Privacy Policy

1Who we are and scope

The Sknak platform is owned and operated by Cellix Technical Solutions in the Kingdom of Saudi Arabia. This policy explains how we collect, use, and protect your personal data when you use the website, the apps, and the platform portal, in compliance with the Saudi Personal Data Protection Law (PDPL) and its implementing regulations.

2Data we collect

We collect the minimum needed to operate owners' association services:

• Account data: name, email, mobile number, unit number, and platform role (chairman, property manager, owner, service firm, firm manager, or technician).
• Complex data: complex name and type, unit count, association registration number, budget and payment records, contracts and vendors.
• Usage content: maintenance tickets and their comments, announcements, votes, utility bills, and uploaded documents and photos — including work-completion proof photos taken with the in-app camera. The camera is also used to scan asset stickers (QR codes): the code is read on the device itself, and we neither upload the scan image to our servers nor retain it. On Android the read is performed by the Google Play services scanner installed on the device, which is what the notice shown during scanning refers to.
• Technical data: device identifier, push notification token (APNs on iOS, FCM on Android), browser type, and sign-in and usage logs. At sign-in and when an account is being created we record the connection (IP) address, the device model, the system version and the app build, to protect your account and to fix faults; only the platform's super admin can see them, and the address and device details are removed from the signup record after 90 days. If the app cannot complete an action — a lost connection, an error or a crash — it sends a short technical report: which action, the error code and the sentence you were shown, with the app build and the device model. The report does not include what you typed or your phone number.
• Payment data: payment is currently made by bank transfer, and we keep the transfer receipt you upload for review and proof of payment. We do not collect credit-card details; if a licensed payment gateway is added later, card data will be processed by it and never stored on our systems.
• Location: a technician's current location is shared with the association chairman and the service firm concerned during work, and only while the technician switches sharing on themselves. Location permission is requested only at that moment, we never track location in the background, and it can be turned off at any time.
• Performance and crash data: we use Firebase Analytics and Firebase Crashlytics (from Google) to measure app usage and detect crashes, which covers app interactions, crash logs, diagnostics and an installation identifier. We do not use the advertising ID and we do not show ads.

3Purposes of processing

We process data only for the following purposes:

• Operating the association's daily services: tickets, collection, contracts, preventive maintenance, and voting.
• Sending service-related notifications and alerts (emergencies, announcements, dues).
• Managing subscriptions, billing, and issuing financial documents.
• Improving the platform, measuring performance, preventing abuse, and protecting security.
• Complying with Saudi regulations and responding to binding legal requests.

4Legal basis for processing

We rely on the performance of the contract with the association or the user, explicit consent where required, our legitimate interest in operating and securing the platform, or legal obligation — as determined by the Personal Data Protection Law.

5Data sharing and processors

We do not sell or trade your personal data. We share it only with:

• Technical service providers acting as data processors: Microsoft Azure, which hosts the platform's servers, database, and files; Apple (APNs) and Google (FCM), which deliver push notifications to your device and receive nothing beyond the device notification token and the content of the notification sent to it; and Google Firebase (Analytics and Crashlytics), which measure performance and detect crashes in the app. Each of them processes the data under its applicable data processing terms (DPA) and contractual commitments.
• The banks subscription transfers pass through, and any licensed local payment gateway adopted later to process subscription payments.
• Members of your complex according to role and permission: for example, the chairman can view owner names, unit numbers, and payment status for operational purposes.
• Government or judicial authorities where there is a binding legal request.

6Storage and data transfers

Platform data is hosted on Microsoft Azure infrastructure, on servers we operate ourselves, in the United Arab Emirates region (UAE North/Central), which holds the database (PostgreSQL), the uploaded files (object storage) and the website itself. That region is outside the Kingdom of Saudi Arabia, so this constitutes a transfer of data outside the Kingdom and is subject to the transfer controls of the Personal Data Protection Law, with appropriate contractual and technical safeguards including encryption in transit and at rest. Notification data may also be processed by the notification providers named above, in other regions.

7Retention period

We keep data for as long as the account or complex is active. When an account is closed or the contractual relationship ends, we delete or anonymize personal data within ninety (90) days, unless the law requires longer retention (such as financial records and audit logs).

8Your rights under the law

As a data subject, you have the following rights:

• To be informed of how your data is collected and processed.
• To request a copy of your personal data in a readable format.
• To request correction or completion of inaccurate data.
• To request deletion (destruction) of your data when the purpose of processing no longer applies.
• To withdraw consent for consent-based processing at any time.
• To lodge a complaint with the competent authority (the Saudi Data & AI Authority — SDAIA) if you believe our processing violates the law.

9In-app account deletion

You can request account deletion directly inside the platform via the "Delete account" page or from the app settings. After identity verification the account is deactivated immediately, and your personal data is deleted or anonymized within the retention period above, except for records the law requires us to keep.

10Information security

We apply transport encryption (TLS), fine-grained role permissions, full isolation of each complex's data, hardened database-level access rules, an audit log for sensitive operations, and periodic security reviews.

11Cookies and local storage

We use local storage and strictly necessary cookies only to manage your sign-in session and language preference. We do not use advertising trackers and we do not share your data with ad networks.

12Minors' privacy

The platform is intended for adult members of owners' associations and vendors; we do not knowingly collect data from anyone under eighteen.

13Changes to this policy

We may update this policy from time to time. We will publish the updated version on this page with a revised "last updated" date, and we will notify you inside the platform of any material change.

14Contact and exercising your rights

To ask a question or exercise any of your rights, contact us at privacy@sknak.com or via the contact page. We respond to requests within the statutory timeframes.