1 — Who We Are
We are a Saudi company represented by the "Jay / J" brand, an electronic platform specialized in receiving, processing, and delivering orders and bookings within the Kingdom of Saudi Arabia. You can reach us through our website and the Jay app available on mobile platforms.
With respect to your privacy, we are the party that decides how and for what purposes your personal data is processed, which the Saudi Personal Data Protection Law defines as the "Controller."
If you have any questions regarding how your personal data is processed, you can contact us through the electronic communication channels of the Jay platform, as announced on the company’s official website and application.
2 — Key Definitions
- Personal Data
- Any information that directly identifies you as a natural person (such as your full name and phone number), or that can be used to identify you (such as a user ID linked to your identity).
- Processing
- Any operation performed on your personal data, including collection, storage, use, disclosure, and destruction.
- Platform
- The Jay website, the Jay mobile application, and all related services.
- User
- Any person who visits the platform, creates an account, or places an order or booking.
- Seller
- Any store, restaurant, or service provider connected to the Jay platform.
- Data Processor
- Any external party that processes data on our behalf and in accordance with our explicit instructions.
3 — Categories of Personal Data We Collect
When you use the platform, we process data you provide directly, data collected automatically from your device, and data obtained from third parties. This data includes the categories set out in the following table:
| Data category | Details |
|---|---|
| Account Data | Full name, email address, phone number (the primary registration method linked to your national ID), username, encrypted password, country, language, user ID, profile settings. |
| Order and Booking Data | Order and booking details, order history, order IDs, product names and quantities, order instructions, date and time of the order or booking, order status. |
| Geolocation Data | The address you enter, postal code, city, region, latitude and longitude, and the real-time location tracked in the background while you head to pick up an active order (Pick-up). |
| Payment Data | Debit or credit card data, payment method, payment amount, refund details, bank receipts (we do not retain full card numbers). |
| Wallet and Rewards Data | Your Jay wallet balance, top-up and usage history, loyalty points and their movement, cashback and coupon history, and indicators used to monitor unfair or fraudulent use related to them. |
| Device Information | Device ID, IP address, browser type, operating system, session information, configuration settings, platform interactions. |
| Customer Support Data | The content of your support requests, customer service team responses, images or videos attached (as proof in compensation requests), communication records. |
| Marketing Data | Your marketing preferences and your subscription status for notifications and newsletters (with the ability to unsubscribe at any time). |
4 — How We Collect Data
We collect your data through the following methods:
- Direct registration when creating an account or placing an order or booking.
- Cookies, SDKs, and measurement pixels while browsing the platform.
- Automatic server logs recorded when interacting with the platform.
- Direct communication with the customer support team through various contact channels.
- Electronic payment gateways when completing payments, or installment payment companies (Tabby/Tamara) when you choose this option.
- Analytics tools such as Google Analytics (aggregated data).
5 — How Do We Use Your Personal Data?
We use your data for the following purposes, noting the legal basis for each purpose under the Saudi Personal Data Protection Law (PDPL):
A. When Creating and Managing Your Account
When creating a customer account, we need to process your account data such as your name, phone number, email, country, and language. Once the account is created, we assign you a unique user ID that cannot be used by external parties.
Your data is processed to manage your profile, including ensuring data accuracy, processing edits, and handling technical issues. The data processed includes: account data, order data, payment data, and device information.
B. When Browsing the Platform
We use web tracking technologies (such as cookies, SDKs, and measurement pixels) to facilitate the platform's operation, improve its performance and security, and understand how our users interact with it. See Section 10 for further details.
We may show you personalized content, including nearby sellers, products you have previously ordered, or suggestions we believe may interest you. These operations will not have a legal effect or similarly significant impact on you — the only result is that you will receive suggestions for products matching your interests.
C. When Placing an Order or Booking
Once you log in and select items, they are saved in your cart even if you close the browser or app. This data is deleted once you place your order or remove the items from the cart.
To process your order, we need your account data and order details, including the address, order ID, and product names and quantities.
While there is an active self-pickup order, we process your geolocation in the background to let the store know you are approaching and prepare your order at the right time. This tracking stops automatically once pickup is complete, and the self-pickup service cannot be used without enabling location permission.
When you place your order, your information is shared with the payment provider you chose, including Tabby or Tamara if you select the Buy Now, Pay Later option. We are legally required to issue you an invoice once payment is completed.
Our platform offers the option to save your preferred payment method to make future orders easier. You can disable this option at any time.
D. Promoting the Platform and Services
We may send you in-app notifications, instant messages, or newsletters to inform you about new stores and offers. You can always unsubscribe at any time.
We use a range of incentives to enhance your experience, including: the friend-referral program, coupons and discount codes, competitions, the Jay wallet, and loyalty points. Data related to these programs is processed to manage them and grant you rewards, as well as to monitor any fraudulent or unfair use of them.
We use various marketing strategies, including targeted advertising. We request your prior explicit consent for personalized ads; if declined, you may continue to receive general, non-personalized ads.
We maintain profiles on social media platforms. When you visit our pages, the operators of these platforms process your data in accordance with their own privacy policies.
E. Customer Service
If you have questions or issues related to your order, we need to process your account data, order details, and payment data. We may use automation and algorithmic decision-making for some customer service functions, and we may use artificial intelligence while ensuring your data is not shared with third parties to train their models.
After your order is completed, you can rate and review the seller. Your first name will be displayed next to your review. You may request the removal of your review from public display at any time, subject to the provisions of the Terms of Use and General Conditions regarding content ownership and our retention of it for service-improvement purposes.
F. Platform Security and Fraud Prevention
We use the latest servers and cloud services. We apply multiple security tools, including: two-factor authentication, endpoint security detection, traffic monitoring, backup systems, and data-loss-prevention solutions.
We implement proactive measures to detect and prevent fraudulent activity, using your account data, payment data, location data, device information, and order data — including detecting fake or unreasonable orders and unfair use of the Jay wallet or loyalty points. These measures include: fraud scoring, transaction analysis, and user-behavior modeling, and in confirmed cases, automatically suspending the account or freezing the wallet. If you object to any such decision, you can contact the customer service team to have your case individually reassessed.
G. Service Improvement
We may occasionally invite you to participate in surveys to improve our services. Participation is entirely voluntary and requires your prior consent, which you may withdraw at any time.
We conduct data analytics to improve our platform in terms of user experience, product development, and pricing. The data is mostly aggregated or de-identified.
H. Legal Compliance
We may be required to share personal data with public authorities in certain cases, such as complying with court orders, responding to law enforcement requests, or handling legal disputes.
When you exercise your legal rights, we process your data to handle your request effectively. We retain this information for as long as necessary to comply with our legal obligations.
6 — Who Receives Your Data?
We handle your data with the utmost care. We do not sell or rent it to third parties. We only share your data in the following cases:
A. Sellers Connected to the Platform
To prepare your order, we share order data with the seller preparing it — including the name of the person placing the order and vehicle details when requesting delivery without leaving the vehicle. Vehicle data is withheld from the seller immediately after delivery is completed.
B. Data Processors (Service Providers)
We use external service providers to run our operations; they are considered "data processors" and act exclusively on our instructions. These include:
- Electronic payment gateways: such as Tap Payments, HyperPay, and other approved payment gateways in the Kingdom.
- Installment payment companies: Tabby and Tamara, exclusively when you choose to use the Buy Now, Pay Later service, subject to their independent terms.
- Cloud services: cloud infrastructure and hosting providers.
- Marketing and communication tools: platforms used to send notifications and emails.
- Analytics tools: such as Google Analytics, to improve performance.
- Operational integration systems: we may integrate your data with accounting systems, point-of-sale (cashier) systems, enterprise resource planning (ERP) systems, logistics systems for delivery partners, and other related systems used by sellers or our partners, in order to improve service quality and order-fulfillment efficiency. These parties are subject to data processing agreements that bind them to confidentiality and prohibit using your data for any purpose outside the service agreed with us.
C. Other Third Parties
We may work with consultants, lawyers, and accountants who receive your data under contract for legal reasons or to protect our legitimate interests. We will never sell or rent your personal information to third parties without your explicit consent.
D. Government and Regulatory Authorities
We may be required to disclose personal data to public authorities in cases such as cooperating in the detection and prevention of crime, responding to court orders, and complying with tax authorities. These bodies include: law enforcement agencies, courts, the Zakat, Tax and Customs Authority, or any relevant government body.
E. Mergers and Acquisitions
In the event of a merger, acquisition, or change of ownership, we may disclose limited information to the relevant party and its advisors, who are bound by professional confidentiality. We will notify you in advance of any material changes in company ownership that affect your data.
7 — Storing and Protecting Your Data
We apply multi-layered security standards to protect your data:
- Encrypting all data transmitted via the HTTPS/TLS protocol.
- Encrypting passwords using secure algorithms (bcrypt or equivalent).
- Restricting internal access on a strict need-to-know basis.
- Regular security testing and firewalls.
- Two-factor authentication and intrusion detection systems.
- Periodic backups deleted after 90 days.
Notice in the event of a breach: If a security breach occurs that affects your personal data, we will notify you within 72 hours of becoming aware of it, in accordance with the requirements of the Saudi National Cybersecurity Authority (NCA) and the Personal Data Protection Law, explaining the nature of the breach and the measures taken to address its effects.
Data Retention Schedule
- Account and order data: for as long as your account remains active, or 3 years after inactivity.
- Billing and financial data: 10 years from the invoice date, in accordance with legal requirements.
- Customer service data: 3 to 6 years, according to applicable statutory limitation periods.
- Wallet and rewards data: for the duration of the account, and after closure as needed for fraud-prevention purposes.
- Fraud data: for the duration of the account and after closure, as needed.
- Daily backups: 90 days only.
8 — Transfer of Data Outside Saudi Arabia
We and our service providers may transfer personal data to other countries. When carrying out such transfers, we take appropriate measures to ensure an adequate level of protection for your data, in line with the requirements of the Saudi Personal Data Protection Law.
If you would like information about the safeguards applied to data transfers, you may contact us.
9 — Your Legal Rights
Under the Saudi Personal Data Protection Law (PDPL) and applicable regulations, you have the following rights:
| Right | Details |
|---|---|
| Right to Access | The right to view your personal data, request a copy of it, and know how it is processed. |
| Right to Correction | You may request the correction of any inaccurate or incomplete data at any time. |
| Right to Deletion | You may request the deletion of your data in the cases prescribed by law, noting that some data may be retained for legal obligations. |
| Right to Restrict Processing | You may request the restriction of processing your data in specific cases, while it may be retained in an archive to meet legal obligations. |
| Right to Data Portability | You may request that your data be provided to you in a machine-readable format; this applies to data processed based on your consent. |
| Right to Object | You may object to the processing of your data for direct marketing purposes or based on our legitimate interests. |
| Right Not to Be Subject to Automated Decisions | You have the right to object to any fully automated decision (without human intervention) that produces legal effects or similarly significant effects on you. |
| Right to Complain | You may submit a complaint to the Saudi Data and Artificial Intelligence Authority (SDAIA) or the relevant regulatory body. |
To exercise any of these rights, please contact us through the channels listed in the last section. We will respond to your request within 15 business days. You may also manage some of these rights directly from your profile on the platform.
10 — Cookies
We use cookies for four main purposes:
- Essential: to operate the platform, manage login sessions, and ensure platform security — these cannot be disabled.
- Analytics: to understand user behavior and improve the service — these can be declined.
- Preference: to remember your settings and preferred language — these can be declined.
- Marketing: to display personalized ads — these require your explicit consent.
You can control your cookie settings from your browser settings at any time, or from the cookie settings panel on our platform.
11 — Algorithmic Decision-Making and Artificial Intelligence
Some of our operations involve the use of algorithmic decision-making and machine learning. We always strive to ensure an appropriate level of human oversight over these decisions.
In most cases, these operations will not have legal effects or similarly significant impacts on you. When they do have such effects, we will guarantee your right to object and request human review.
12 — Children's Privacy
Our services are intended exclusively for persons over 18 Hijri years of age. We do not knowingly collect personal data from minors under this age. If we learn that a minor's data exists in our database, we will act to delete it immediately.
If you believe your child has created an account, please contact us directly so the matter can be handled urgently.
13 — Delivery Service (Coming Soon)
Notice: Physical delivery is not currently active on the Jay platform. This service will launch during the coming period, and this policy will be updated before launch to include: real-time geolocation data to track the order during delivery, sharing the detailed delivery address with approved couriers, proof of delivery, and privacy policies specific to couriers and logistics partners.
14 — Amendments to This Policy
We may update this policy from time to time to reflect our new operations, technologies, and legal obligations. If we make material changes, we will notify you through a clear notice on the platform's homepage and an email to the address registered on your account.
Your continued use of the platform after the amendments take effect constitutes acceptance of them. We recommend reviewing this page periodically.