Privacy Policy

1. Data We Collect

When you create an account: your Saudi mobile number (the account identifier), name, email address, password (stored encrypted; we cannot read it), date of birth, username, and any profile or cover photo you choose to add.

When you create an account or a wishlist: your Saudi national short address (four letters and four digits), the only delivery detail we ask for, and required to create an account.

When you gift as a guest without an account: your mobile number (verified by a one-time code), your name if you choose to enter one, and technical request data (IP address and browser type) used for abuse prevention only and never shown to any user.

When you contribute: the amount, your chosen name-display mode, and your gift message if you write one. When you choose hidden gifting, your identity is not displayed to other users, including the wish owner. Hidden gifting does not delete account data, guest-gifter data, or payment records; access to retained data is limited to authorised parties for the purposes described in the Privacy Policy.

When you request additional verification (KYC): your national ID/Iqama number and legal name (both stored encrypted) and the document images you upload.

When you look for friends from your contacts (in the app, with your permission): the app reads only the phone numbers in your device's contacts, not names or any other details, and sends them to us to match against the numbers of registered accounts. These numbers belong to other people, so we use them for this match only and discard them immediately: we do not store, log, or share them with anyone, contact their owners, or use them for any other purpose. To prevent abuse we count how many numbers each account looks up per day, without keeping the numbers themselves. The app may keep the result of your last search on your device so it does not repeat it. You can refuse or withdraw the permission in your device settings at any time, and the app works without it.

What you post: wishlist and wish images, Thankful moments, and messages, displayed on platform pages according to the privacy settings you choose; access through public image URLs is explained in Section 3.

We use no advertising or marketing trackers. The only cookies are functional: language preference and day/night theme. The website uses a technical monitoring service to detect faults and improve the platform's reliability; this service may process technical data about your browsing session.

2. Purposes and Legal Basis

We process your data with your consent and/or to perform our contractual relationship with you (PDPL Arts. 5–6), in order to: create your account and verify your mobile number with one-time codes; operate wishlists and receive contributions; process payments through the payment service provider; fulfil completed wishes (purchasing the product and delivering it to your address); send notifications about your account and wishes; prevent fraud and abuse; and meet legal obligations. The data required at registration, including the national short address, is mandatory for creating an account. Photos are optional. When requesting additional data, we explain whether it is required for the requested service and the effect of not providing it.

We may send you messages about Omniya's services and offers; you can ask us to stop at any time via support@omniya.sa.

We also use mobile numbers to help you find friends who are registered on the platform, as described in Sections 1 and 3; you can withdraw from this at any time by refusing the contacts permission or turning off being found by your number.

3. Disclosure and Sharing

We do not sell your personal data and disclose it only as follows:

The licensed payment service provider: processes your payment on its own secure page; your card details never reach us and are not stored by us.

The SMS delivery provider: receives your mobile number to deliver verification codes.

The email delivery provider: receives your email address to deliver platform messages.

The store and delivery carriers: when fulfilling a completed wish, we provide the seller and carrier with the recipient's name, address, and mobile number to the extent needed for delivery.

Cloud hosting and storage providers: platform data and images are stored with cloud service providers and may be processed or stored outside the Kingdom; we take the measures required to protect data in accordance with PDPL Art. 29.

Competent authorities: where required by law or to satisfy judicial requirements.

Being found by your number: if your number is saved in another user's contacts and they look for friends, your account may appear in their results (your username, display name, profile photo, and the number of wishes on your public lists); we never show your number to anyone. Your account is not shown to anyone you have blocked or who has blocked you, and suspended or deleted accounts are never shown. This option is on by default, and you can turn it off at any time in your Profile with "Let people who have my number find me"; your account then stops appearing in these results immediately.

Note: profile, wishlist, wish, and Thankful-moment images uploaded to the public image area are stored on a public content-delivery network. Wishlist privacy settings control access to its pages within the platform, but do not protect direct image URLs; anyone with a direct image URL may be able to access that image outside the wishlist page. Do not upload sensitive images or identity documents to this area.

4. Retention and Destruction

We keep your data while your account exists and as long as the purposes above require. When you delete your account, the account is deactivated and your sign-in identifiers are detached from it; we retain financial transaction records, contributions, and whatever a legal basis requires us to keep (such as financial and anti-fraud requirements), and destroy what is no longer needed in accordance with PDPL Art. 18. Account deletion is temporarily refused while gifters' money is attached to your account: while a wish of yours is being fulfilled; while a wish of yours is still collecting and has received contributions or has a payment in progress; or while you hold unspent wish credit (including contributions to an expired wish that have not yet become credit), until that situation ends. Deletion is also refused for a few minutes while a payment for your subscription is in progress.

5. Your Rights

Under PDPL Art. 4 you have the right to: be informed of the purposes of processing (which this policy provides); access your data and obtain a copy by requesting it from support@omniya.sa; correction and updating (you can edit your name, photos, birthday, and address in account settings, and change your username and email after verification); destruction of data no longer needed; and withdrawal of consent at any time.

To exercise any of these rights, contact us at support@omniya.sa and we will respond within the legally prescribed period. If you believe our processing violates the law, you may lodge a complaint with the competent authority (the Saudi Data & AI Authority, SDAIA) under PDPL Art. 34.

6. Data Security

We apply organisational and technical measures to protect your data, including: encryption of passwords and of KYC identity numbers and legal names; database-level access controls; one-time-code verification of sensitive operations (such as email change and account deletion); and restricting guest-gifter data to the operations team. If a breach affects your data in a way likely to cause serious harm, we will notify you and the competent authority in accordance with PDPL Art. 20.

7. Eligibility

The platform is intended for those with the legal capacity to enter into contracts. If we learn that data has been processed without valid consent from its subject or their guardian, we will take the necessary action.

8. Changes and Contact

We may update this policy; the updated version applies from its publication on the platform, and we will notify you of material changes. Publication of the updated policy, continued use of the platform, or acceptance of the Terms does not replace any separate consent required for personal-data processing. For any question about this policy or your data: support@omniya.sa.