Privacy notice

Who is responsible for your data

The operator of Naqra is nakra, a company based in the Kingdom of Saudi Arabia. For anything related to your personal data, contact us at omarbaaiz@hotmail.com.

When you rate a visit through a card, the business you visited is the party you are dealing with. Naqra stores and processes that data on the business's behalf so that the business can read your feedback and, if you asked for it, contact you.

If you tapped a card and rated a visit

The rating page opens in your browser without an app or an account. We ask for as little as possible.

• Your rating from 1 to 5 stars.
• An optional note, in your own words.
• Your phone number, only if you tick the option asking the manager to contact you and type it in yourself. The phone field is optional and nothing else on the page depends on it.
• The language you used, the time of the visit, and which card and branch you tapped.
• For protection against abuse: a coarse description of your device type and a scrambled version of your network address that changes every day and cannot be turned back into the address. We do not store your full address.

We use this data for one purpose: to let the business know how the visit went and, if you asked, to let it contact you about that visit. The rating and note are sent only when you press one of the two buttons on the page. You can leave without sending anything.

The sentence next to the phone field tells you how long your number is kept. By entering your number you agree that the business may contact you about this visit only. The business must not use your number for advertising or for anything unrelated to the visit. If it does, tell us and we will act.

How long we keep customer data

Each business chooses a retention period for the notes and phone numbers it receives. The default is 12 months and the maximum is 24 months. A weekly job deletes phone numbers and notes that are older than the period. Only the star rating and the counts remain, and they cannot identify you.

You can ask for your data to be deleted earlier at any time, either through the business or by writing to us. Ask us and we will find every record linked to your phone number in that business and delete it.

Who can see customer data

The owner of the business and the branch managers the owner authorises can see ratings and notes for their branches. Phone numbers are stored encrypted and shown only to authorised users, and every time a number is revealed the event is recorded with who revealed it and when.

Naqra's own staff can access data only to run the service, answer support requests, investigate abuse or fulfil a deletion request. Every such access is logged.

We do not sell personal data, we do not use it for advertising, and we do not share it with anyone other than the business and the providers listed below.

Posting a review on Google

The button that opens Google Maps takes you to Google's own review page. What you write there is a public Google review governed by Google's terms and privacy policy, not by this notice. Naqra does not see, edit or suggest what you write.

If the business connects its Google Business Profile to Naqra, we fetch the public reviews of that business, including the display name Google shows for the reviewer, so that the owner can read and reply to them from one place.

If you own or work at a business that uses Naqra

To run your account we store your name, email address, a hashed version of your password, the phone numbers you add for WhatsApp alerts, your business details such as the legal name, VAT number and address, your branches and logo, and your subscription and invoice history.

When you connect Google, we store the access tokens Google issues, encrypted, and use them only to read your reviews and publish the replies you approve. When you pay, Moyasar gives us a token that stands for your card; the card number itself never reaches Naqra.

We also keep security and activity logs: sign-ins, changes to settings and team members, and each time a customer's phone number is revealed. These logs protect you and your customers and are kept for as long as your account exists.

We use this data to provide the service, to send the alerts and reports you asked for, to issue tax invoices as Saudi VAT law requires, to keep the service secure and to answer your requests. Emails and WhatsApp messages from us are about your account and your service; we do not send advertising to your customers.

Your data is kept while your account is active. When a business is closed, its data is soft-deleted for 30 days and then removed, except for invoices and accounting records, which we must keep for the period required by Saudi tax law.

If you contact us through the website

The contact form asks for your name, business name, city, number of branches and phone number. We use them to reply to you about Naqra and for nothing else. The phone number is stored encrypted.

We keep this information while we are in contact with you about Naqra and delete it when it is no longer needed for that purpose. You can ask us to delete it at any time.

Providers that process data for us

Naqra relies on a small number of providers. Each one receives only the data needed for its task.

• Twilio, for sending WhatsApp messages such as alerts, reports and invoice reminders to the numbers a business adds.
• Resend, for sending account emails such as email verification and invoices.
• Anthropic, for drafting replies to Google reviews and for the analysis in the monthly report. It receives review text and note text only; phone numbers and names are removed before anything is sent.
• Google, for finding a business's Place ID during setup and, when the owner connects Google, for reading and replying to its Business Profile reviews.
• Moyasar, for taking payments. Card details are entered on Moyasar's own secure form and never touch Naqra's servers.
• The hosting provider that runs our servers and stores the backups. The server location is to be confirmed at deployment and will be stated here once it is fixed.

Some of these providers process data outside the Kingdom. We send them only the minimum each task needs, and we keep a record of what is sent, to whom and why.

How we protect data

These measures apply to all data in the service.

• All traffic is encrypted in transit (HTTPS).
• Customer phone numbers, alert recipient numbers, Google tokens, provider credentials and payment tokens are encrypted at rest.
• Access is limited by role, and sensitive actions are logged.
• A backup is taken every day and kept for 14 days.
• The rating page sets no tracking cookies and loads no third-party scripts. The only stored token is a signed device token used to avoid counting the same tap twice.

If a security incident affects your data, we will inform the affected businesses and, where the law requires it, the competent authority and the people concerned.

Your rights

You have the right to know what personal data we hold about you, to get a copy of it in a readable format, to correct it and to have it deleted. You can also withdraw the consent you gave for your phone number at any time, and withdrawing it is as easy as giving it: ask the business or write to us.

To exercise any of these rights, write to omarbaaiz@hotmail.com with the phone number or email address you used. We answer within 30 days. If we need more time, we will tell you why and when to expect our answer.

You can also complain to the Saudi Data and Artificial Intelligence Authority (SDAIA) if you believe your rights have not been respected.

Changes to this notice

When we change this notice we update the date at the top. If a change affects how we use data in a meaningful way, we tell businesses by email before it takes effect.

Contact

nakra, Kingdom of Saudi Arabia. Email: omarbaaiz@hotmail.com.