Privacy Policy

Last updated: June 2026

At Baraaem, we are committed to protecting your personal data in accordance with the Saudi Personal Data Protection Law (PDPL) and its implementing regulations.

1. Personal data we collect

We collect the following categories of personal data:

Mobile phone number — for OTP identity verification (stored in parent_users table).
Full name — to associate your account with booking communications (parent_users).
Booking details: parent name, phone, child age in months, preferred visit date (bookings table).
Reviews: review text and star rating linked to your account (reviews table).
Session data: an encrypted session token in a cookie to keep you signed in (parent_sessions table).
OTP codes: stored hashed, valid for 5 minutes only (otp_codes table).

2. Purposes and lawful basis

Account creation and verification — Lawful basis: your explicit consent at sign-up (PDPL Art. 5).
Forwarding booking requests to nurseries — Lawful basis: contract performance.
Publishing reviews — Lawful basis: your implicit consent by submitting a review.
Platform improvement — Lawful basis: legitimate interest in delivering a better service.

3. Data retention

We retain your data for as long as your account is active. When you delete your account, your personal data (name and phone) are permanently deleted immediately. Booking records linked to your account are anonymised (personal identifiers removed) to preserve the nursery's legitimate operational record.

4. Cross-border transfers

The current beta stores data on Neon eu-central-1 (Europe) servers protected under GDPR, which constitutes an adequate-safeguard transfer under PDPL Art. 29. In the production release, all data will be migrated to AWS me-central-1 (Saudi Arabia) to satisfy PDPL data residency requirements.

5. Your data-subject rights

Access and portability: request a copy of your personal data.
Correction: correct inaccurate or incomplete data.
Erasure (right to be forgotten): delete your account and all associated personal data — available directly from your account page.
Withdraw consent: withdraw consent at any time without affecting the lawfulness of prior processing.
Object: object to processing of your data in certain circumstances.

To exercise any of these rights, contact us at: privacy@baraaem.sa

6. Security measures

All connections encrypted in transit via TLS 1.2 or higher.
Passwords and sensitive data encrypted at rest (bcrypt + server-side encryption).
Audit log for all write operations on personal data tables.
OTP codes valid for 5 minutes with brute-force rate limiting.

7. Contact

Data Protection contact: privacy@baraaem.sa