1. Who We Are
laf warja Company LLC, a limited liability company incorporated in the Kingdom of Saudi Arabia under Commercial Registration No. 7054919290 (“Laff”, “we”, “us”), is the controller of the personal data described in this policy. Laff operates the Laff / لفّ mobile application and the website laffapp.com (together, the “Service”). Our company website is lafwarja.com.
For privacy requests, questions, and complaints, contact support@laffapp.com. This mailbox is our designated contact for data-subject requests under the Saudi Personal Data Protection Law and its implementing regulations (the “PDPL”).
2. Scope
This policy applies to everyone who uses the Service, including customers and personnel of food-truck businesses (“Operators”). Operators who applied for an operator account were shown a separate operator application privacy notice during onboarding; that notice remains in force as a separately acknowledged document and is not replaced by this policy.
3. Personal Data We Collect
We collect the following categories of personal data. In-app records in these categories, except the SDK-level diagnostic data described below, are linked to your account while it exists. Support correspondence may instead identify you through the contact details you provide. We do not use any of it to track you across other companies’ apps or websites, we do not sell personal data, we do not share data with data brokers, and the app contains no advertising SDKs.
- Email address — your account identity when you sign in with email, Google, or Apple.
- Phone number — your account identity when you sign in with a phone one-time code.
- Physical address — a venue or neighborhood you supply for a catering request.
- Name — the display name you choose for your profile.
- Photos and videos — your profile photo and the media you attach to posts, reels, and reviews.
- Audio data — the audio track in a video you choose to record or upload; Laff transcribes it for publication screening.
- Other user content — posts, reviews, chat and truck-room messages, check-ins, and rankings you create.
- Customer-support data — the details you choose to send by email or through the private operator support and privacy-request queue, including help requests and content reports.
- Precise location — for customers: your device location, used to show the map and to verify check-in proximity; for Operators: the live GPS location the truck broadcasts to followers.
- Coarse location — the profile city or venue neighborhood you supply.
- User ID — your account identifier and a pseudonymous analytics identifier derived from it.
- Device ID — the APNs/FCM installation token stored under your signed-in account to route notifications; the Google Analytics for Firebase app-instance ID used for feature experiments; and identifiers declared by Google Sign-In. The app does not collect IDFA, and IDFV collection is disabled.
- Purchase history — pickup orders and catering requests. Payment is made on pickup; the app collects no payment credentials (no card numbers, no bank details).
- Product interaction — first-party analytics events describing how the Service is used, plus Google Analytics for Firebase screen and event data used for Remote Config experiments.
- Other usage data — usage data generated by Google Sign-In and Google Analytics for Firebase for analytics.
- Health-certificate verification data — for a person working inside a food cart: the health-certificate reference, issuer, verification status, and expiry. Laff does not collect examinations, diagnoses, laboratory results, or treatment records.
- Other operator verification and work-readiness data — the operator lane and applicant capacity; mobile-cart licence reference; applicable commercial registration or unified number; site-authorization reference; relationship to the applicant; direct-notice or confirmation state; and, when they are photographed at sign-up, photos of the Balady licence, the commercial registration and in-cart workers’ health certificates, and of the menu board.
- Other diagnostic data — unlinked operational diagnostics generated by Firebase Authentication, Firestore, and Messaging, and, on iPhone and Android, crash reports from Firebase Crashlytics (device model, operating-system and app versions, and the technical details of the crash, with no user ID attached), for analytics, app functionality and fixing faults.
Except for other usage data, which is used for analytics only, the categories above are collected for app functionality. User ID, Device ID, product interaction, and other operator verification and work-readiness data are also used for analytics; unlinked other diagnostic data is used for app functionality and analytics. Laff treats in-cart worker health-certificate verification data as restricted personal data. We do not request financial or card data, your contacts, your browsing or search history outside the Service, or advertising data of any kind.
4. Purposes of Processing
We process personal data to: (a) operate and provide the Service, including requested bilingual business-name suggestions; (b) improve, develop, and test the Service; (c) personalize content, rankings, and recommendations; (d) secure the Service, prevent fraud and abuse, and enforce our terms; (e) moderate content, including automated screening; (f) analyze usage and perform research; (g) communicate with you about the Service, your account, and your activity; and (h) with your consent, send you marketing communications.
Marketing. Marketing messages are sent only with your consent, and every message offers an easy opt-out. Marketing by SMS is sent only after a confirmed double opt-in and is not sent between 8:00 p.m. and 8:00 a.m., in line with applicable Saudi regulations.
5. Legal Bases
We rely on the legal bases recognized by the PDPL: performance of a contract with you (operating your account and the Service); our legitimate interests (securing, improving, moderating, and analyzing the Service) where those interests do not prejudice your rights; your consent (marketing, and wherever the PDPL requires it); and compliance with legal obligations.
6. Aggregated and Anonymized Data
We may create aggregated, statistical, de-identified, or anonymized data from personal data and from use of the Service — including usage statistics, location heatmaps, market insights, benchmarks, and other derived datasets. Once data has been anonymized so that it no longer identifies you, directly or indirectly, it ceases to be personal data under the PDPL. Laff owns all aggregated and anonymized data and may use, retain, license, publish, and commercially exploit it for any lawful purpose, without restriction, notice, or compensation, provided it does not identify you.
7. Sharing and Disclosure
Creating an account requires explicit acceptance of the current Terms of Service and acknowledgement of this Privacy Policy. The Terms explain AI processing and permission to use eligible public submissions for model training. We record the terms version and time; older AI-processing grants do not authorize training. You may decline and keep browsing. Settings → AI sharing lets you withdraw permission. Withdrawal stops new processing requests and future selection for training after it is recorded; requests already in progress may finish. Re-enabling processing alone does not restore withdrawn training permission. Withdrawal does not itself delete previously processed information or promise removal of an already completed model’s learned effects. Your statutory data rights remain available.
Model-training permission and current operation. The public-content permission in Terms section 8.1 excludes private messages, private contact details, credentials, precise locations, transaction details and operator verification records. No training workflow or transfer is enabled, and no external training recipient is currently designated. OpenAI currently provides processing services as described below; the new permission does not enable supplier training settings. Before a training workflow starts, we will identify its recipient, purpose, data selection and applicable transfer/retention arrangements and obtain further permission where required. Accepting earlier terms, turning on analytics or restoring processing permission does not authorize training.
We share personal data only as follows:
- Service providers (processors). Google LLC provides our cloud infrastructure (Firebase: authentication, database, storage, push notifications, and Google Analytics for Firebase for feature experiments). Video publishing is unavailable in this beta. If enabled in a later release, video safety checks send the uploaded video file, including its audio and video streams, to Cloudflare for speech transcription; OpenAI then screens the transcript. This path does not extract an audio-only track before transfer. OpenAI screens written text, speech transcripts, and image bytes for moderation and, when an operator requests it, provides an editable bilingual truck-name suggestion. For a name suggestion, Laff sends only the proposed public name and the source and target language — not an account identifier, licence reference, application identifier, or location. Processors act on our instructions under contractual safeguards.
- Operators and authorized reviewers. Operators receive aggregated analytics about their own trucks (for example, check-in counts, visitor statistics, and heatmaps). Operators also see the social interactions the Service already displays by design — for example, your public check-ins, reviews, and follows relating to their truck. A legal owner, authorized manager, or named Laff reviewer may receive only the operator and worker verification status needed for their unit and role; an ordinary shift worker does not receive another person’s raw certificate reference.
- Other users. Content you publish (profile, posts, reviews, check-ins on public surfaces) is visible to other users as the Service is designed to display it.
- Legal compliance. We disclose data where required by law, regulation, or a binding order of a competent authority, or to protect users, the public, our rights, or the integrity of the Service.
- Business transfers. If Laff is involved in a merger, acquisition, financing, reorganization, or sale of all or part of its assets, personal data may be transferred or assigned to the successor or acquirer as part of that transaction, subject to this policy and applicable law.
8. Transfers Outside the Kingdom
Some processing occurs outside the Kingdom of Saudi Arabia: authentication data is hosted by Google in the United States, push notifications are delivered through Google’s global infrastructure, Google Analytics for Firebase processes pseudonymous app-usage analytics for feature experiments in the United States (without advertising identifiers or ad personalisation), the disabled video-moderation path would send full uploaded video files to Cloudflare for transcription, and OpenAI performs automated content screening and requested public truck-name suggestions. We carry out such transfers in accordance with the PDPL and its Regulation on Personal Data Transfer outside the Kingdom, applying the safeguards required by the Saudi Data and Artificial Intelligence Authority (SDAIA), and limiting transfers to the minimum necessary to operate the Service.
9. Retention
We retain personal data for as long as necessary for the purposes above — generally, for the lifetime of your account — and thereafter only as needed to comply with legal obligations, resolve disputes, and enforce agreements. Raw analytics events and similar operational records are additionally subject to automatic time-limited expiry enforced by our systems.
Laff keeps an Operator’s application and verification records, including photos of their papers, while the Operator’s account exists, and deletes them when the account is deleted. Photos are deleted sooner: a sign-up started by a Laff team member is deleted with its photos if it is not completed within 30 days; photos of papers are deleted 30 days after an application is rejected or withdrawn; and when a worker leaves an Operator’s list, that worker’s certificate reference and every health-certificate photo of the truck are removed within 30 days.
A restricted account-deletion record retains the account identifier, lifecycle status, and timestamps so that we can show the deletion was carried out. We keep that record, and any order records and support correspondence that remain, only as long as needed to meet legal, tax and accounting obligations and to resolve disputes, and then delete or anonymize them.
10. Your Rights and Deletion
Under the PDPL you have the right to be informed about our processing, to request access to your personal data, to request correction of inaccurate data, and to request deletion. You can initiate account deletion in the app (Profile → Settings → Delete account). The current flow deletes your profile, authored social content, and private account records; severs the link to your first-party pseudonymous analytics identifier; and purges associated first-party raw analytics events. The app also resets its local Google Analytics identity.
If you browse as a guest, use Guest privacy → Delete guest account in the app without creating a named account. Confirmed deletion removes the guest authentication account and clears this device’s saved browse location. Your language and accessibility settings stay. Browsing remains paused until you choose to continue; browsing again after deletion creates a new guest account. If deletion cannot be confirmed, the app shows that status and lets you retry or contact support.
Order and catering records may remain after their direct customer identifiers, customer notes, vehicle details, and catering address/location fields are removed; a restricted account-deletion status record also remains as described above. Removing these fields does not by itself prove that a record is anonymous. Truck or organization owners can initiate an in-app offboarding request; ownership must be safely resolved before their account is deleted. You may also exercise any right by contacting support@laffapp.com; we will respond within the periods required by the PDPL. If you are dissatisfied, you may escalate to the competent authority (SDAIA).
11. Security
We protect personal data with access controls, server-enforced security rules, private storage paths, role checks, and monitoring. No system can guarantee absolute security; we ask you to protect your sign-in method and notify us of any suspected compromise.
12. Children
The Service is not directed to children under 13 years of age, and we do not knowingly collect personal data from children under 13. If you believe a child under 13 has provided personal data, contact support@laffapp.com and we will delete it.
13. Changes to This Policy
We may update this policy from time to time. We will post the updated version in the app or on the site with a new “Last updated” date, and where required by law we will provide additional notice. Your continued use of the Service after an update constitutes acceptance of the updated policy. New or expanded permission for AI processing or model training requires explicit acceptance and is not inferred from continued use.
14. Language
This policy is issued in English and Arabic. In the event of any conflict between the two texts, the Arabic text prevails.
15. Contact
laf warja Company LLC — Commercial Registration No. 7054919290, Kingdom of Saudi Arabia. Privacy requests and questions: support@laffapp.com.