Heavyar Privacy Policy

1. Controller and scope

Heavyar is the controller for data whose purposes and means it determines to operate the platform. This Policy covers Customers, Providers, Drivers, website visitors and support users.

2. Sources

We receive data from registration, profiles, listings, Requests, chat and support; device and service use; counterparties and processors; and competent authorities where lawfully justified.

3. Account and contact data

We may process name, email, phone number, user identifier, profile image, language, role and account status.

4. Business, equipment and location

We may process provider type, commercial-registration number and submitted business data; equipment specifications, images, ownership or authority, condition, price and availability; region, city and approximate location; and an optional precise equipment, work-site or chat pin chosen by the user.

5. Location pins and access

A location may be selected manually on the map. Heavyar requests foreground precise-location permission only after an explicit action such as “Use my location”, and providing precise device location is not mandatory when manual selection is available. Exact equipment coordinates are excluded from public equipment projections and remain available only to the equipment owner. A work-site pin is visible only to authorized rental participants, and a chat pin is a static location shared by the user with authorized conversation participants. Heavyar does not continuously track location or track it in the background.

6. Maps and third-party processing

Heavyar uses MapLibre with MapTiler services to display map styles and tiles. MapTiler may process technical requests needed to deliver map content, such as network address, device or connection information, and the requested map resource or viewed map area, under its policies. Heavyar stores and shares pins under the access controls above; a pin being overlaid in the app does not by itself mean MapTiler receives the saved exact pin record.

7. Location feature release status

The M1 maps and pins capability is implemented in source prepared for a future native release but has not yet been publicly distributed. The currently distributed release therefore does not activate M1 precise-pin collection. When an approved release makes it available, the disclosures and permission and access controls above apply; a source capability is not active for users merely because it is documented.

8. Requests and content

We process equipment and Driver Requests, rental, handover and completion states, chat, ratings, complaints, evidence, images, notifications and preferences.

9. Technical and security data

We may process push tokens, installation or request identifiers, logs, network address, security events and diagnostics needed for operation and fraud prevention, not cross-app advertising tracking.

10. Payments

We process transaction amount, currency, status and references for Requests, invoices and support. Card data is entered with Tap in a hosted flow; Heavyar does not store the full card number or CVV.

11. Data categories not collected

Heavyar does not currently collect the following categories within the scope described here, and future capabilities must not be treated as active now.

• National ID, passport or government identity document.
• Bank-account number, IBAN or payout-bank details.
• Contacts or microphone data.
• Data for cross-app advertising tracking.

12. Purposes and lawful bases

Data supports authentication, marketplace operation, Requests, hosted payments, communications, support, notifications, fraud prevention, rights protection and compliance. The basis may be requested service, legal duty, consent or legitimate interest not overridden by the person's rights.

13. Minimization and accuracy

We collect what is necessary, review minimization and ask users to keep data current. Data is not used for an incompatible purpose without an appropriate basis and disclosure.

14. Marketplace sharing

Counterparties receive only what is needed to perform a Request, such as listing, communication, appropriate operational location and status. Data may not be used outside the transaction or disclosed without authority.

15. Processors

Where needed, we use Firebase for authentication, data and notifications; Cloudflare for hosting and protection; Cloudinary for media; Expo for app and notifications; Resend for email; and Tap for hosted payments.

16. Lawful disclosure

Specific data may be disclosed to a competent authority or court under a valid request or legal duty, or proportionately to protect rights, safety and prevent fraud. We do not sell personal data.

17. Cross-border processing

Some processors may require processing outside Saudi Arabia. Purpose, necessity, protection level, appropriate safeguards and minimization must be assessed under the PDPL and transfer regulation. This does not mean every category is transferred.

18. Retention and destruction

Heavyar applies category-specific retention: transaction, payment, invoice and related dispute records follow a seven-year operational period from closure; completed privacy cases not tied to a transaction follow three years; notification inbox records follow 180 days; and temporary records are deleted on expiry. These are owner operational periods, not claims of a single statutory duration. Destruction pauses for a lawful duty, dispute or hold, after which data is deleted, destroyed, anonymized or restricted. Limited backups may remain until secure rotation with restricted use.

19. Account deletion

Deletion starts in-app from Profile or Settings. The account is locked and processing begins; limited transaction, invoice, refund, audit or dispute records may remain where necessary. If access is unavailable, contact support and never send a password.

20. Security and incidents

We use risk-appropriate access controls, permissions, secret separation, transport encryption, audit records and monitoring. No method is absolutely secure. We assess and contain incidents and notify authorities and people where required.

21. Data-subject rights

Subject to law and lawful limits, a person may be informed of basis and purpose; access data and receive a clear copy; request correction, completion and update; request destruction where applicable; and withdraw consent when it is the basis without retroactive effect. Identity may be verified.

22. Complaints

Rights, questions and complaints may be submitted in-account or at the email below. This does not prevent escalation to SDAIA or another competent Saudi authority.

23. Children and capacity

The platform is not directed to children or persons lacking capacity for these services. Data submitted without an appropriate basis for a person lacking capacity may be restricted or deleted subject to law.

24. Automation, ads and website storage

Heavyar does not currently use solely automated profiling for legal or similarly significant decisions, sell data or use behavioral advertising. The website uses necessary local storage for language and core functions and does not claim unimplemented analytics.

25. Changes and contact

We publish the update date and provide appropriate notice of material changes where required. Never send passwords or card details when contacting us.