Law (PDPL) and its implementing regulations. If you do not agree with this Policy, please do not use the Services.

1. Information We Collect

1.1 Information Users give us

Account details: name, email address, phone number, password (stored only in hashed form), optional profile photo and preferred language.
Booking details: the matches, cafes and seats you book, booking dates, booking status, check-in status and booking history.
Loyalty details: points, tier status, achievements and preferences.
Support details: messages, reports and tickets you send to us.

1.2 Information Cafes give us

Owner and staff details: name, email address, phone number, and each staff member's role and permissions within the cafe account.
Business details: cafe or business name, branches and addresses, map location, opening hours, logo, photos, seating layouts, and the matches and offers you publish.
Verification documents: commercial registration, VAT number and any other documents we request to confirm that the business is eligible.
Financial details: subscription plan, billing history and the bank account details used to pay out booking proceeds.

1.3 Payment information

Saved card details: card brand, last four digits, expiry month and year, cardholder name, and a secure payment token issued by our payment service provider.
Transaction records: amount, currency, date, payment status, and the booking or subscription the payment relates to.
Refund records: refunded amount, date, reason and status.

We never receive or store your full card number or CVV code. Card details are entered into our payment service provider's secure form and sent directly to it.

1.4 Information from sign-in providers

Sign in with Apple: your name and email address (or an Apple private relay email address if you choose to hide your email) and a unique account identifier.
Sign in with Google: your name, email address, profile photo and a unique account identifier.

We never receive your Apple or Google password.

1.5 Information collected automatically

Location: your device's precise location, only if you allow it, to show nearby cafes and matches and the distance to them. You can turn this off at any time in your device settings.
Camera and photos: the camera is used to scan booking QR codes at check-in and to take profile or cafe photos; the photo library is used to choose images you upload and to save your QR codes. We only process the photos you choose.
Device and usage data: device model, operating system and version, app version, language, IP address, and log data such as sign-in times, failed sign-in attempts, errors and actions taken in the app.
Notifications: your notification preferences, used to send booking confirmations and reminders.
Cookies: our website uses cookies as described in our Cookie Policy.

We do not use advertising trackers and we do not track you across other companies' apps or websites.

2. How We Use Information

To create and manage accounts, sign you in and keep your account secure.
To process bookings, generate QR codes, handle check-in at the cafe and share booking details with the cafe you booked.
To process payments, refunds, Cafe subscriptions and payouts, and to issue receipts and invoices.
To show nearby cafes, maps and distances.
To run the loyalty programme, including points, tiers and achievements.
To send service messages, such as booking confirmations, reminders, changes and cancellations.
To send promotional messages, only where you have agreed; you can opt out at any time.
To provide customer support and resolve disputes between Users and Cafes.
To detect and prevent fraud, abuse, fake accounts, QR code misuse and unauthorised access, and to enforce our Terms and Conditions.
To understand how the Services are used, fix problems and improve features, using aggregated data where possible.
To comply with legal obligations, including tax, accounting and anti-money-laundering requirements and lawful requests from authorities.

We rely on the following legal bases under the PDPL: performing our agreement with you, your consent (for example for location, photos and promotional messages), our legitimate interests (such as security and improving the Services), and compliance with legal obligations.

3. How We Share Information

With Cafes: when you book, the cafe receives your name, phone number, booking details, check-in status and the amount paid. Cafes never see your card details.
With Users: a Cafe's public profile (business name, logo, photos, branch addresses, map location, matches and offers) is visible to Users. We do not publish the personal contact details or financial details of cafe owners and staff.
With our payment service provider: Moyasar, a licensed payment service provider that complies with the Payment Card Industry Data Security Standard (PCI DSS), together with the banks and card networks involved, only to process payments, refunds and payouts.
With sign-in providers: Apple and Google, only to verify your identity when you choose to sign in with them. Their handling of your data is governed by their own privacy policies.
With service providers: companies that host our servers and store data, deliver emails and SMS messages, provide map services, and support our customer service, only as needed to provide their services to us.
For legal reasons: with government, tax or regulatory authorities where required by law or a court order, or where necessary to protect the rights, property or safety of Shaj3, our users or others, or to investigate fraud.
Business transfers: as part of a merger, acquisition, restructuring or sale of assets, in which case this Policy will continue to apply to your data.

We require every third party that receives personal data from us to protect it to the same or a higher standard than described in this Policy and required by applicable law, and to use it only for the purposes we specify.

We do not sell personal data, and we do not share it with third parties for their advertising.

4. Cafes' Responsibilities for User Data

Cafes that receive User data through Shaj3 may use it only to fulfil the booking and check-in. They must keep it confidential and secure, and must not use it for marketing, copy it outside the platform or share it with anyone else. Cafe owners are responsible for the actions of their staff accounts. Misuse of User data may lead to suspension or termination of the Cafe account.

5. Your Choices and Device Permissions

Location, camera, photos and notifications are optional. You can allow or deny each one, or change your choice later, in your device settings. Some features, such as nearby cafes or QR scanning, may not work without them.
You can opt out of promotional messages at any time using the unsubscribe option in the message or by contacting us. Service messages about your account and bookings will continue.
You can remove a saved card from the app at any time; its token is then deleted and the card can no longer be charged.

6. Data Retention

We keep your personal data for as long as your account is active.
When you delete your account, we delete or anonymise your personal data within 30 days, except for the data below.
Transaction, invoice, refund and payout records are kept for the period required by applicable tax and accounting laws.
Data needed to resolve an open dispute, prevent fraud or establish or defend legal claims is kept until the matter is resolved.
Security logs are kept for up to 12 months.
Backup copies are overwritten within 90 days.
Aggregated data that no longer identifies you may be kept to improve the Services.

7. Your Rights and Account Deletion

Under the PDPL, you have the right to:

be informed about how your personal data is collected and used;
access your personal data and request a copy of it;
request correction of inaccurate or incomplete data;
request deletion of your personal data;
withdraw your consent at any time, without affecting processing that took place before; and
file a complaint with the Saudi Data and Artificial Intelligence Authority (SDAIA).

How to delete your account

In the app: go to Profile, tap Edit Profile, tap Delete Account, then confirm. This works for both Users and Cafe owners.
Cafe owners must first complete or cancel any pending, confirmed or checked-in bookings.
A step-by-step guide is available at shaj3.sa/account-deletion.
If you cannot access the app, email support@shaj3.sa from your registered email address and we will delete your account for you.

Account deletion is permanent. Your profile, booking history, loyalty points, tier status and achievements will be deleted and cannot be restored. Data we must keep by law is handled as described in section 6.

To exercise any other right, contact us at support@shaj3.sa. We may ask you to verify your identity, and we will respond within 30 days.

8. Children

The Services are intended for people aged 18 and over. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

9. Data Security

We protect personal data with encrypted connections (HTTPS/TLS), hashed passwords, secure storage of sign-in tokens on your device, tokenisation of card data by our payment service provider, limits on failed sign-in attempts and restricted access for our staff. No system is completely secure, so please keep your password confidential and tell us immediately if you suspect unauthorised use of your account. If a data breach affects you, we will notify you and the competent authorities as required by law.

10. Where Your Data Is Stored

Your data is stored on servers located in the Kingdom of Saudi Arabia. Where personal data is transferred outside the Kingdom, for example when you use Sign in with Apple or Google, we do so only as permitted by the PDPL and its regulations on cross-border transfers, with appropriate safeguards.

11. Third-Party Services

The Services include features provided by third parties, such as Apple, Google, Moyasar and map providers. Their use of your data is governed by their own privacy policies, and we encourage you to read them.

12. Changes to This Policy

We may update this Policy from time to time. The "Last updated" date at the top shows when it was last changed. If we make material changes, we will notify you in the app or by email before they take effect. Continuing to use the Services after the changes take effect means you accept the updated Policy.

13. Contact Us

For any questions or requests about this Policy or your personal data, contact us:

Email: support@shaj3.sa
In the app: Profile, then Support