Who we are and the scope of this policy
HarajTok is a Saudi platform being developed as a visual online marketplace. Sell Talk Establishment is the intended operator and controller of personal data for which HarajTok determines the purposes and means of processing.
This policy covers harajtok.com, pre-registration pages, and—when launched—the HarajTok app and its account, listing, interaction, communication, transaction, shipping, return, and support services. It does not cover third-party websites reached through external links.
What happens before launch?
The current site only processes information needed to operate the informational page and waitlist and to respond to enquiries. It does not yet provide accounts, listings, payments, or public marketplace transactions.
- Waitlist contact details, your intended role, and an optional city.
- The contents of messages you send by email or WhatsApp.
- Technical, error, and security logs needed to protect and troubleshoot the site.
Data we may process after launch
Depending on the feature you use, we may process account and identity data, public listing content, communications, location and address details, transactions, payment references, device and usage information, and trust and safety records.
- Payment card details are handled in the payment provider's secure interface; HarajTok does not intend to store the full card number or security code.
- Required fields will be identified. If you do not provide data essential to a feature, only that feature may be unavailable.
How we obtain data
We obtain data directly from you, from your device with permission, automatically through your use of the service, from the other party to a transaction, from service providers, and from public or official sources where permitted by law.
Purposes and legal grounds
We process data to register interest, create and operate accounts, provide the marketplace, complete transactions, deliver support, prevent fraud, comply with legal duties, and improve the service. Each activity relies on an appropriate ground under Saudi law, such as consent, performance of an agreement, a legal obligation, or a legitimate interest permitted by law.
- Where consent is the basis, you may withdraw it without affecting processing already performed.
- We will not use data for a materially incompatible new purpose without an appropriate notice and legal ground.
Sharing and disclosure
We share only what is necessary with transaction parties and providers of hosting, communications, payment, shipping, identity verification, fraud prevention, analytics, and customer support. We may also disclose data to competent authorities or professional advisers where legally required or necessary to protect rights.
- We do not sell personal data.
- Service providers must follow contractual confidentiality, security, and purpose restrictions.
Transfers outside Saudi Arabia
We prefer processing and storage within Saudi Arabia. If an overseas transfer is necessary, we apply the Personal Data Protection Law and its regulations, including purpose limitation, necessity, risk assessment, and required safeguards or approvals.
Artificial intelligence and suggestions
A smart assistant may suggest a listing title, description, or category. The seller remains responsible for reviewing accuracy and legality. We do not intend to make a decision with legal or similarly significant effects solely through automated processing without the notices, human review, and other safeguards required by law.
In-app call recording
Voice calls between a buyer and a seller inside the HarajTok app are recorded in full. Both parties see the recording notice before the call, and the call only starts once each of them agrees; anyone who declines simply does not place the call and can use the other channels on the platform instead.
- Purpose: checking a report, settling a dispute over an order, and protecting the parties from fraud and abuse. Recordings are not used for marketing, for rating users, or to train AI models.
- Legal ground: the prior explicit consent of both parties, together with our legitimate interest in user safety.
- Access: authorised staff only, for a specific operational reason, through a short-lived link, and every access is written to the audit log with the staff member's identity, the time, and the reason.
- Retention: a recording is destroyed automatically seven days after the call ends. If it is needed as evidence in an open report or dispute, it is kept for that purpose alone until the matter closes and then destroyed.
- Limits: recording stops after sixty minutes of a single call, without ending the call. Neither party may record the other outside the platform, or publish any part of a call, without a lawful basis and consent.
Retention and secure disposal
We keep data only as long as needed for its stated purpose, a legal retention duty, fraud prevention, accounting, or dispute resolution. We then securely delete it or irreversibly anonymize it, subject to backup deletion cycles and lawful preservation holds.
Cybersecurity
We use proportionate technical and organizational measures, including access controls, encryption where appropriate, monitoring, backups, supplier controls, staff confidentiality, and incident response. No system is completely risk-free, so we review and improve safeguards continuously.
Your data rights
Subject to Saudi law and applicable exceptions, you may ask to be informed, access your data, obtain a clear copy, correct or complete it, request destruction when the purpose ends, and withdraw consent where consent applies.
- We may request information needed to verify your identity and protect your account.
- We respond within the statutory period and explain any full or partial refusal and available complaint route.
Children and persons lacking full legal capacity
The marketplace is not intended for anyone under 18 to enter independent transactions. A minor may only use relevant features with guardian involvement where legally permitted. We apply additional care and remove improperly collected data when identified.
Contact and complaints
Send privacy requests or complaints to [email protected]. Please describe the request and provide enough information for secure verification. If we do not resolve a complaint, you may submit it to the competent Saudi authority under its applicable procedure.
Official references and updates
This policy is informed by the Saudi Personal Data Protection Law, its Implementing Regulations, and relevant national cybersecurity and digital-service guidance. We may update it when services, processors, or legal requirements change. Material changes will be highlighted and the issue date updated.