Zaffah · زفّة

Privacy Policy

Last updated: 24 July 2026

Who we are

Zaffah (زفّة) is a Saudi platform for wedding planning and for booking venues and wedding services, based in Riyadh. The data controller is the Zaffah founding team; upon completion of our company registration, this responsibility passes automatically to the registered Zaffah entity, with no change to our obligations to you. We comply with the Saudi Personal Data Protection Law (PDPL) and its Implementing Regulations, under the supervision of the Saudi Data & AI Authority (SDAIA).

Privacy contact: hello@zaffahapp.com

What we collect

Only what the product actually needs:

• Account & sign-in: your mobile number (verified by an SMS one-time code), your name and city.
• Wedding journey: your wedding date, checklist tasks, and budget items you record.
• Guest list: the names and phone numbers of your guests, if you add them. This is other people’s data entered by you: add only people you genuinely intend to invite. Anyone on a guest list may ask us to remove their details (see "Guests' rights").
• Invitations: the invitation text, couple names, date and venue, shared by link or SMS; we count link opens.
• Chat: text and images exchanged with partners. Messages are automatically scanned to block the sharing of off-platform contact details (phone numbers, email addresses, messaging or social handles), to keep the conversation on Zaffah. Bank and payment details (such as IBANs) may be shared so you and the partner can arrange payment directly: Zaffah is not a party to those payments and is not responsible for them.
• Reservations & reviews: booking requests you send, and reviews published after moderation.
• Feedback: notes you send us from within the app (a short message and its category), with the app version, used only to fix issues and improve the product. While your account exists, a note stays linked to you so we can follow up with you; after you delete your account we keep it in anonymised form only.
• Partners (venues, planning offices, photo studios): organisation and staff account details, roles and resource access, venue photos, prices, and calendars.
• Portfolios: photos from past events uploaded by a partner to its profile, which may show people's faces. By uploading, the partner attests it has the documented permission of the people who appear in them, photos are reviewed before they appear in the app, and anyone appearing in a photo may ask us to remove it (see "Portfolio subjects' rights").
• Notifications: device tokens and web-push subscriptions used to deliver alerts.
• Waitlist (zaffahapp.com): your phone number and first name, plus your family name if you choose to share it, with your explicit consent given through a checkbox on the form, solely to notify you at launch and address you by name in that message, along with minimal technical data to prevent automated submissions (page language and browser identifier).
• Wedding-service partnership records: the establishment's name, its service type (venue, photography, catering, styling, or other), city and contact number, plus optionally its email or Instagram handle, whether submitted by the establishment through the "Register your service" form on zaffahapp.com or recorded by our team from direct contact or the establishment's public channels, used solely to communicate about and follow up the partnership, with the source of every record noted, along with minimal technical data to prevent automated submissions (page language and form fill time).
• Venue map location: the venue's pin coordinates and a nearby-landmark line written by the partner, business data the partner provides itself and our team reviews before it appears, used solely to guide couples and their guests to the venue. Zaffah's maps are hosted entirely on our own servers, so browsing the map sends nothing to any other party, and we never ask for your device location.
• Technical logs: basic operational and audit logs for platform security and troubleshooting.

We do not process any payments or deposits in this version of the product.

Why we collect it (legal basis)

We process your data to perform the service you asked for, creating your account, organising your wedding, messaging venues, handling booking requests, and with your consent where the law requires it (such as the waitlist and notifications). We do not sell your data or use it for third-party advertising.

Who sees your data

• Partners (the venue, office, or studio) see only what your request needs: your name, event date, request details, and your messages to them. They never see your guest list or budget.
• Processors acting for us: our SMS provider (verification codes and invitations), hosting provider, and push-notification provider, under contracts that bind them to protect your data, receiving only the minimum necessary.
• The "Open directions" button: tapping it is your choice to hand off to the maps app you use (such as Google or Apple Maps), carrying only the venue's name and coordinates; that app's own policy applies from there. We never call any maps provider ourselves.
• We disclose data to no one else except where the law requires.

Venue back office. We give venue partners a back office to run their own bookings, quotes, contracts, invoices, receipts, purchases and reports. For the data a venue enters there (its own customers, including people who never used the Zaffah app, its suppliers, its financial records, its tax identifiers such as VAT and commercial registration numbers, and any document scans it uploads), the venue is the controller and Zaffah acts as its processor: the venue decides what to enter and is responsible for it, and we process it only on the venue's instructions to provide the office service. We do not sell it, we do not use it for any other purpose, and we add no analytics or tracking to it.

Payments stay outside Zaffah. Recording a payment in the office is a bookkeeping entry the venue makes about money it received directly. Zaffah is still not a party to any payment, and still holds and moves no money.

When you book a venue that uses the office. The venue may hold your name and phone number as its own customer record, and may place the booking you made with it on a quote, contract or invoice it issues. It sees nothing else: not your guest list, not your budget, not your activity in the app, and nothing about any other venue. Because those documents are the venue's commercial and tax records, the venue keeps them, and the customer record behind them, for the period below, even after you delete your Zaffah account.

Exercising your rights over a venue's records. For a record a venue holds in its office, the venue is the controller: address access, correction and deletion requests to that venue, and Zaffah will assist it as processor. Your own Zaffah account keeps its separate in app export and delete.

Breach notification. If a personal data breach affects office data, we notify the affected venue without undue delay so it can meet its own notification duty to SDAIA, and we notify SDAIA directly where the duty is ours.

Storage & PDPL

Your data is stored with a hosting provider under our security controls, and every storage-location or cross-border decision is made in compliance with the PDPL and the Data Transfer Regulations. Plain-language caveat: the launch waitlist is temporarily held in a cloud spreadsheet tool whose servers may be outside Saudi Arabia; we keep it to the minimum and will migrate it into our own systems before launch.

Retention

• Account and wedding data: as long as your account exists; deleted when you delete it.
• Feedback: linked to you while your account exists, so we can follow up. When you delete your account, we remove the link to your identity and keep only the anonymised message, its category and the app version, to fix issues and improve the product; we can no longer connect it to you.
• One-time codes: minutes, then purged automatically.
• Chat: linked to you while your account exists. When you delete your account, your messages stay in the venue's conversation with your identity stripped out, so nothing in them points back to you.
• Waitlist: until launch, then deleted unless you create an account.
• Portfolio photos: as long as the partner's account exists. When a subject asks, we take the photo down within at most 72 hours; when the partner account is deleted the photos are deleted, and backup copies expire within the normal backup cycle.
• Partnership records: while the conversation is live; if a partnership does not go ahead, the details are deleted or anonymised within 12 months of the record closing. On a deletion request we delete the record and keep only a minimal do-not-contact marker so we never approach the requester again.
• Office records (sent quotes, contracts, invoices, credit notes, receipts, purchase bills, the document scans attached to them, and the customer record each is issued to): 10 years from the end of the financial year in which the document was issued, because Saudi law obliges the venue to keep its commercial books, correspondence and supporting documents for at least ten years, and its VAT records for at least six. We hold them for the venue as its processor for that period, whether or not the venue's account or the customer's Zaffah account is still open. Customer records and drafts that never produced an issued document are deleted or anonymised 24 months after the last activity, or on the venue's instruction, whichever comes first.
• Operational and audit logs: 12 months, then deleted or anonymised.

Deleting your Zaffah account: your account, wedding journey, guest list, invitations, budget and booking requests are deleted. Two things survive, and we say so plainly. First, your messages stay in the venue's conversation with your identity stripped out, so nothing in them points back to you. Second, if a venue you actually booked issued you a quote, contract or invoice from its office, that venue keeps that document and the customer record named on it, including your name and phone number, as its own commercial and tax record for the period above, and the booking row those documents rest on is kept with its link to your account removed. Nothing else about you stays with the venue.

Your rights

You may access, export, correct, and delete your data. In practice: the app includes Export my data and Delete my account (this deletes your profile, wedding journey, guests, invitations, budget and booking requests; see Retention for the two things that survive and why). For corrections or anything else, email hello@zaffahapp.com; we respond within the statutory timelines.

Guests' rights

If someone added your name or number to their guest list on Zaffah, email hello@zaffahapp.com and we will remove your details, no account required.

Portfolio subjects' rights

If your photo appears in a partner's portfolio on Zaffah, email hello@zaffahapp.com and we will take it down within at most 72 hours, no account required.

Cookies & analytics

Honestly: our landing page currently uses no tracking cookies and no analytics. If that changes, we will update this policy before enabling them.

Changes

We will notify you in-app or by email before any material change takes effect, with the last-updated date shown above.

Contact

Zaffah team, Riyadh, Saudi Arabia · hello@zaffahapp.com