Privacy Policy

1.Introduction & scope

This policy applies to the ProAdvice mobile applications, our website, and all related services (together, the “Platform”). It covers everyone who uses ProAdvice: customers (individuals and members of business or company teams), professional experts, and company administrators.

ProAdvice operates in the Kingdom of Saudi Arabia and processes personal data in accordance with the Saudi Personal Data Protection Law (PDPL) and its implementing regulations. By creating an account, booking a consultation, or otherwise using the Platform, you acknowledge the practices described here. Where the law requires it, we ask for your consent and record your acceptance.

2.Who we are & how to contact us

ProAdvice is the data controller responsible for the personal data described in this policy. We are also the merchant of record for consultations: we collect payment from customers and remit expert earnings (net of our platform commission) to each expert’s verified Saudi bank account.

3.The personal data we collect

We collect data that you provide directly, data generated as you use the Platform, and a small amount of technical data needed for security and authentication. We collect different information depending on whether you are a customer, an expert, or a company.

From everyone

• Account & identity: full name and phone number (in E.164 format), used for registration and one-time-password (OTP) sign-in.
• Email address: optional at registration and required before your first paid booking; used for notifications, booking confirmations, VAT receipts, and tax (ZATCA) invoices.
• Profile photo: optional.
• Professional context: title and short bio (optional).
• Technical & security data: IP address and device/browser (user-agent) recorded for OTP verification and to evidence your acceptance of our legal terms.
• Push tokens: device tokens for push notifications, stored per app and platform (iOS/Android).

From customers

• Optional professional context, an auto-generated referral code, and any “referred-by” relationship.
• Loyalty credit balance and referral-reward tracking.

From experts (verified professionals)

• Identity & credentials: national identity (national ID or iqama), CV, educational and professional credentials, and professional title.
• Professional details: currently-employed status and, optionally, monthly salary (stored encrypted, used only for benchmarking features).
• Banking & tax details: Saudi IBAN, bank name, and account-holder name (stored encrypted); a valid Saudi IBAN and a tax registration number (TRN) are required before your first payout.

From companies

• Legal name, commercial registration (CR) number, trade name, VAT number, and billing email and address. Company corporate-credit budgets and consolidated invoicing data are also recorded.

Booking, session & consultation data

• Booking records: scheduled start/end times, session duration, prices, VAT amounts, and payment-intent references.
• Smart Brief & intake: your objective, background, up to five questions, and any attachments you upload (PDF/JPG/PNG, up to 10 MB each).
• Video session metadata: meeting ID, video provider, join URLs, and — only where a recording exists — a recording URL and its expiry date.
• Session recording (audio/video): created only when both the customer and the expert explicitly consent at booking time. If consent is not given, no recording is made.
• Feedback: ratings (1–5 on expertise, communication, and outcome) and optional written reviews.
• Outcome tracker: item descriptions, owner, due dates, and completion status.
• AI-assisted content (optional): where AI processing is consented, session transcripts and AI-generated summaries and structured outcomes. Transcripts are encrypted and deleted on the same schedule as recordings.

4.How & why we use your data

We use personal data only for clear purposes, each supported by a lawful basis under the PDPL:

• To provide the service (matching, booking, and facilitating your video consultation) and to authenticate you via OTP and manage your sessions — performance of our contract with you.
• To process payments through our payment gateway, calculate platform commission, and remit expert payouts to a verified IBAN — performance of contract.
• To issue VAT-compliant invoices and ZATCA e-invoices and to keep financial records — compliance with a legal obligation.
• To send transactional and reminder notifications by email, push, SMS, and in-app messages — performance of contract / legitimate interest.
• To compute and display an expert’s trust score (based on profile verification, session-completion rate, customer ratings, responsiveness, and repeat-client rate), and to run referral and loyalty programmes — legitimate interest.
• To detect and prevent fraud and abuse and to keep the Platform secure — legitimate interest / legal obligation.
• To generate AI-assisted prep packets, summaries, and transcripts — only with your consent, which you can decline or withdraw.
• To comply with the PDPL and applicable financial regulations — legal obligation.

Where we rely on your consent — for example, session recording or optional AI processing — you may withdraw it at any time. Withdrawing consent does not affect processing carried out before the withdrawal.

5.Sharing with third-party processors

We do not sell your personal data. We share it only with carefully selected service providers who process it on our behalf, under contract, and only as needed to run the Platform. We describe them here by their function:

• SMS / OTP delivery: a messaging provider sends the one-time codes that sign you in and the transactional SMS we send you.
• Payment gateway: a third-party payment provider processes customer card payments and handles expert payouts. Card details are entered directly with the gateway and are never stored on ProAdvice servers (see Section 7).
• Video provider: a video-meeting provider creates and hosts your consultation and, where a recording is consented, stores it for the limited retention period.
• Push notifications: a cloud messaging provider delivers push notifications to your mobile device.
• AI provider (optional): where you consent to AI features, an AI provider performs inference only — structuring your brief, summarising sessions, and coordinating transcription. This is governed by a data-processing agreement, and your data is not used to train the provider’s models. An optional third-party transcription service may convert session audio to text (Arabic/English) under the same protections.

We may also disclose personal data where required by law, to a competent Saudi authority, or to protect the rights, safety, and property of ProAdvice, our users, or the public.

6.Data shared with experts

When you book a consultation, the expert you book receives the information they need to prepare for and deliver your session — typically your name, the details of your Smart Brief (objective, background, your questions, and any attachments you upload), and relevant booking details. Where a recording is consented, both you and the expert may download it within the retention window. Experts are bound by confidentiality obligations, including a non-disclosure agreement and a code of conduct, and may use your information only to provide your consultation.

7.Payment-data handling

We retain only non-sensitive transaction information, such as payment references, amounts, currency (SAR), VAT amounts, and payment status, which we need for booking, invoicing, refunds, and accounting. Prices shown to you include VAT. As the merchant of record, ProAdvice charges the customer for the session and remits the expert’s earnings (net of platform commission) to their verified Saudi IBAN after the session. Corporate customers may settle via a credit budget and a monthly consolidated invoice. Refunds, where due under our cancellation policy, are returned to the original card by the payment gateway.

8.International transfers

We aim to store personal data within the Kingdom of Saudi Arabia. Some of our service providers (for example, the video, push-notification, and optional AI providers) may process limited data outside the Kingdom. Where this happens, we transfer data only in line with the PDPL — relying on appropriate safeguards such as data-processing agreements and approved transfer mechanisms — and limit the data to what is necessary for the relevant service.

9.Cookies, analytics & device identifiers

On the web: our website uses a small number of cookies and similar technologies that are necessary for the site to function and to keep it secure. Where we use analytics to understand how the site is used, we do so in an aggregated way and, where required, with your consent. You can control cookies through your browser settings.

In the app: we use device identifiers and push-notification tokens to deliver notifications, keep you signed in, and protect your account. You can disable push notifications at any time in your device settings.

10.Data retention

We keep personal data only for as long as we need it, then delete or anonymise it:

• Account & profile data: kept while your account is active; deleted or anonymised when you close your account or make a valid erasure request.
• Session recordings and AI transcripts: automatically deleted after a short retention window (currently 30 days), after which they can no longer be accessed or downloaded.
• Booking, payment, and invoice records: retained for up to 7 years to meet financial, tax, and audit obligations, even after an account is closed (with personal identifiers detached where possible).
• OTP codes: retained briefly (up to 24 hours after expiry), then purged. Codes are always stored in hashed form, never in plain text.
• Legal-acceptance audit records: retained for compliance and audit purposes.

11.Your PDPL rights

Under the Saudi Personal Data Protection Law, you have the right to:

• Access the personal data we hold about you and be informed of how it is used.
• Correct inaccurate or incomplete data — much of which you can update yourself in the app.
• Delete your data (erasure), subject to records we must keep by law. On erasure, we anonymise your profile — for example, replacing your phone number and email with non-identifying values, removing your name, bio, and photo, and clearing banking details — while retaining the minimal financial and audit records the law requires.
• Object to or restrict certain processing.
• Withdraw consent at any time for processing that relies on it (such as session recording or AI features), without affecting earlier processing.

To exercise any of these rights, email us at hello@proadvice.app. We may need to verify your identity before acting on a request, and we will respond within the time frames set by the PDPL. If you believe we have not handled your data properly, you may also contact the competent Saudi data-protection authority.

12.Children

ProAdvice is intended only for users aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us with personal data, please contact us at hello@proadvice.app and we will delete it.

13.Security

We take the protection of your data seriously and apply appropriate technical and organisational measures, including:

• Passwordless sign-in via phone-number OTP, with sensitive actions (such as changing banking details or making a payment) requiring a fresh, short-lived single-use security token.
• Encryption in transit using TLS, and encryption at rest for sensitive data such as IBANs, account-holder names, salary information, and session transcripts.
• Rate limiting on OTP requests and registration to deter abuse.
• Data residency within the Saudi region for our primary storage.
• Audit logging of sensitive events — such as access to banking details, status changes, and administrative actions — recorded with the actor, IP address, and timestamp.
• Administrative safeguards, including a password policy and multi-factor verification for sensitive staff actions, and strict access controls.

No system is ever completely secure, but we work continuously to protect your data and to respond promptly to any incident.

14.Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our services or the law. When we make material changes, we will update the “Last updated” date above and, where appropriate, notify you in the app or by email. Your continued use of the Platform after an update means you acknowledge the revised policy.

15.Contact us

Back to top