Zaffah · زفّة

Privacy Policy

Last updated: 22 July 2026

Who we are

Zaffah (زفّة) is a Saudi platform for wedding planning and for booking venues and wedding services, based in Riyadh. The data controller is the Zaffah founding team; upon completion of our company registration, this responsibility passes automatically to the registered Zaffah entity, with no change to our obligations to you. We comply with the Saudi Personal Data Protection Law (PDPL) and its Implementing Regulations, under the supervision of the Saudi Data & AI Authority (SDAIA).

Privacy contact: [email protected]

What we collect

Only what the product actually needs:

• Account & sign-in: your mobile number (verified by an SMS one-time code), your name and city.
• Wedding journey: your wedding date, checklist tasks, and budget items you record.
• Guest list: the names and phone numbers of your guests, if you add them. This is other people’s data entered by you: add only people you genuinely intend to invite. Anyone on a guest list may ask us to remove their details (see "Guests' rights").
• Invitations: the invitation text, couple names, date and venue, shared by link or SMS; we count link opens.
• Chat: text and images exchanged with partners. Messages are automatically scanned to block the sharing of off-platform contact details (phone numbers, email addresses, messaging or social handles), to keep the conversation on Zaffah. Bank and payment details (such as IBANs) may be shared so you and the partner can arrange payment directly: Zaffah is not a party to those payments and is not responsible for them.
• Reservations & reviews: booking requests you send, and reviews published after moderation.
• Partners (venues, planning offices, photo studios): organisation and staff account details, roles and resource access, venue photos, prices, and calendars.
• Portfolios: photos from past events uploaded by a partner to its profile, which may show people's faces. By uploading, the partner attests it has the documented permission of the people who appear in them, photos are reviewed before they appear in the app, and anyone appearing in a photo may ask us to remove it (see "Portfolio subjects' rights").
• Notifications: device tokens and web-push subscriptions used to deliver alerts.
• Waitlist (zaffahapp.com): your phone number and optional first name, with your consent, solely to notify you at launch, along with minimal technical data to prevent automated submissions (page language and browser type).
• Wedding-service partnership records: the establishment's name, its service type (venue, photography, catering, styling, or other), city and contact number, plus optionally its email or Instagram handle, whether submitted by the establishment through the "Register your service" form on zaffahapp.com or recorded by our team from direct contact or the establishment's public channels, used solely to communicate about and follow up the partnership, with the source of every record noted, along with minimal technical data to prevent automated submissions (page language and form fill time).
• Venue map location: the venue's pin coordinates and a nearby-landmark line written by the partner, business data the partner provides itself and our team reviews before it appears, used solely to guide couples and their guests to the venue. Zaffah's maps are hosted entirely on our own servers, so browsing the map sends nothing to any other party, and we never ask for your device location.
• Technical logs: basic operational and audit logs for platform security and troubleshooting.

We do not process any payments or deposits in this version of the product.

Why we collect it (legal basis)

We process your data to perform the service you asked for, creating your account, organising your wedding, messaging venues, handling booking requests, and with your consent where the law requires it (such as the waitlist and notifications). We do not sell your data or use it for third-party advertising.

Who sees your data

• Partners (the venue, office, or studio) see only what your request needs: your name, event date, request details, and your messages to them. They never see your guest list or budget.
• Processors acting for us: our SMS provider (verification codes and invitations), hosting provider, and push-notification provider, under contracts that bind them to protect your data, receiving only the minimum necessary.
• The "Open directions" button: tapping it is your choice to hand off to the maps app you use (such as Google or Apple Maps), carrying only the venue's name and coordinates; that app's own policy applies from there. We never call any maps provider ourselves.
• We disclose data to no one else except where the law requires.

Storage & PDPL

Your data is stored with a hosting provider under our security controls, and every storage-location or cross-border decision is made in compliance with the PDPL and the Data Transfer Regulations. Plain-language caveat: the launch waitlist is temporarily held in a cloud spreadsheet tool whose servers may be outside Saudi Arabia; we keep it to the minimum and will migrate it into our own systems before launch.

Retention

• Account and wedding data: as long as your account exists; deleted when you delete it.
• One-time codes: minutes, then purged automatically.
• Chat: while your account is active.
• Waitlist: until launch, then deleted unless you create an account.
• Portfolio photos: as long as the partner's account exists. When a subject asks, we take the photo down within at most 72 hours; when the partner account is deleted the photos are deleted, and backup copies expire within the normal backup cycle.
• Partnership records: while the conversation is live; if a partnership does not go ahead, the details are deleted or anonymised within 12 months of the record closing. On a deletion request we delete the record and keep only a minimal do-not-contact marker so we never approach the requester again.
• Operational and audit logs: 12 months, then deleted or anonymised.

Your rights

You may access, export, correct, and delete your data. In practice: the app includes Export my data and Delete my account (a full deletion covering your profile, wedding journey, and guests). For corrections or anything else, email [email protected]; we respond within the statutory timelines.

Guests' rights

If someone added your name or number to their guest list on Zaffah, email [email protected] and we will remove your details, no account required.

Portfolio subjects' rights

If your photo appears in a partner's portfolio on Zaffah, email [email protected] and we will take it down within at most 72 hours, no account required.

Cookies & analytics

Honestly: our landing page currently uses no tracking cookies and no analytics. If that changes, we will update this policy before enabling them.

Changes

We will notify you in-app or by email before any material change takes effect, with the last-updated date shown above.

Contact

Zaffah team, Riyadh, Saudi Arabia · [email protected]