Privacy Policy
Operated by Althiqa Alzarqa Company, Commercial Registration No. 7050867733, Riyadh, Kingdom of Saudi Arabia.
- Effective date
- 1 August 2026
- Last updated
- 28 August 2026
1. Our commitment
Rukkab exists to move young women safely. The data we hold about you — where you live, where you study, when you travel, and the route you take — is data about your movements and your routine. We treat it accordingly.
This Policy explains what we collect, why, who we share it with, how long we keep it, and what rights you have. It is written to comply with the Personal Data Protection Law of the Kingdom of Saudi Arabia (PDPL) and its Implementing Regulations.
Two commitments are worth stating at the outset, because they are choices we made rather than obligations imposed on us:
- We do not sell your personal data. Not to advertisers, not to data brokers, not to anyone.
- We do not give your parents or guardians access to your travel history. See Section 7.
2. Data Controller
The controller of your personal data is:
Althiqa Alzarqa Company Commercial Registration No. 7050867733 Riyadh, Kingdom of Saudi Arabia
Data protection contact: support@rukkab.app
3. Who this Policy applies to
This Policy applies to:
- Riders — the students who use our service; and
- Drivers — the captains contracted to drive Rukkab routes, whose personal data we process as described in section 4.4.
Where a section speaks only of Riders or only of Drivers, it says so. Everything else applies to both.
Rukkab is available only to individuals aged eighteen (18) or over. We do not knowingly collect personal data from anyone under 18. If we become aware that we hold personal data of a person under 18, we will delete it and terminate the associated account.
4. What we collect
4.1 Information you give us
| Data | Examples | Why |
|---|---|---|
| Identity | Name, date of birth, national ID or Iqama number, gender | To verify eligibility, and to identify you to your Driver |
| Contact | Mobile number, email address | To communicate with you about your trips |
| Academic | Institution, campus, faculty, semester schedule | To match you to a Cluster and schedule |
| Location | Home address or pickup point, destination | To plan routes and place you in a Cluster |
| Payment | Payment card details, billing information | To take payment for your Subscription |
| Support | Messages you send us, reports you make | To respond to you and investigate issues |
4.2 Information we generate or collect automatically
| Data | Examples | Why |
|---|---|---|
| Trip data | Scheduled trips, boarding and alighting events, trip status, no-shows | To operate the service and to bill correctly |
| Vehicle location | The position of the vehicle during a Trip | To operate the service, provide arrival estimates, and enable live trip sharing |
| Device and app data | Device type, operating system, app version, IP address, crash logs | To keep the app working and secure |
| Communications metadata | Notifications sent to you and their delivery status | To confirm that safety-relevant messages actually reached you |
4.4 Drivers
We process the following from Drivers. It is collected through the Rukkab Driver app and through the onboarding we carry out before a Driver may drive a route.
| Data | Examples | Why |
|---|---|---|
| Identity | Name, national ID or Iqama number, gender | To verify who is driving, and to show your name and photo to the Riders on your route before they board |
| Licensing | Driving licence number and expiry, TGA operating card number and expiry, and photographs of both | To confirm you are lawfully permitted to carry passengers, as the Transport General Authority requires |
| Contact | Mobile number, WhatsApp number, email address | To reach you about your routes and in an emergency |
| Vehicle | The vehicle assigned to you, its registration and insurance documents | To confirm the vehicle is roadworthy and insured, and to show its plate to Riders |
| Precise location | The position of your device while a Trip is in progress | To show waiting Riders how far away the bus is, and to locate you immediately if an SOS is raised |
| Trip records | Trips driven, boarding and absence marks you record, delays you report | To operate the service and to resolve disputes |
| Photographs you submit | Evidence attached to a no-show report or a safety report | To investigate what you have reported |
| Device data | Push notification token, an app-generated device identifier, device type and app version | To send you trip alerts, and to let you sign out of a device you no longer have |
A Driver's location. Location is requested only when a Trip is in progress and stops when the Trip ends. The app does not request background location and cannot collect your position while it is closed. During a Trip your position is shared with the Riders booked on that Trip and with Rukkab safety staff — this is the same feed a Rider sees as "your bus is 4 minutes away".
Drivers see no financial data in the Driver app. Earnings, payouts and fares are not shown there. Payment to a Driver's employing transport company is handled outside the app.
4.3 A note on location
We collect the location of the vehicle during a Trip. This is necessary to run the service.
For Riders, we do not track your personal device at all — the rider app requests no device location. For Drivers, we do not continuously track your personal device outside of a Trip. We do not build a picture of your movements when you are not travelling with us.
Your home or pickup address is collected as a fixed data point for route planning — not as a live location feed.
5. Why we process your data, and on what legal basis
Under PDPL we must have a lawful basis for each purpose.
| Purpose | Lawful basis |
|---|---|
| Creating and managing your account | Performance of a contract with you |
| Verifying your eligibility (age, gender, enrolment) | Performance of a contract; legal obligation |
| Forming Clusters, planning routes, scheduling Trips | Performance of a contract |
| Providing your details to the Transport Supplier and Driver so they can carry you | Performance of a contract |
| Taking payment, invoicing, and tax compliance | Performance of a contract; legal obligation (ZATCA) |
| Sending you trip notifications and safety alerts | Performance of a contract; legitimate interests (your safety) |
| Live trip sharing with a person you choose | Your consent — and only where you initiate it |
| Investigating safety reports and incidents | Legitimate interests (the safety of Riders and Drivers) |
| Responding to your support requests | Performance of a contract |
| Improving routes, schedules, and service quality | Legitimate interests |
| Complying with TGA, ZATCA, and other regulatory requirements | Legal obligation |
| Establishing, exercising, or defending legal claims | Legitimate interests |
Where we rely on consent, you may withdraw it at any time (Section 10). Withdrawing consent does not affect processing carried out before the withdrawal.
6. Who we share your data with
We share the minimum necessary in each case.
6.1 Transport Suppliers and Drivers. Your Driver needs to know who to collect, from where, and when. We share your first name, pickup point, destination, and scheduled time. We do not share your national ID, your payment details, your full address history, or your academic records with a Driver.
6.2 Payment processor. Payment card details are collected and processed directly by our payment processor. Rukkab does not store your full card number.
6.3 Technology service providers. We use third-party providers for database hosting, application hosting, workflow orchestration, messaging and notification delivery, error monitoring, and customer support. These providers process data on our instructions and are bound by contract to protect it. See Section 9 on international transfers.
6.4 Educational institutions. Where an institution is a party to the arrangement, we may confirm enrolment status. We do not report your individual travel patterns, attendance, or punctuality to your institution.
6.5 Regulators and authorities. We may disclose data where required by law, by a court, or by a competent authority such as the TGA or ZATCA.
6.6 In an emergency. Where there is a serious and imminent risk to your safety or the safety of another person, we may disclose data to emergency services or law enforcement.
6.7 We do not sell your personal data, and we do not share it with advertisers.
7. Parents and guardians
Rukkab is used by adults. We treat you as one.
7.1 We do not provide parents or guardians with access to your travel history, your routes, your past trips, or your location outside of a trip you have chosen to share.
7.2 Live trip sharing is yours to control. If you choose to share a live trip — with a parent, a friend, a flatmate, anyone — you initiate it, you choose the recipient, and it ends when the trip ends. It is a feature you use, not a permission granted over you.
7.3 We will not create an account for a parent or guardian, and we will not act on a request from a parent or guardian to disclose your data, except where we are required to do so by law.
8. How long we keep your data
We keep your data only as long as we need it, or as long as the law makes us.
| What | How long we keep it |
|---|---|
| Your account and identity details | While your account is open, then 24 months |
| Your trip history and routes | 12 months after each trip, then anonymised so it can no longer be linked to you |
| Messages you send us | 24 months |
| Safety reports and incidents | 5 years after the matter is resolved |
| Records that a safety message reached you | 12 months |
| Payments, invoices and tax records | 6 years — required by law |
| Accounting records | 10 years — required by law |
The last two are not our choice. Saudi tax and commercial law sets them, and they apply even if you ask us to delete your data. Where that happens, we delete everything we are allowed to delete and keep only what the law requires us to keep — and we stop using it for anything else.
After a period ends, the data is deleted, or anonymised so thoroughly that it can no longer be connected to you.
9. International transfers
We want to be straightforward with you about this, because it concerns where your data physically sits.
Rukkab is a Saudi company, operating in the Kingdom, serving students in the Kingdom. However, some of the technology providers we rely on — for database hosting, application hosting, workflow orchestration, route optimisation, notification delivery, error monitoring, and customer support — process data on servers located outside the Kingdom of Saudi Arabia.
This is common for software of this kind, but we would rather tell you plainly than leave it unsaid.
Where your personal data is transferred outside the Kingdom, we:
- transfer only what is necessary for the provider to perform its function;
- bind every provider by contract to protect your data and to process it only on our instructions;
- require security standards consistent with those described in Section 11;
- do not permit any provider to use your data for its own purposes.
PDPL restricts the transfer of personal data outside the Kingdom and permits it only in defined circumstances and subject to defined safeguards. We keep our arrangements under review to ensure they remain consistent with those requirements.
Financial records. Separately from PDPL, Saudi tax law requires that VAT and accounting records be kept within the Kingdom, or on a system that the Zakat, Tax and Customs Authority can access on request, and be maintained in Arabic. We maintain our financial records accordingly.
If you have questions about where your data is processed, contact us at support@rukkab.app.
10. Your rights
Under PDPL you have the right to:
(a) Be informed — to know what data we hold, why, and who we share it with. This Policy is part of how we meet that obligation.
(b) Access — to obtain a copy of your personal data.
(c) Request correction — to have inaccurate or incomplete data corrected.
(d) Request destruction — to have your personal data deleted, where we no longer need it for the purpose it was collected for, and where we are not required by law to keep it.
(e) Withdraw consent — where our processing is based on your consent, you may withdraw it at any time.
To exercise any of these rights, contact us at support@rukkab.app.
We will respond within the period required by PDPL. We may need to verify your identity before acting on a request — this is a protection for you, not an obstacle.
If you are not satisfied with our response, you have the right to complain to the Saudi Data & Artificial Intelligence Authority (SDAIA).
11. Security
We protect your data with measures including:
- encryption of data in transit and at rest;
- strict access controls, so that our staff and our suppliers can see only what they need to see;
- an immutable audit trail of access to sensitive records;
- secrets management, so that credentials are never stored in application code;
- monitoring and alerting for anomalous access;
- contractual security obligations on every provider that touches your data.
No system is perfectly secure. If a breach occurs that is likely to cause you harm, we will notify you and the competent authority as required by PDPL.
12. Cookies and similar technologies
Our website does not use cookies at all.
We use no analytics, no tracking tools, and no third-party scripts on the site.
The site uses a single item of session storage in your browser, whose only purpose is to remember whether you have already seen the opening animation in this session, so it is not repeated. It:
- is necessary for the site to work as intended;
- contains no personal data;
- is never sent to our servers or to anyone else;
- is erased automatically when you close the browser tab.
Because the site sets no non-essential cookie, no cookie consent mechanism is required. If that ever changes, we will update this section and provide the necessary consent mechanism before enabling any such tool.
13. Changes to this Policy
We may update this Policy. Where a change is material, we will notify you before it takes effect. The date at the top of this Policy shows when it was last updated.
14. Contact us
Althiqa Alzarqa Company Commercial Registration No. 7050867733 Riyadh, Kingdom of Saudi Arabia
Privacy and data protection: support@rukkab.app General support: support@rukkab.app
You may also complain to the Saudi Data & Artificial Intelligence Authority (SDAIA).