Privacy Policy
Operated by Althiqa Alzarqa Company, Commercial Registration No. 7050542989, Riyadh, Kingdom of Saudi Arabia.
- Effective date
- 1 August 2026
- Last updated
- 12 July 2026
1. Our commitment
Rukkab exists to move young women safely. The data we hold about you — where you live, where you study, when you travel, and the route you take — is data about your movements and your routine. We treat it accordingly.
This Policy explains what we collect, why, who we share it with, how long we keep it, and what rights you have. It is written to comply with the Personal Data Protection Law of the Kingdom of Saudi Arabia (PDPL) and its Implementing Regulations.
Two commitments are worth stating at the outset, because they are choices we made rather than obligations imposed on us:
- We do not sell your personal data. Not to advertisers, not to data brokers, not to anyone.
- We do not give your parents or guardians access to your travel history. See Section 7.
2. Data Controller
The controller of your personal data is:
Althiqa Alzarqa Company Commercial Registration No. 7050542989 Riyadh, Kingdom of Saudi Arabia
Data protection contact: support@rukkab.app
3. Who this Policy applies to
This Policy applies to Riders — the students who use our service.
Rukkab is available only to individuals aged eighteen (18) or over. We do not knowingly collect personal data from anyone under 18. If we become aware that we hold personal data of a person under 18, we will delete it and terminate the associated account.
4. What we collect
4.1 Information you give us
| Data | Examples | Why |
|---|---|---|
| Identity | Name, date of birth, national ID or Iqama number, gender | To verify eligibility, and to identify you to your Driver |
| Contact | Mobile number, email address | To communicate with you about your trips |
| Academic | Institution, campus, faculty, semester schedule | To match you to a Cluster and schedule |
| Location | Home address or pickup point, destination | To plan routes and place you in a Cluster |
| Payment | Payment card details, billing information | To take payment for your Subscription |
| Support | Messages you send us, reports you make | To respond to you and investigate issues |
4.2 Information we generate or collect automatically
| Data | Examples | Why |
|---|---|---|
| Trip data | Scheduled trips, boarding and alighting events, trip status, no-shows | To operate the service and to bill correctly |
| Vehicle location | The position of the vehicle during a Trip | To operate the service, provide arrival estimates, and enable live trip sharing |
| Device and app data | Device type, operating system, app version, IP address, crash logs | To keep the app working and secure |
| Communications metadata | Notifications sent to you and their delivery status | To confirm that safety-relevant messages actually reached you |
4.3 A note on location
We collect the location of the vehicle during a Trip. This is necessary to run the service.
We do not continuously track your personal device outside of a Trip. We do not build a picture of your movements when you are not travelling with us.
Your home or pickup address is collected as a fixed data point for route planning — not as a live location feed.
5. Why we process your data, and on what legal basis
Under PDPL we must have a lawful basis for each purpose.
| Purpose | Lawful basis |
|---|---|
| Creating and managing your account | Performance of a contract with you |
| Verifying your eligibility (age, gender, enrolment) | Performance of a contract; legal obligation |
| Forming Clusters, planning routes, scheduling Trips | Performance of a contract |
| Providing your details to the Transport Supplier and Driver so they can carry you | Performance of a contract |
| Taking payment, invoicing, and tax compliance | Performance of a contract; legal obligation (ZATCA) |
| Sending you trip notifications and safety alerts | Performance of a contract; legitimate interests (your safety) |
| Live trip sharing with a person you choose | Your consent — and only where you initiate it |
| Investigating safety reports and incidents | Legitimate interests (the safety of Riders and Drivers) |
| Responding to your support requests | Performance of a contract |
| Improving routes, schedules, and service quality | Legitimate interests |
| Complying with TGA, ZATCA, and other regulatory requirements | Legal obligation |
| Establishing, exercising, or defending legal claims | Legitimate interests |
Where we rely on consent, you may withdraw it at any time (Section 10). Withdrawing consent does not affect processing carried out before the withdrawal.
6. Who we share your data with
We share the minimum necessary in each case.
6.1 Transport Suppliers and Drivers. Your Driver needs to know who to collect, from where, and when. We share your first name, pickup point, destination, and scheduled time. We do not share your national ID, your payment details, your full address history, or your academic records with a Driver.
6.2 Payment processor. Payment card details are collected and processed directly by our payment processor. Rukkab does not store your full card number.
6.3 Technology service providers. We use third-party providers for database hosting, application hosting, workflow orchestration, messaging and notification delivery, error monitoring, and customer support. These providers process data on our instructions and are bound by contract to protect it. See Section 9 on international transfers.
6.4 Educational institutions. Where an institution is a party to the arrangement, we may confirm enrolment status. We do not report your individual travel patterns, attendance, or punctuality to your institution.
6.5 Regulators and authorities. We may disclose data where required by law, by a court, or by a competent authority such as the TGA or ZATCA.
6.6 In an emergency. Where there is a serious and imminent risk to your safety or the safety of another person, we may disclose data to emergency services or law enforcement.
6.7 We do not sell your personal data, and we do not share it with advertisers.
7. Parents and guardians
Rukkab is used by adults. We treat you as one.
7.1 We do not provide parents or guardians with access to your travel history, your routes, your past trips, or your location outside of a trip you have chosen to share.
7.2 Live trip sharing is yours to control. If you choose to share a live trip — with a parent, a friend, a flatmate, anyone — you initiate it, you choose the recipient, and it ends when the trip ends. It is a feature you use, not a permission granted over you.
7.3 We will not create an account for a parent or guardian, and we will not act on a request from a parent or guardian to disclose your data, except where we are required to do so by law.
8. How long we keep your data
We keep personal data only as long as necessary for the purpose it was collected for, or as required by law.
Saudi law does not prescribe a single retention period for all personal data. PDPL requires us to destroy personal data once it is no longer necessary for the purpose it was collected for, and to be able to justify the periods we set. Certain other laws impose minimum retention periods which override that principle. The table below sets out the periods we apply and the reason for each.
| Data | Retention period | Basis |
|---|---|---|
| Account and identity data | Duration of your account, then 24 months | Purpose limitation (PDPL). Retained to handle post-termination queries, billing disputes, and claims arising from the period of service |
| Trip location and route history | 12 months from the date of the Trip, then irreversibly anonymised | Purpose limitation (PDPL). Retained to investigate safety reports, resolve billing disputes, and analyse route performance. Anonymised thereafter so it can no longer be linked to you |
| Payment, invoicing, and tax records | 6 years from the end of the tax period to which they relate | Statutory minimum. Required by ZATCA under Saudi VAT rules. We cannot delete these earlier, even at your request |
| Accounting records | 10 years | Statutory minimum. Required under the Law of Commercial Books |
| Safety reports and incident records | 5 years from resolution | Purpose limitation (PDPL). Retained to establish, exercise, or defend legal claims, and to detect patterns across repeat incidents involving the same Driver or Supplier |
| Support communications | 24 months | Purpose limitation (PDPL). Service quality and dispute resolution |
| Notification delivery logs | 12 months | Purpose limitation (PDPL). Evidence that safety-critical messages were actually delivered to you |
| Records of our processing activities | 5 years after the processing ends | Statutory. Required under the PDPL Implementing Regulations. These are records about our processing, not about you individually |
Where a statutory minimum applies, it governs. This means that if you ask us to delete your data, we will delete what we lawfully can, but we must retain payment, invoicing, and accounting records for the periods above. This is a legal obligation, not a choice.
After the applicable period expires, data is deleted or irreversibly anonymised so that it can no longer be linked to you.
9. International transfers
We want to be straightforward with you about this, because it concerns where your data physically sits.
Rukkab is a Saudi company, operating in the Kingdom, serving students in the Kingdom. However, some of the technology providers we rely on — for database hosting, application hosting, workflow orchestration, route optimisation, notification delivery, error monitoring, and customer support — process data on servers located outside the Kingdom of Saudi Arabia.
This is common for software of this kind, but we would rather tell you plainly than leave it unsaid.
Where your personal data is transferred outside the Kingdom, we:
- transfer only what is necessary for the provider to perform its function;
- bind every provider by contract to protect your data and to process it only on our instructions;
- require security standards consistent with those described in Section 11;
- do not permit any provider to use your data for its own purposes.
PDPL restricts the transfer of personal data outside the Kingdom and permits it only in defined circumstances and subject to defined safeguards. We keep our arrangements under review to ensure they remain consistent with those requirements.
Financial records. Separately from PDPL, Saudi tax law requires that VAT and accounting records be kept within the Kingdom, or on a system that the Zakat, Tax and Customs Authority can access on request, and be maintained in Arabic. We maintain our financial records accordingly.
If you have questions about where your data is processed, contact us at support@rukkab.app.
10. Your rights
Under PDPL you have the right to:
(a) Be informed — to know what data we hold, why, and who we share it with. This Policy is part of how we meet that obligation.
(b) Access — to obtain a copy of your personal data.
(c) Request correction — to have inaccurate or incomplete data corrected.
(d) Request destruction — to have your personal data deleted, where we no longer need it for the purpose it was collected for, and where we are not required by law to keep it.
(e) Withdraw consent — where our processing is based on your consent, you may withdraw it at any time.
To exercise any of these rights, contact us at support@rukkab.app.
We will respond within the period required by PDPL. We may need to verify your identity before acting on a request — this is a protection for you, not an obstacle.
If you are not satisfied with our response, you have the right to complain to the Saudi Data & Artificial Intelligence Authority (SDAIA).
11. Security
We protect your data with measures including:
- encryption of data in transit and at rest;
- strict access controls, so that our staff and our suppliers can see only what they need to see;
- an immutable audit trail of access to sensitive records;
- secrets management, so that credentials are never stored in application code;
- monitoring and alerting for anomalous access;
- contractual security obligations on every provider that touches your data.
No system is perfectly secure. If a breach occurs that is likely to cause you harm, we will notify you and the competent authority as required by PDPL.
12. Cookies and similar technologies
Our website uses cookies necessary for it to function, and may use analytics cookies to understand how the site is used.
13. Changes to this Policy
We may update this Policy. Where a change is material, we will notify you before it takes effect. The date at the top of this Policy shows when it was last updated.
14. Contact us
Althiqa Alzarqa Company Commercial Registration No. 7050542989 Riyadh, Kingdom of Saudi Arabia
Privacy and data protection: support@rukkab.app General support: support@rukkab.app
You may also complain to the Saudi Data & Artificial Intelligence Authority (SDAIA).