Privacy Policy

1. Who We Are

KidoraX operates the digital childcare discovery and booking platform described in this policy and is responsible for the platform processing it determines. Participating nurseries remain responsible for the childcare services and care records they independently determine. For privacy questions, rights requests, complaints, or formal notices, contact KidoraX through in-app support or at info@kidorax.sa.

2. Scope

This policy applies to personal data processed through the KidoraX mobile app, nursery portal, website, booking flows, payment flows, customer support, provider onboarding, and related communications. It should be read with the KidoraX Terms & Conditions.

3. Personal Data We Collect

• Account data: name, email, password credentials, email-verification status, mobile number and mobile-verification status, language, account role, and account activity. A mobile number is optional at signup but must be provided and verified before a reservation can be submitted.
• Parent or guardian data: contact details, optional relationship to the child, the declaration that the user is the child's parent or legal guardian or is otherwise lawfully authorized to make the booking, and support records.
• Child data: name, age or date of birth, gender where needed, optional photos, notes, booking history, and authorized pickup details.
• Government identity data: the current consumer mobile account and child-profile flows do not request a Saudi national ID or Iqama number, passport number or image, passport issuing country, nationality, or passport expiry date. A mobile number is optional at signup but is required and verified before reservation.
• Health and safety data: allergies, chronic conditions, medication notes, dietary restrictions, disability or accessibility needs, emergency contacts, incident notes, and other instructions shared for safe care.
• Booking and payment data: selected provider, branch, date, time, service type, prices, fees, tax treatment, payment status, refund status, invoices, transaction references, and settlement records.
• Provider data: nursery profile, commercial information, license information, staff contact details, bank or settlement information, photos, prices, schedules, policies, and support records.
• Technical data: device type, IP address, app version, browser, logs, diagnostics, analytics events, security signals, precise latitude and longitude when the user chooses nearby-nursery search, and approximate location or map data where used.
• Content and communications: reviews, comments, support messages, uploaded files, emails, call notes, and feedback.

4. How We Collect Data

• Directly from users, parents, guardians, providers, staff, and authorized representatives.
• From bookings, payments, refunds, support requests, account and child-profile forms, optional user content, and provider onboarding or licensing documents.
• From selected service providers when they update booking, attendance, incident, refund, or profile information.
• Automatically through app, portal, website, security, analytics, logging, and device technologies.
• From payment gateways, banks, communication providers, app stores, cloud providers, fraud prevention tools, or competent authorities when relevant.

5. Why We Process Data

• Create, authenticate, secure, and manage accounts.
• Display providers, prices, schedules, policies, locations, and availability.
• Create, confirm, manage, cancel, refund, and support bookings.
• Verify the parent's email and mobile number before reservation and use the verified mobile number for reservation updates, coordination with the selected nursery, pickup or contact needs, and emergencies.
• Share necessary reservation, parent, child, health, pickup, and emergency information with the selected provider so the provider can verify and deliver the booked service.
• Process payments, refunds, invoices, tax records, settlement records, fraud checks, and chargebacks.
• Review provider eligibility, licensing information, profile quality, and platform compliance.
• Respond to support requests, complaints, incidents, safety concerns, legal requests, and regulator inquiries.
• Protect children, families, providers, staff, KidoraX, and the platform from harm, fraud, misuse, unauthorized access, and unlawful activity.
• Improve app reliability, customer experience, pricing workflows, search, analytics, and operational reporting.
• Send service messages, security notices, booking updates, refund updates, provider updates, and lawful marketing messages where permitted.

6. Legal Bases and Consent

KidoraX processes personal data where necessary to provide the platform, perform booking and support arrangements, comply with applicable laws, protect users and children, pursue permitted legitimate interests, or based on consent where required. Explicit consent may be requested for sensitive data such as health information, child photos, marketing communications, or processing that requires a separate permission. Consent may be withdrawn through available app or support channels, subject to legal, safety, accounting, dispute, or service completion requirements.

7. Child and Sensitive Data

• KidoraX processes child and health-related data only for limited purposes such as booking verification, safe childcare delivery, emergency handling, provider communication, compliance, support, and record keeping.
• Parents, guardians, and authorized adults must provide accurate child and health data, declare that they are the child's parent or legal guardian or otherwise lawfully authorized, and must not submit information about a child unless they have that authority.
• Sensitive data, including child health information, will not be used for marketing.
• KidoraX restricts access to child, health, and payment data to personnel, providers, processors, or authorities who need it for an authorized purpose.
• A selected nursery may inspect original parent or child documents directly and in person at admission or check-in when operationally necessary or legally required. This inspection takes place outside the current consumer mobile signup flow, and KidoraX does not currently receive or store the inspection result, document number, or document image through that flow.

8. Sharing Personal Data

• Selected service providers: the booking details, the parent's verified mobile number and other necessary contact details, child details, pickup information, health notes, and optional child photo needed to coordinate and deliver the booking, including reservation updates, pickup or contact needs, and emergencies. The current consumer reservation flow does not send a government ID/Iqama or passport number or image; restricted legacy records are not used in the normal reservation flow.
• Payment and finance partners: payment gateways, banks, card networks, wallets, refund processors, invoice tools, and settlement support providers.
• Technology providers: hosting, database, storage, authentication, OTP, email, SMS, analytics, logs, maps, app stores, security, and customer support systems.
• Professional advisers: auditors, accountants, lawyers, insurers, and consultants where needed.
• Authorities: courts, regulators, law enforcement, child protection, tax, commerce, data protection, or other competent authorities where required or reasonably necessary.
• Business transfers: if KidoraX is involved in a merger, financing, restructuring, acquisition, asset transfer, or similar transaction, subject to appropriate safeguards.

KidoraX confirms that third parties receiving personal data are required, through applicable law, contractual safeguards, or both, to provide the same or an equivalent level of protection described in this Privacy Policy and required by applicable privacy laws and platform rules.

9. International Transfers

Some technology, payment, support, analytics, cloud, or security providers may process or access personal data outside Saudi Arabia. Where personal data is transferred or made accessible outside the Kingdom, KidoraX will use safeguards required by applicable Saudi data protection rules, which may include transfer assessments, contractual controls, standard contractual clauses, data minimization, encryption, access controls, and vendor due diligence.

10. Retention and Deletion

• KidoraX keeps personal data only for as long as needed for the purposes described in this policy, unless a longer period is required for legal, tax, accounting, safety, child protection, dispute, fraud prevention, or regulatory reasons.
• Booking, payment, invoice, refund, settlement, complaint, and incident records may be retained for the period needed to protect legal rights and comply with applicable record requirements.
• If a restricted legacy record contains government identity or other information that KidoraX no longer requests in current consumer flows, it is not used in the normal reservation flow. Access will remain restricted, and the information will be deleted, destroyed, anonymized, or otherwise minimized when any applicable legal, safety, accounting, fraud-prevention, or dispute-retention requirement expires.
• When personal data is no longer needed, KidoraX will delete, destroy, anonymize, or restrict it using reasonable technical and organizational measures.

11. Security Measures

KidoraX uses administrative, technical, and organizational measures intended to protect personal data from unauthorized access, loss, misuse, alteration, disclosure, or destruction. These measures may include access controls, authentication, encryption in transit, logging, permission management, secure storage controls, staff access restrictions, vendor reviews, and incident response procedures. No digital service can be guaranteed completely secure.

12. Your Rights

• The right to be informed about the legal basis and purpose of collecting personal data.
• The right to access personal data, subject to applicable conditions and exceptions.
• The right to request a clear and readable copy of personal data where applicable.
• The right to request correction, completion, or updating of inaccurate or incomplete data.
• The right to request destruction of personal data when it is no longer needed, subject to legal exceptions.
• You can initiate account deletion directly in the KidoraX app from Settings > Delete account. Data that must be retained for legal, tax, payment, safety, fraud-prevention, or dispute purposes will be minimized, anonymized, or restricted as applicable.
• The right to withdraw consent where processing is based on consent, without affecting processing that occurred before withdrawal.

13. Rights Requests and Complaints

To exercise privacy rights or submit a privacy complaint, contact in-app support or info@kidorax.sa. KidoraX may need to verify your identity, clarify the request, or ask for information needed to locate the relevant account, booking, child, provider, or transaction. We aim to respond within a reasonable period required by applicable law and the nature of the request.

14. Marketing and Opt-Out

KidoraX may send service messages that are necessary for account, booking, payment, security, provider, or support purposes. Marketing messages will be sent only where permitted and may be stopped using the unsubscribe, SMS, app, or support channel provided. Stopping marketing messages does not stop required service messages.

15. Cookies, Analytics and Similar Tools

KidoraX uses essential local storage and similar technologies where needed to operate the service, preserve preferences, protect accounts, and maintain reliability. Optional usage analytics are separate from these essential functions.

• The KidoraX web experience keeps Firebase/Google Analytics off by default and asks for an explicit local choice before enabling it.
• If allowed, analytics are used to understand aggregate page and app interactions and account, authentication, and portal-flow usage so KidoraX can improve navigation, reliability, and product experience.
• Google Analytics may automatically process browser and device information, app-instance information, IP or other network signals, and an approximate region derived from those signals.
• KidoraX custom analytics use sanitized route templates and limited predefined events. They are designed not to send names, email addresses, phone numbers, KidoraX child, nursery, reservation, or account identifiers, precise GPS location or coordinates, street addresses, query or search text, uploaded content, or free text entered in forms.
• KidoraX does not set an Analytics User-ID. Advertising storage, advertising user data, and ad personalization remain denied even when usage analytics are allowed.
• The analytics choice is saved locally in the browser. Users can continue without analytics and can change or withdraw the choice at any time through the persistent Privacy settings control on the KidoraX web experience. Core service access does not depend on allowing optional analytics.

16. Updates to This Policy

KidoraX may update this Privacy Policy from time to time. Updated versions will be published in the app, portal, website, or official channels. Material changes may be notified through reasonable means where appropriate.

17. Language

This policy is available in Arabic and English. If there is any conflict between the versions, the Arabic version shall prevail to the extent required for interpretation before Saudi authorities and courts.