Privacy Policy

Last updated: June 2026

At Baraaem, we are committed to protecting your personal data in accordance with the Saudi Personal Data Protection Law (PDPL) and its implementing regulations.

1. Personal data we collect

We collect the following categories of personal data:

Mobile phone number — for OTP identity verification (stored in parent_users table).
Full name — to associate your account with booking communications (parent_users).
Booking details: parent name, phone, child age in months, preferred visit date (bookings table).
Reviews: review text and star rating linked to your account (reviews table).
Session data: an encrypted session token in a cookie to keep you signed in (parent_sessions table).
OTP codes: stored hashed, valid for 5 minutes only (otp_codes table).

2. Purposes and lawful basis

Account creation and verification — Lawful basis: your explicit consent at sign-up (PDPL Art. 5).
Forwarding booking requests to nurseries — Lawful basis: contract performance.
Publishing reviews — Lawful basis: your implicit consent by submitting a review.
Platform improvement — Lawful basis: legitimate interest in delivering a better service.

3. Data retention

We retain your data for as long as your account is active. When you delete your account, your personal data (name and phone) are permanently deleted immediately. Booking records linked to your account are anonymised (personal identifiers removed) to preserve the nursery's legitimate operational record.

4. Cross-border transfers

Data is currently stored with our managed cloud database provider (Railway) on managed PostgreSQL infrastructure. In the production release, all personal data will be migrated to servers inside the Kingdom of Saudi Arabia (AWS me-central-1) to satisfy PDPL data-residency requirements. The final data-residency region and the cross-border-transfer legal basis are being finalised as part of our pre-launch data-protection review.

5. Your data-subject rights

Access and portability: request a copy of your personal data.
Correction: correct inaccurate or incomplete data.
Erasure (right to be forgotten): delete your account and all associated personal data — available directly from your account page.
Withdraw consent: withdraw consent at any time without affecting the lawfulness of prior processing.
Object: object to processing of your data in certain circumstances.

To exercise any of these rights, contact us at: privacy@baraaem.com

6. Security measures

All connections encrypted in transit via TLS 1.2 or higher.
Passwords and sensitive data encrypted at rest (bcrypt + server-side encryption).
Audit log for all write operations on personal data tables.
OTP codes valid for 5 minutes with brute-force rate limiting.

7. Contact

Data Protection contact: privacy@baraaem.com