This policy explains what personal data RABL collects through its website and mobile apps, why, who can see it, how long it is kept, and the rights you have under the Saudi Personal Data Protection Law (PDPL).
RABL keeps this simple: we collect what the marketplace and the farming tools need to work, we do not sell your data, and we do not use advertising, analytics or crash-reporting services.
1. Who we are
RABL is operated by [Company legal name] (Commercial Registration [CR number], VAT number [VAT number]), [Registered address]. We are the controller of the personal data described here.
For any privacy question or request, write to [Privacy contact email].
2. What this policy covers
This policy covers the RABL mobile apps (Android and iOS) and the RABL website, including the marketplace, the farming tools, the seller workspace and the support pages.
Sellers on RABL are independent businesses and farmers. When you buy from or contact a seller, the seller receives the details described below and handles them under its own responsibility.
3. Data we collect
Account and sign-in:
- Mobile number (required): used to sign in with a one-time code sent by SMS.
- First and last name (required).
- Email address and password (optional, for email sign-in). The password is stored only as a secure hash.
- Your preferred language.
Shopping:
- Delivery addresses you add, and the coordinates if you add them.
- Orders and purchase history: products, prices, the seller, pickup or delivery details and the order status.
- Your cart, favorites and reward points (when the rewards program is active).
- Questions (inquiries) you send to sellers about a product.
Farming:
- Farm details you enter: name, area, region and city, address text, precise coordinates and an optional cover photo.
- Your plantings and crop records.
- Crop listings you publish: text, price and photos.
Selling:
- Company details: Commercial Registration, unified number, business contact, logo and store cover.
- Seller applications and their documents (for example an agricultural registration, or the licence required to sell crop-protection products).
- Optional bank details (IBAN and account holder name). RABL processes no payouts today.
Safety and support:
- Reports you submit about listings, stores or sellers, and the sellers you block.
- Messages you send through the contact form (name, email, optional phone and message).
Technical:
- Your account ID and sign-in sessions (only a hashed session token; no IP address or device details are stored with a session).
- A notification token for your device, if the app registers one.
- Server logs with the IP address, account ID and the address requested, kept for security and operations.
- Your location only if you tap "Use my current location" when adding a farm: the app reads it once, in the foreground, to fill in the coordinates. RABL never tracks your location in the background.
4. Plant diagnosis photos
When you use plant diagnosis, the app asks for your consent first, then sends the leaf photo to RABL's server for analysis.
- In the current phase the photo is not stored: it is analysed and discarded. We keep only a record of the request (the result status and confidence, the analysis service used, the time) and your feedback if you give it.
- When RABL connects an external AI service, the photo will be sent to that provider for analysis only. The provider will be named here ([AI provider name]) and in the app before it is used.
- A diagnosis is guidance, not a professional opinion. See the Terms of Use.
5. What we do not collect
- No advertising: RABL shows no ads and uses no advertising identifiers.
- No analytics or tracking services, and no tracking across other apps or websites.
- No crash-reporting service.
- No contacts, calendar, microphone recordings or background location.
- No payment card details: payment is arranged directly between buyer and seller, outside RABL.
6. How we use your data
- To create your account, sign you in and keep your account secure.
- To run the marketplace: show products, place orders with sellers, deliver inquiries, and apply coupons and reward points.
- To provide the farming tools: farms, plantings, the agricultural calendar and guidance.
- To review seller applications, products and crop listings before they are published, and to handle reports.
- To answer your support requests.
- To meet legal obligations (for example keeping order records) and to prevent fraud and abuse.
We rely on the contract with you (providing the service), your consent (for example plant diagnosis and optional data), our legitimate interests (security, fraud prevention) and legal obligations.
8. Where your data is stored and transfers
Our servers are hosted by Hostinger in [Hosting location]. If personal data is processed outside the Kingdom of Saudi Arabia, we transfer only what is needed for the service and apply the safeguards required by the PDPL and its regulations.
9. How long we keep data
- Account data: as long as your account is open. When you close it, it is deleted or anonymised as described below.
- Orders: kept for accounting, legal and dispute purposes for [Order record retention period]. After closure an order is no longer linked to a usable account, but the delivery details recorded on it (recipient name, phone and address) stay on that order for the seller and RABL until the period ends.
- Server logs: [Log retention period].
- Audit records of changes: kept to protect the platform, with your location details and names removed when you close your account.
- Contact-form messages: as long as needed to answer you; ask us to delete them at any time.
10. Deleting your account
You can delete your account at any time in the app (Account → Delete account) or on the web at Delete your account.
What is deleted or anonymised:
- Your mobile number, email, password and language preference; your name is replaced by "Closed account".
- Your addresses, farmer profile, personal bank details, plantings, favorites, cart and device notification tokens.
- The address and coordinates of your farms; your crop listings are archived and no longer shown.
- Your photos and files (farm cover, crop-listing photos, seller documents, profile image) are queued for deletion from our storage.
- Notification delivery addresses are cleared, and every session ends.
What is kept: order records (see retention), audit records without your location details and names, and the messages you sent to sellers (shown as from a closed account).
If you own a company account and are its only member, the company is closed with your account: its contact details and address are anonymised, its products are unpublished, and its orders are kept. If the company has other members, you can send a deletion request; RABL handles it within 30 days.
11. Your rights
Under the PDPL you have the right to:
- be informed about how your data is used (this policy);
- access your data and receive a copy;
- correct inaccurate or incomplete data;
- have your data deleted when it is no longer needed (see Deleting your account);
- withdraw your consent where we rely on it.
Send your request to [Privacy contact email]. We answer within 30 days. You may also complain to the Saudi Data and Artificial Intelligence Authority (SDAIA).
12. Security
Data travels encrypted (TLS). Passwords and session tokens are stored only as hashes. On your phone, sign-in tokens are kept in the system keychain or keystore. Access to personal data inside RABL is limited to the staff who need it, and changes are recorded in an audit trail.
13. Children
RABL is not directed at children. You must be at least [Minimum age] to create an account.
14. Changes to this policy
We will update this page when our practices change and show the new effective date. Important changes will also be announced in the app.
15. Contact
Privacy questions and requests: [Privacy contact email].
General support: [Support email], [Support phone/WhatsApp], or the Support page.