Last updated: 30 September 2026
1. Controller and scope
The data controller is MUAYID EAZIZ S AL OTAIBI, a freelance practitioner and operator of moayad.app. This policy explains processing when you browse the site, submit an enquiry, act as a client or portal user, or receive operational communications.
2. Categories of data we process
- Identity and contact data: name, company name if supplied, email, phone number, language, and preferred contact channel.
- Enquiry and client data: requested service, project description, indicative budget and timing, answers, links, attachment metadata, and attribution data where provided.
- Account and authentication data: account and verification status, protected credentials, two-factor settings, sessions, invitations, and protected password-reset or email-change tokens.
- Commercial relationship data: quotes and versions, acceptance, projects, stages, tasks, files, delivery, approvals, and revisions.
- Financial data: invoices, payment requirements and status, bank transfers, payer name and bank reference, and refund records where applicable. The site does not currently collect payment-card details.
- Support and communications data: support requests, correspondence, notifications, message subject and content, delivery status, and provider message identifiers.
- Technical and security data: IP address and user agent for sessions and certain client decisions, login and activity timestamps, request and correlation identifiers, audit, error, job, and security events.
3. Sources of data
We receive data directly from you through forms, accounts, the portal, and correspondence; from website operation and security records; from an authorized client representative; and from operational, email, and payment providers when their services are used. Derived data, such as a request status or next action, may be generated from operational records.
4. Purposes of processing
- Review enquiries, communicate before contracting, and prepare quotes.
- Create accounts, verify operational identity, manage sessions, and protect access.
- Deliver services and manage projects, approvals, revisions, delivery, and support.
- Issue invoices, record payment requirements, verify bank transfers, and maintain financial records.
- Send operational email, record delivery status, and handle bounces and complaints.
- Prevent fraud and misuse, enforce authorization and rate limits, and investigate faults and incidents.
- Meet legal and contractual obligations, evidence decisions, and protect rights.
5. Legal basis
We process data as necessary to take steps at your request before contracting, perform the contractual relationship, comply with legal obligations, pursue legitimate interests such as service security and transaction evidence where permitted, or rely on consent where it is required. Consent is not presented as the basis where performance or law is the actual basis.
6. Service providers
We share or make data available only as needed to providers that help operate the platform or deliver the service, subject to appropriate purpose and access controls. We do not sell personal data.
- Vercel: website hosting, application runtime, routing, and necessary operational logs.
- Neon: hosting the PostgreSQL application database.
- Resend: sending transactional email and recording sent, delivered, delayed, failed, bounced, and complained events.
- Google Workspace: receiving and managing messages addressed to info@moayad.app and support@moayad.app.
- Better Auth is an authentication library running within the application, not a separate external identity provider.
7. Processing outside Saudi Arabia
The platform actually processes data outside Saudi Arabia. The Production Neon database is in AWS US East 1 (N. Virginia, United States), and the currently configured Production application functions execute in Vercel iad1 (Washington, D.C., United States). Selecting an execution region establishes where those functions run; it does not by itself establish the location of every Vercel service, log, or support system.
Resend stores customer data in the United States, including message content, delivery logs, webhook payloads, and account records. Resend states that email and log data on its ordinary plans is retained for 30 days and backups persist for 7 days. Vercel, Neon, and Resend may permit authorised personnel and documented subprocessors to process data under their agreements. The public evidence reviewed did not establish the physical location of every Vercel or Neon backup or support record.
Google Workspace is used to receive and manage mail for moayad.app, but the subscription edition and actual Data Regions setting were not verified. We therefore do not attribute a specific storage or processing region to it. Google offers certain data-region controls depending on the Workspace edition; availability does not show that they are enabled for this account.
Vercel, Neon, and Resend publish data-processing agreements. The Vercel and Resend instruments include mechanisms primarily directed to European transfer frameworks. Those agreements and general GDPR policies do not by themselves prove compliance with Saudi transfer requirements. Applicability of the Saudi Regulation on Personal Data Transfer outside the Kingdom, the purpose and scope of each transfer, data minimisation, an appropriate safeguard, and any required transfer risk assessment must be documented and reviewed by Saudi counsel before final legal approval.
8. Retention
Retention is determined by the processing purpose, contractual and legal obligations, dispute resolution, protection of rights, and security. There is currently no general automated deletion policy covering every data category. The need for destruction or anonymisation is reviewed case by case using available means where law permits or requires it. This text does not promise an automated deletion schedule that is not implemented.
Validity is not the same as deletion. The current sign-in session lifetime is 12 hours and may be refreshed or revoked; portal invitations expire after 72 hours; password-reset links expire after 30 minutes; and email-change links expire after 60 minutes. The server rejects an expired, consumed, or revoked token, and security tokens are stored as hashes. Status and consumption records may remain for audit after a link becomes unusable because the application does not currently apply a general automatic deletion schedule to them.
The maintenance job deletes credential-attempt rate-limit keys 24 hours after the last attempt. Resend currently states that it retains email and log data for 30 days on its ordinary plans and backups for 7 days. Final deletion periods have not yet been adopted for client, project, quote, invoice, payment, support, internal email-delivery, and audit records in Moayad's database.
| Category | Verified period | Effect at expiry | Record retention | Current deletion |
|---|---|---|---|---|
| Sign-in session | Access lifetime up to 12 hours, subject to refresh or revocation | Expired or revoked sessions are rejected | The access lifetime is not a promise that every session record is deleted at that instant | Deleted on certain security events such as password change or account suspension; no documented general cleanup job |
| Client-portal invitation | 72 hours | Rejected after expiry, consumption, revocation, or replacement | Status record remains for audit | No documented general automatic deletion |
| Password reset | 30 minutes | Rejected after expiry, consumption, or revocation; successful use invalidates sessions | Hashed-token status record remains for audit | No documented general automatic deletion |
| Email change | 60 minutes | Rejected after expiry, consumption, or revocation | Hashed-token status record remains for audit | No documented general automatic deletion |
| Credential rate-limit keys | 24 hours after the last attempt | No further operational purpose after the protection window | Not a commercial client record | Automatic deletion by the maintenance job |
| Moayad commercial, operational, and audit records | No final deletion period adopted | Subject to purpose, obligations, and rights | Currently retained for operations | Manual review or action; no general automatic deletion |
| Provider-side Resend data | 30 days for email and logs; 7 days for backups according to provider documentation | Managed under the provider retention cycle | Separate from Moayad's internal Email Delivery Log | Automatic at the provider according to its plan and documentation |
9. Information security
We apply reasonable controls including encrypted transport, environment and tenant separation, server-side authentication and authorization, protected rather than plaintext password storage, secure sessions, one-time tokens stored as hashes where the design uses them, rate limiting, audit records, signed webhook verification, and secrets kept outside source code.
No transmission or storage method is absolutely secure. Controls are reviewed and incidents are handled according to their nature and applicable requirements.
10. Your data rights
Where applicable under Saudi law, you may have the right to be informed about collection and purpose, access your data, obtain it in a clear and readable format, request correction, completion or updating, request destruction where conditions are met, withdraw consent where consent is the basis, and complain to the competent authority.
11. Exercising your rights
Send privacy requests to support@moayad.app. We may request information reasonably necessary to verify the requester's identity and authority and to prevent unauthorized disclosure. A data-rights request is handled without delay and within no more than 30 days. The period may be extended by no more than a further 30 days where implementation requires disproportionate effort or multiple requests are received, provided the data subject is notified in advance with the reason for delay. This deadline concerns data rights and is not a commercial-complaint service level.
Where permitted, we explain the result or why a request cannot be fulfilled in whole or in part. A data subject may complain to the Saudi Data and Artificial Intelligence Authority as the competent authority within 90 days of the incident or of becoming aware of it, subject to the Regulation's allowance where reasonable grounds prevented timely filing.
12. Access, correction, copies, and destruction
We aim to keep data accurate. Access, correction, copy, and destruction requests can be submitted through the privacy channel. Limited records may be retained where needed to evidence a transaction or financial or legal obligation, or to protect security and rights, even after account suspension or service completion.
13. Security and fraud prevention
We may process IP addresses, user agents, correlation identifiers, login attempts, requests, and operational events to detect misuse, apply rate limits, prevent unauthorized access, and investigate failures and incidents. Operational error records are privacy-minimised and do not store raw request bodies.
14. Children
The services are not primarily directed to children. If you believe a child's data has been processed without an appropriate basis, contact support@moayad.app so the matter can be reviewed and appropriate action taken.
15. Direct marketing
Operational messages needed for an account or service are distinct from marketing. Accepting a project or account is not marketing consent. We do not use your data for direct marketing without meeting legal requirements and obtaining consent where required. No advertising or marketing trackers are currently enabled on the site.
16. External links
The website may link to external services such as WhatsApp, Instagram, and TikTok. Their processing is governed by their own policies after you leave the website, and this policy does not control their independent practices.
17. Changes to this policy
This policy may be updated to reflect service, processing, or legal changes. The latest update date appears above, and additional notice will be provided where the impact of a change requires it.
18. Contact
Privacy, data-rights, and complaint requests: support@moayad.app. General enquiries: info@moayad.app.