Privacy Policy

About the Privacy Policy

This Privacy Policy explains how personal data is handled through the Najla Residence Property Access System, including guest.najlapsa.com, the operator mobile application, protected short-term guest pages, long-term viewing pages, subscription checkout, support, and account-deletion services.

The policy applies according to the role described below. Najla handles some data as a controller and handles other data for a registered property operator as a processor. A property-specific notice may identify another controller for a guest or prospect record. That notice and this policy should be read together.

This version takes effect on 30 August 2026. The current policy and future historical versions are available through the public Privacy Policy page.

Identity of the controller

Where Najla acts as controller, the controller is Najlaa Saleh Hamad bin Shuail Establishment Real Estate, Arabic legal name مؤسسة نجلاء صالح حمد بن شعيل العقارية.

• Commercial Registration: 1010967708
• Unified National Number: 7037715294
• Address: Building 3305, Malik Al Qusheri Street, Al Muruj District, Secondary Number 7923, Postal Code 12284, Riyadh, Kingdom of Saudi Arabia
• Privacy email: najlapsa@gmail.com
• Main website: https://najlapsa.com
• Guest platform: https://guest.najlapsa.com
• Official commercial-record verification: Saudi Business Center record

No Data Protection Officer has been listed for this policy. Privacy requests may be sent to the privacy email above.

Controller-versus-processor responsibilities

Najla acts as controller for operator accounts, authentication, subscriptions, payments, support, platform security, optional push-notification registration, platform audit records, and Najla's legal obligations.

A registered property operator acts as controller for guest and prospect records when that operator decides why and how those records are collected. In that setting, Najla processes the records as a service provider on the operator's instructions. The operator remains responsible for its legal basis, property notice, collection decisions, responses to individual requests, and instructions to Najla.

Najla acts as controller for guest and prospect information when Najla operates the relevant property and determines the purposes and means of processing. A notice shown before a guest or prospect enters personal data identifies the relevant arrangement where the system has a confirmed operator identity.

Registered property operators

Registered property operators use the service to create and manage short-term guest pages, long-term viewing pages, property media, access instructions, reports, subscriptions, settings, and user access. An operator may be a property owner, manager, employee, or authorized representative.

Operators must enter accurate account and property information, restrict staff access, protect private links and access instructions, and use guest and prospect information for lawful property operations. Operators must not upload data that they have no authority to process. They must answer privacy requests for records under their control and instruct Najla when deletion, correction, restriction, or disclosure action is required.

Short-term guests

A short-term guest receives a private property link. Before unlocking protected access details, the guest reads the displayed warnings and house rules, enters the required contact information, and completes the property acknowledgment. The service records the content version and the relevant timestamps so the property operator can demonstrate what the guest reviewed.

The guest's acknowledgment concerns property rules, warnings, and access conditions. It does not operate as blanket consent for all personal-data processing. The property privacy notice identifies the controller and links to this policy before the guest enters personal data.

Long-term rental prospects

A long-term rental prospect receives a private viewing link. The prospect enters a name and phone number, with email available as an optional field, before opening the timed property guide. The guide may contain a map link, photos, video, and door-opening instructions.

At the end of the viewing period, the service asks whether the prospect liked the apartment and whether the prospect expects to rent it. If the prospect answers no where the form requests an explanation, the service records the submitted reason. If the prospect expresses interest, the page may show a rental contact number and links for a call or WhatsApp message.

Support contacts

When a person contacts Najla for support, sales, privacy, account recovery, billing, or another service question, Najla may process the person's name, email address, phone number, message content, attachments, account or property reference, and the dates and outcome of the correspondence.

Najla uses this information to answer the request, authenticate the requester where needed, resolve service issues, document the response, prevent abuse, and meet legal obligations. A person who chooses WhatsApp, email, or another external service also gives that provider information under the provider's own terms.

Operator-account information

Najla processes the following account information where applicable:

• Full name, email address, phone number, preferred language, password hash, and identity-confirmation status.
• Workspace role, account status, team relationship, subscription status, package, limits, trial or billing term, and account settings.
• Web and mobile session records, internal account identifiers, session expiry and revocation data, device name, operating platform, and application version.
• Optional push token and notification preference.
• Policy version, document hash, language, acknowledgment source, and timestamp for required policy acknowledgments.

Najla does not store the plain-text account password. The server stores a password hash. The mobile application stores access and refresh tokens in platform secure storage on supported devices.

Property and access information

An operator may enter or upload property codes, private-link slugs, English and Arabic page titles, Google Maps links, Wi-Fi network details, contact numbers, warnings, house rules, photos, videos, audio recorded with a video, labels, viewing duration, door-opening instructions, building or apartment references, social links, brand logo, and page theme.

Some property content is sensitive even when it does not identify a person. Door codes, smart-lock details, Wi-Fi passwords, private links, and access instructions appear only through protected workflows. Operators control the content they publish and must remove or change access information when it is no longer safe or current.

Guest information

For a short-term guest journey, the service may process:

• Full name, normalized phone number, optional email address, and chosen language.
• Property title and code associated with the visit.
• Snapshots of the warnings, house rules, acknowledgment wording, and content version displayed to the guest.
• Acceptance, agreement, and signature timestamps, signature type, and typed signature name.
• Hashed private access tokens, session expiry, email-delivery status, and related audit events.

The property operator receives the guest record and can view, filter, export, or print it through the authorized dashboard. Najla restricts records to the account that controls the property, except where Najla must support the service, comply with law, or protect the platform.

Prospect and survey information

For a long-term viewing journey, the service may process:

• Full name, normalized phone number, optional email address, and chosen language.
• Property title and code.
• Viewing registration, guide-opening, survey-opening, expiry, and completion timestamps.
• Yes or no answers about liking the apartment and intending to rent it.
• An explanation supplied after a negative answer where the form requests it.
• A hashed viewing token and related audit events.

The relevant property operator receives this record for viewing follow-up and rental decisions. The operator must use the information for the stated property purpose and must not use it for unrelated marketing without a separate lawful basis and any consent required by law.

Payment and Moyasar information

When customer checkout is enabled, Najla may process the selected package, billing interval, amount, currency, tax configuration, checkout identifier, Moyasar payment identifier, payment method type, status, payment time, receipt information, and subscription entitlement. STC Pay may require a Saudi mobile number for the payment flow.

For card payments, the browser sends the cardholder name, card number, expiry details, and security code to Moyasar's token service. Najla's server receives a payment token or provider reference and does not receive or store complete card credentials. Moyasar handles payment authentication and may show a separate transaction page. Najla activates a subscription only after server-side payment confirmation.

Najla stores payment-provider credentials only in the protected Website Owner workspace. The server encrypts stored configuration, masks credentials in the interface, and does not expose secret keys to ordinary users.

Device, application and security information

The service processes technical information needed to operate and secure the web and mobile applications. This may include internal user and account identifiers, platform, device label, application version, session creation and use times, token expiry or revocation, notification token, network status used for upload retry, storage usage, record versions, security and audit events, and notification read state.

The web server uses the connection address in temporary in-memory rate limits to reduce repeated login, registration, payment-test, and guest-form abuse. Najla does not add a new IP address to the policy-acknowledgment record. Hostinger and network providers may process connection logs, request time, browser or device information, and security events as part of hosting and infrastructure protection.

The audited application contains no first-party analytics, advertising, tracking, or crash-reporting SDK.

Optional camera access

The mobile application asks for camera access only when an operator chooses to capture a property photo or instruction video. The operator can use an existing file instead or continue without camera access. Captured media is uploaded to the protected property record only after the operator chooses the file and supplies the required labels.

Najla does not use the camera for background monitoring, facial recognition, advertising, or unrelated observation.

Optional photo-library access

The mobile application asks for photo-library access only when an operator chooses media from the device library for a property page or chooses a brand logo. The operator controls the selected files. The service does not scan or upload the full library.

The device may keep the original file according to its operating-system and library settings. Removing a file from the service does not delete the original from the operator's personal device.

Optional microphone access

The mobile application uses microphone access only when an operator records audio with a property instruction video. The operator may deny microphone access or upload a video without recording new audio. Najla does not activate the microphone for calls, continuous listening, advertising, or background monitoring.

Optional notifications

The mobile application asks for notification permission only after an operator enables notifications in Settings. If enabled, Najla registers an Expo push token and uses Expo, Apple Push Notification service, or Google Firebase Cloud Messaging to route minimal operational notices.

Notification previews avoid guest names, phone numbers, door codes, Wi-Fi passwords, private links, and full payment details. An operator can disable notifications in the application or device settings. Najla removes active push registration during account deletion and deletes expired disabled tokens under the retention schedule.

Optional biometric application access

An operator may enable Face ID, fingerprint, or another device-supported biometric method to unlock an existing authenticated application session. The operating system performs the comparison. Face images, fingerprint templates, and biometric templates remain under the device and operating system's control.

Najla receives only the local success, failure, or cancellation result. Najla does not receive or store the biometric template. Disabling biometric unlock does not close the account; the operator can use the normal account credentials.

Information the service does not collect

The audited service does not request or collect the device contact list, device GPS location, advertising identifier, cross-application behavioral advertising data, Bluetooth data, face templates, fingerprint templates, or continuous background activity. An operator may enter a property Google Maps link, but the service does not read the operator's or guest's device location.

Najla does not sell personal data. Najla does not use personal data for third-party advertising or cross-application behavioral advertising. The service has no advertising SDK, no tracking permission, and no first-party analytics or crash-reporting SDK in the audited version.

Collection sources

Najla receives personal data from:

• Operators, guests, prospects, support contacts, and authorized team members when they enter data or upload content.
• A registered property operator that creates a property page or manages a guest or prospect record.
• The web browser, mobile application, device operating system, and security controls when they create sessions, permission results, push tokens, or operational records.
• Moyasar when it returns payment status, provider references, and transaction results.
• Hostinger and other service providers when they provide hosting, delivery, security, or support information needed to operate the service.

Najla may also receive information from a lawful representative or guardian acting for a person who lacks full legal capacity.

Processing purposes and legal bases

Najla processes personal data for the following purposes and legal bases, according to the context:

• To create and administer an operator account, provide the selected workspace, store property content, deliver protected guest or viewing pages, and manage a subscription. The basis is performance of an agreement or steps requested before entering an agreement.
• To complete and confirm payment, issue records, handle disputes, and meet accounting or regulatory duties. The basis is contract performance and applicable legal obligations.
• To authenticate users, prevent abuse and fraud, protect private property information, enforce account limits, investigate incidents, and maintain network and information security. Najla relies on legitimate interests only after the required assessment, within the person's reasonable expectations, without using sensitive data on that basis, and without overriding individual rights.
• To send optional push notifications or use optional device features. Najla relies on the user's device choice and any consent required for the specific feature. A person may withdraw that choice through Settings without affecting prior lawful processing.
• To comply with Saudi law, court orders, competent-authority requests, legal holds, and recordkeeping duties. The basis is the applicable legal obligation.

For guest and prospect data controlled by a property operator, the operator determines and communicates the applicable legal basis. Najla processes that data under the operator's instructions unless Najla must process it for its own security, legal, or compliance purpose.

The Privacy Policy acknowledgment confirms that an operator read and understood the policy. It is not consent to every processing activity and it is separate from marketing or optional notification choices.

Required and optional fields

Operator name, email, phone number, password, language, and workspace selection are required to create and administer an account. The system may require identity confirmation before granting access. If the operator does not provide required account data, Najla cannot create or secure the account.

Short-term guests and long-term prospects must provide a name and valid phone number for the applicable private journey. Email is optional. A short-term guest must accept the displayed warnings and house rules and complete the final property acknowledgment before protected instructions open. A prospect must answer the displayed survey questions; an explanation is required only where the chosen answer triggers that field.

Property media, camera, photo library, microphone, notifications, biometric unlock, brand logo, social links, and many property-detail fields are optional. Some page types require specified map, media, warning, rule, contact, or instruction content before the operator can publish the page. Denying an optional device permission limits only the related feature.

Service providers and disclosures

Najla limits provider access to the service purpose and the data categories required for that purpose:

• Hostinger: application hosting, database, protected media, configured email transport, and infrastructure backups. The production server region is United States, Arizona.
• Expo: mobile build services and routing for optional push notifications. Expo uses cloud processing based principally in the United States and other locations listed for its subprocessors.
• Apple Push Notification service: delivery of optional operational notifications to Apple devices. Apple may process data in the United States and other Apple processing locations worldwide.
• Google Firebase Cloud Messaging: delivery of optional operational notifications to Android devices through Google's global infrastructure, which does not provide a fixed selectable processing location for this service.
• Moyasar: payment tokenization, checkout, authentication, verification, and payment-status records when checkout is enabled. Moyasar states that its payment-processing data is stored and processed in Saudi Arabia.

Najla may disclose guest or prospect records to the property operator that controls the record. Najla may also disclose the minimum data required by Saudi law, a court, or a competent authority, or to protect rights and information security where a lawful basis applies. Najla does not disclose personal data to data brokers or third-party advertisers.

Provider privacy references: Hostinger, Expo, Apple, Google, and Moyasar.

External links and deliberate opening of other applications

Property and public pages may contain deliberate links to Google Maps, WhatsApp, telephone, email, Instagram, TikTok, Snapchat, X, Najla websites, or another operator-supplied destination. The service opens the destination only after the user selects the link. The destination provider then processes browser, device, account, and interaction data under its own policy.

A Google Maps link may contain the property destination entered by the operator. A WhatsApp, telephone, or email link may contain the destination phone number, address, or prepared subject. Najla does not automatically send the guest or prospect form record to those external applications merely because the link appears. Information that a person sends after opening an external application is controlled by that person's action and the external provider's terms.

Operators must not add misleading or unlawful links. Najla does not control an external provider's content, security, availability, or privacy practices.

Processing inside and outside Saudi Arabia

Moyasar states that its payment-processing data is stored and processed within Saudi Arabia. The Najla production application, database, protected media, configured email transport, and infrastructure backups use Hostinger hosting in United States, Arizona. Expo, Apple, and Google may process optional mobile build or push-routing data in the regions described in section 23.

Some personal data may be transferred to or processed outside Saudi Arabia through Hostinger, Expo, Apple, or Google only where necessary to provide, secure, support, or operate the service. We assess the transfer and apply appropriate contractual, technical, and organizational safeguards. Transfers occur only as permitted by Saudi Arabia's Personal Data Protection Law and its regulations and are suspended if the required protection cannot be maintained. Moyasar states that its payment-processing data is stored and processed within Saudi Arabia.

Najla limits transferred data to the stated purpose, records applicable providers and regions, reviews transfer risk where the regulations require it, and requires processor assistance with security, individual requests, and deletion where applicable.

Cookies and local storage

The website uses necessary storage for language preference, authentication, private guest access, form progress, and deletion-request status. It does not use advertising or analytics cookies in the audited version.

• The operator web session uses an HttpOnly cookie for up to 12 hours. Production marks it Secure and SameSite Strict.
• A private guest link places its secret in the URL fragment, exchanges it for an HttpOnly protected cookie, and removes the secret from ordinary query-string handling. Bootstrap and guest-access cookies last no more than 24 hours; a provisional warning acknowledgment lasts no more than two hours. The server enforces the shorter long-term viewing period configured for the property.
• The browser stores the selected public or guest language in local storage. The public deletion page stores request-status details in session storage so the requester can refresh the status in the same browser session.
• The mobile application uses platform secure storage for authentication tokens, language choice, biometric preference, push token, and protected drafts. It may keep pending-upload queue metadata in application storage until an upload succeeds or the operator removes it.

A person can clear browser or application storage through device controls. Clearing necessary session storage may sign the person out, remove local drafts, or require the private journey to start again.

Retention periods

Najla uses the following approved maximum periods, subject to the starting point stated and any legal hold or legal retention duty:

• Guest identity: 365 days from the signed guest record.
• Long-term prospect identity and survey information: 365 days from viewing registration.
• Guest warnings, house-rule, and property acknowledgment records: 730 days from signature. Expired provisional acknowledgments are removed after their short session expires.
• Platform audit and processing-activity records: 1,825 days from the event or the end of the relevant processing activity, as applicable.
• Payment, checkout, receipt, accounting, dispute, and related status records: 3,650 days from creation or the transaction date.
• Operator account information after closure: up to 90 days to complete closure, subject to earlier active-system removal through a completed deletion request. Najla may retain a pseudonymous account key with payment, legal, or audit evidence for the longer applicable period.
• Removed or archived property content and protected media: 30 days from removal or archival.
• Support correspondence: 730 days from closure of the support matter.
• Disabled or invalid push tokens: 30 days from disablement or the last relevant registration event.
• Completed or rejected deletion-request queue records: 30 days from completion or rejection. Separate audit evidence follows the audit period.
• Infrastructure backups: a rolling period of up to 30 days after active-system deletion, subject to Hostinger's controlled backup cycle.

Scheduled cleanup handles eligible guest, prospect, acknowledgment, audit, payment, disabled push-token, completed deletion-queue, and archived property records. Account deletion, support mailbox controls, and provider backup procedures handle the remaining categories. Najla may anonymize a record instead of deleting it when the remaining information no longer identifies the person.

Najla may retain data for a longer period where Saudi law requires it, a payment or accounting obligation continues, a dispute or fraud investigation remains open, or an active legal hold applies. Najla restricts retained data to the reason for the exception and deletes or anonymizes it after the exception ends.

Security

Najla uses organizational and technical controls suited to the service, including HTTPS, password hashing, hashed session and private-link tokens, rotating mobile sessions, session revocation, authorization and account scoping, secure production cookies, platform secure storage, protected media routes, encrypted payment-provider configuration, rate limiting, minimal push content, audit records, legal holds, and controlled deletion processing.

Najla keeps door details, Wi-Fi passwords, guest identities, signatures, private links, complete payment credentials, and authentication tokens out of public pages, ordinary query strings, push previews, and public search indexing. Private guest pages instruct search engines not to index them, while the public Privacy Policy and account-deletion pages remain accessible.

No security method eliminates all risk. Operators and users must protect passwords, devices, private links, and access instructions, sign out from shared devices, and tell Najla promptly about suspected unauthorized access.

Individual rights

Subject to the Saudi Personal Data Protection Law, its regulations, and applicable exceptions, a person may have the right to:

• Know the legal basis, purpose, collection methods, use, storage, disclosure, and destruction of personal data.
• Access personal data held by the controller.
• Obtain a readable and clear copy in a commonly used electronic form, and a printed copy where technically possible.
• Request correction, completion, or updating of inaccurate or incomplete data.
• Request destruction when the data is no longer needed or another applicable ground exists.
• Withdraw consent where consent is the basis for processing, without affecting lawful processing completed before withdrawal.
• Submit a complaint and seek compensation where the law permits.

Send a request to najlapsa@gmail.com. Identify the account, property, guest, prospect, or support record and the right you want to exercise. Najla or the relevant property operator may request information needed to confirm identity and protect other people. Najla will route an operator-controlled guest or prospect request to the responsible operator and provide processor assistance.

The controller responds without delay and within 30 days after receiving a complete request. If implementation requires disproportionate effort or the same person submits multiple requests, the controller may extend the period by no more than another 30 days and will give advance notice with the reason. The controller may refuse a repetitive, manifestly unfounded, or disproportionate request where the regulations allow and will explain the reason.

Account and data deletion

An authenticated operator can request deletion through Settings → Account & data → Request account deletion. A person who cannot sign in can use https://guest.najlapsa.com/account-deletion. The public process uses an email code and a private status token. Najla does not act on an unconfirmed public request against an account.

After confirmation, Najla suspends the account, revokes web and mobile sessions, disables push tokens, and places the request in the protected owner workflow. Authorized processing removes protected media and active credentials, removes or anonymizes property content, anonymizes guest and prospect identifiers under that account, clears active notification and reset records, and replaces account identifiers with deletion values. The requester can check a limited public status; internal notes remain restricted.

Najla retains payment, receipt, accounting, fraud, dispute, legal acceptance, and security audit evidence only for the applicable periods and anonymizes direct identifiers where possible. An active legal hold can delay completion. Hostinger backup copies leave the backup cycle within up to 30 days after active-system removal. Najla records any processor follow-up needed for push, hosting, or payment records.

The protected Website Owner account cannot use the ordinary customer-deletion workflow because the system requires an accountable owner for legal, security, payment, and deletion administration. A lawful closure of that controller account requires a separate controlled migration and business-record process.

Children and people lacking full legal capacity

The operator service is designed for persons who can manage a property account and enter the relevant agreement. It is not designed for children acting as independent property operators. The service does not ask for date of birth and should not be used to collect a child's data unless the property operator has a clear lawful need and follows the rules for guardians and persons who lack full legal capacity.

Where a person fully or partly lacks legal capacity, the legal guardian may exercise that person's rights. Najla or the property operator may request evidence of authority before acting on the request. If Najla learns that an account or record lacks the required authority, it may suspend processing and delete or restrict the information subject to legal retention duties.

Material policy changes

Najla creates a new version when it makes a material change to processing purposes, data categories, controller roles, providers, international processing, retention, individual rights, or deletion practices. The public page shows the version and effective date and preserves published historical versions.

Najla may notify registered operators through the application or account email before a material version takes effect. If the new version requires acknowledgment, the service will present the legal-update screen before continued account use and will record the accepted version, hash, language, source, and time. Minor editorial corrections do not require a new acknowledgment unless Najla marks them as requiring one.

Contact and complaints

Send privacy questions, rights requests, objections, or complaints to:

Najlaa Saleh Hamad bin Shuail Establishment Real Estate
Building 3305, Malik Al Qusheri Street, Al Muruj District
Secondary Number 7923, Postal Code 12284
Riyadh, Kingdom of Saudi Arabia
Email: najlapsa@gmail.com

For a guest or prospect record controlled by a registered property operator, contact the operator shown in the property notice. You may also contact Najla at the address above, and Najla will help route the request.

If you believe that the controller has not handled your concern or request under the Saudi Personal Data Protection Law, you may complain to the Saudi Data & AI Authority through the National Data Governance Platform or review authority information at https://sdaia.gov.sa. The Implementing Regulations state that a complaint should be submitted within 90 days from the incident or from learning of it, while allowing the competent authority to consider a later complaint where a factual reason prevented timely submission.