Privacy policy – Customer app

A version dedicated to app customers

Last updated: 12 August 2026

This policy explains how the Marah app, operated by Meatsteak Company, unified national establishment number 7052155863, a company registered in the Kingdom of Saudi Arabia with its head office in Riyadh, collects, uses, discloses, stores, protects and destroys the personal data of app customers.

This policy applies to the Marah customer app and the interfaces connected with the customer's order, payment and support. It does not apply to the seller app or to sellers' commercial registration data.

Marah is a technical intermediary between the customer and the seller and is not a seller or owner of the products. It may arrange and manage an independent delivery service for some stores where the customer is shown 'Delivery by Marah'. In that case transport is carried out by a contracted carrier, being an establishment licensed in the appropriate activity or a Saudi individual working with their own vehicle who meets the driver, vehicle and regulatory requirements. Meatsteak Company is the controller of the data it processes to operate the platform and manage the delivery service, while the seller, the payment provider, the seller's delivery party or the contracted carrier may be an independent controller of what it receives and processes for its own lawful purposes, or a processor acting on Marah's instructions, depending on the nature of the relationship and the processing.

We are committed to protecting and respecting customers' privacy in accordance with the Saudi Personal Data Protection Law, its implementing regulation and related laws.

Reading this policy does not amount to general consent to every form of processing. Where consent is the lawful basis, we will request it clearly and separately, it may be withdrawn as explained below, and withdrawal does not affect lawful processing carried out earlier or processing based on another lawful basis.

First: meaning of terms and responsibility for data

Personal data: any data that could lead to identifying the customer directly or indirectly, such as name, mobile number, address, account identifier and order data.
Processing: any operation carried out on data, such as collection, recording, storage, use, analysis, disclosure, transfer or destruction.
Controller: Meatsteak Company, in respect of processing Marah customers' data, determining the purposes and means of processing.
This policy is limited to natural persons using the customer app, even where the person uses the app on behalf of an establishment.

Second: the data we collect

Identity and contact data: name, mobile number, email address if provided, city and address.
Account and verification data: user identifier, verification code and records of successful verification, language and notification settings, account status and saved preferences.
Location and delivery data: delivery address, precise coordinates where location permission is granted, description of the location, landmarks and delivery instructions, and the chosen fulfilment method: pickup from the store, delivery by the seller, or delivery by Marah.
Delivery execution and proof data — for delivery by Marah: the identifier assigning the order to the carrier, the statuses of collecting the order from the seller, starting transport, arrival and handover, and the operational communication log linked to the order. Where the feature is enabled, it may include the time and location of handover, a verification code, the recipient's name, a photograph of the handover point or an electronic signature, to the extent necessary to carry out and evidence the service and to handle complaints and claims.
Order and transaction data: the seller, products, quantities, weights, cutting or preparation options, special requests, minimum order, fees, discounts, amount, tax, the delivery party shown, and the status of acceptance, payment, preparation, delivery, cancellation and refund, with date and time.
Limited payment data: the payment method chosen, the payment provider's name, the transaction identifier, its status and amount, and refund data. Marah does not itself retain the full card number or its security code; these are processed by the payment provider in line with its requirements, unless the customer is expressly informed otherwise for a particular method.
Communication and support data: the customer's conversations with the seller, the delivery party or support inside the app, correspondence, reports, complaints, images or attachments uploaded, and the communication log. If a call is recorded, the customer will be notified before recording where that is required.
Review and content data: ratings, comments, images and the order data needed to verify that a review relates to an actual experience.
Technical and usage data: internet protocol address, device type and identifiers, operating system, app version, language, region, sign-in, crash and performance logs, the pages and features used, and the notification token. It may include attribution and campaign measurement tools such as AppsFlyer, depending on the installed version of the app.
Security and anti-fraud data: sign-in attempts, unusual activity, verification results, chargebacks and any record of misuse of offers or payment methods.
Offer and preference data: vouchers used, interaction with offers and marketing consent. If points, credit or a wallet are made available later, the data may include the balance, movements, expiry dates and eligibility conditions, without implying that these features are available at present.

Where photography is enabled as proof of handover, Marah instructs whoever carries out the delivery to limit the photograph as far as possible to the order or the handover point, and to avoid photographing people, the inside of a residence, documents or any unnecessary personal detail. The photograph may not be used other than to evidence fulfilment of the order, handle a complaint or claim, and meet regulatory requirements.

We do not request sensitive data unless it is necessary for a legitimate and stated purpose, and with explicit consent or the required lawful basis. Health data, identity documents or additional financial information should not be sent through the chat unless support requests it for a specific case and by a secure means.

Third: sources of data and how it is collected

Directly from the customer when creating the account, entering the address, submitting the order, paying, communicating, and providing a review or complaint.
Automatically from the device and the app during use, through technical logs, app identifiers and analytics, crash and attribution tools, subject to device settings and the required consent.
From the seller or their driver in the case of delivery by the seller, or from the establishment licensed in the appropriate activity or the Saudi individual working with their own vehicle who meets the driver, vehicle and regulatory requirements and is contracted by Marah in the case of delivery by Marah, regarding acceptance, preparation, collection, transport and handover of the order, or a shortage, cancellation or complaint.
From the payment provider or the bank regarding the success, rejection, suspicion or refund of a transaction, without Marah receiving full card data.
From the competent authorities or publicly available sources in the cases permitted by law, with notice to the data subject where that is required.

Fourth: purposes of processing and their lawful bases

Performance of the agreement or taking steps at the customer's request: creating and verifying the account, showing nearby stores, submitting the order, enabling the seller to accept it, processing payment, showing the available fulfilment method, arranging pickup or assigning the delivery order to the contracted carrier, enabling communication and arrival, updating delivery status and proof of handover, managing cancellation, refunds and complaints, and providing support.
Legal obligation: issuing or keeping records and invoices, responding to the competent authorities and lawful orders, meeting accounting, tax and anti-fraud requirements, and protecting legal rights.
Legitimate interest: protecting the account and the platform, preventing fraud, diagnosing faults, improving performance and the user experience, preparing aggregate statistics, and managing claims, provided that these interests do not override the customer's rights and reasonable expectations and do not extend to sensitive data without an appropriate basis.
Consent: direct marketing, non-essential personalisation, optional device permissions, optional technologies, and publishing customer content, where consent is the required basis. Consent can be withdrawn easily from the settings or by contacting us.
We may use aggregated or anonymised data for analysis and planning; where an individual cannot reasonably be re-identified, such data is not considered personal data.

Fifth: mandatory and optional data

Name, mobile number, verification and order data, address or pickup location, and payment status are normally required to create the account and fulfil the order. Failure to provide them may make registration, ordering, delivery or refund impossible.
Email address, precise location permission, camera or photo access, marketing notifications and additional preferences are optional data unless the screen states otherwise for a specific purpose. They may be refused, and refusal only results in the related feature being unavailable.
The customer may disable location permission and select the address manually where the feature is available; the accuracy of showing nearby stores or of delivery may be affected.
We do not use the customer's device location to track their movement continuously beyond what is needed to show nearby stores, determine the order address or carry out delivery, unless a separate feature requiring this is offered and we have obtained the necessary permission or lawful basis.

Sixth: disclosure of data and recipients

We do not sell or rent personal data. We disclose only the minimum necessary, according to the purpose and the lawful basis, to the following categories:

For pickup from the store: the seller receives the order and preparation data, the name and the contact data needed to verify the order holder and hand the order over. The delivery address is not shared with the seller for this purpose, as it is not needed for this method.
For delivery by the seller: the seller or their driver receives the order data, the name, contact number, handover address, its location and instructions, to the extent needed for preparation, arrival, communication, handover and resolving any problem.
For delivery by Marah: the seller receives the order, preparation and collection data needed to hand the order to the delivery party, and the full handover address is not shared with the seller except where an operational need or a complaint justifies it. The establishment licensed in the appropriate activity, or the Saudi individual working with their own vehicle who meets the driver, vehicle and regulatory requirements and is contracted by Marah, is given the name, contact data, handover address, its location and instructions, and the data needed to evidence handover, without access to the customer's order history or full payment data.
Payment providers, banks and anti-fraud parties, to process payment and refunds and to verify the transaction.
Providers of hosting, databases, technical support, analytics, crash reporting, notifications, communications and campaign measurement, as processors and under appropriate instructions and contractual safeguards where applicable.
Advisers, auditors, insurers, or parties to a potential restructuring, merger or acquisition, to the extent necessary and subject to confidentiality and the required legal safeguards.
Governmental, judicial or supervisory bodies or law enforcement, where there is a request, an obligation or a lawful basis.

We do not disclose delivery data to a delivery party that is not enabled for the store or the order. For delivery by the seller, the seller or their driver may process the necessary data as an independent party; for delivery by Marah, authorised persons or contracted carriers process the data for the specified purpose and under appropriate contractual instructions and controls, including confidentiality, data security and prevention of independent use. The driver's or carrier's access is limited to the order assigned to them and to the period needed to carry it out and settle any related complaint, and they may not use customer data for marketing or to build an independent database without the necessary basis and consent.

Seventh: cookies, app permissions and similar technologies

The website may use cookies, and the app uses identifiers and similar technologies to maintain the session, for security and preferences, and to measure performance, crashes and campaigns.
Technologies necessary to operate and secure the service run on the appropriate basis, while optional technologies for marketing or personalisation are subject to consent where required.
Permissions can be managed from the device or app settings. Turning off a permission may disable the feature that depends on it, such as location, photos or notifications, without preventing use of other features that do not depend on it.

Eighth: storing data and transferring it outside the Kingdom

Data is stored in Marah's systems or with approved service providers, with access and protection controls appropriate to the nature of the data and the risks.
If operations require personal data to be transferred or disclosed to a party outside the Kingdom, this will only take place in accordance with the Personal Data Protection Law and the regulation on transferring data outside the Kingdom, and after verifying the purpose and the minimum necessary and applying the appropriate legal, contractual and regulatory safeguards.
The customer may request general information about the categories of recipients and the safeguards applied to the transfer, unless the law or the rights of others prevent disclosure of particular details.

Ninth: retention period and destruction

We retain account data throughout the life of the account, then to the extent and for the period needed to close it, settle orders, meet legal obligations and defend rights.
We retain records of orders, payments, invoices, refunds and complaints for the periods required by financial, tax and commercial laws, or for the period needed for a claim or dispute, whichever is longer where there is a lawful basis.
We retain technical and security logs and crash data for the operational period needed for security, investigation and improving the service, then delete them or anonymise them.
We retain proof-of-handover data to the extent and for the period needed to evidence fulfilment of the order, handle complaints and claims and meet legal obligations, then destroy it, restrict it or anonymise it once the purpose has ended and there is no other basis for retention.
We retain marketing data and consents until consent is withdrawn or the purpose ends, while keeping a limited record to evidence the opt-out and prevent new messages being sent.
Basket data and temporary data are removed when there is no longer an operational need for them. If points or a wallet are made available in future, their movements will be kept as far as needed to operate them and to settle rights and legal obligations.
Once the purpose has ended and there is no basis for retention, we destroy the data securely or anonymise it. Destruction covers the available copies and backups, in line with the technical deletion cycle and regulatory requirements.

Tenth: data security and breach incidents

We apply appropriate organisational, administrative and technical measures, including access control, encryption where appropriate, backups, monitoring, updates, management of service providers and training of authorised persons.
No technical means guarantees absolute security; we therefore review the controls and address risks on an ongoing basis, and limit access to those who need the data to perform their duties.
If a breach occurs that may harm the data or the customer's rights, we take containment and investigation steps and notify the competent authority within the statutory period, and notify the customer without undue delay where the potential harm requires it, setting out the risks, the measures taken and appropriate advice.

Eleventh: the customer's rights and how to exercise them

Under the Personal Data Protection Law, and subject to the statutory exceptions and restrictions, the customer has the right to:

Be informed of the lawful basis and purpose of collecting and processing their data, of the mandatory and optional data, of the parties to whom it is disclosed, and of transfers outside the Kingdom.
Access their personal data held by Marah.
Request a copy of their data in a readable, clear and commonly used format, where that is legally possible.
Request correction of inaccurate data, completion of incomplete data, or updating of outdated data.
Request destruction of the data where the purpose has ended and there is no lawful basis requiring its retention.
Withdraw consent at any time for processing that relies on it, without retroactive effect on processing lawfully carried out before withdrawal.
Submit a complaint to Marah, and then to the Saudi Data and Artificial Intelligence Authority as the competent body, if they are not satisfied with the processing or the outcome.

Rights may be exercised through in-app support or by writing to the main email address privacy@marahapp.sa with 'Privacy request' and a statement of the type of request. We may ask for reasonable information to verify identity and protect the account. We respond within a period not exceeding 30 days from completion of verification, extendable by up to a further 30 days in the cases permitted by the regulation, with notice to the customer of the extension and its reason.

Deleting the account may not result in the immediate destruction of all data where an order, payment, invoice or dispute record must be retained under a law or an existing right. In that case use is limited to the purpose that justifies retention.

Twelfth: marketing and notifications

Contact data is used to send offers or marketing messages where consent or the required lawful basis exists, and the subscription can be cancelled at any time from the settings, the unsubscribe link, or through support.
Cancelling marketing does not affect essential operational messages, such as the verification code and the status of the order, payment and refunds, and security alerts.
We do not share the mobile number or email with a seller for use in independent marketing without the customer's consent or a clear lawful basis.
If you give your separate consent to receive marketing messages, you agree that Marah may send you offers and marketing campaigns through app notifications, text messages and WhatsApp, and you may withdraw your consent and unsubscribe at any time, easily and free of charge.

Thirteenth: minors' data

The platform is directed at those aged 18 and over. We do not knowingly collect a minor's data to create an independent customer account. If it becomes apparent to us that an account has been created for a minor without an appropriate basis, we take the necessary steps to restrict it and destroy unnecessary data, and the legal guardian may contact us to exercise rights in accordance with the law.

Fourteenth: third-party links and services

The app may open a link or service operated by a third party. This policy does not apply to the external site or service once you leave the Marah environment, and you are advised to read that party's policy. This does not affect Marah's obligations in respect of any disclosure or integration initiated from within the platform.

Fifteenth: amendment of the privacy policy

This policy may be updated when practices, services or laws change. The date of the last update is shown, and material changes are notified through the app or an appropriate means of communication before the new processing begins, where the law requires this. If a change requires fresh consent, it will be requested separately.

Sixteenth: contact and complaints

For enquiries, complaints or to exercise data rights, you may contact us through in-app support or the main email address privacy@marahapp.sa, writing 'Privacy' in the subject line. A complaint may be submitted to the Saudi Data and Artificial Intelligence Authority through its official channels in accordance with the applicable procedures.

The Arabic version of this policy is the approved version. Any translation made available in another language is for guidance only, and the Arabic text prevails in the event of a difference in interpretation, subject to the applicable legal provisions.

Back to the homepage