سياسة الخصوصية | Privacy Policy

1. Introduction

This Privacy Policy explains how Elegance Code collects, uses, shares, stores, transfers, and protects personal data when you use our website, mobile application, legal centre, support channels, or expert-led consultation workflows.

The platform is currently focused on the Kingdom of Saudi Arabia and may support users in GCC countries where the service is available. We aim to align our privacy practices with the Saudi Personal Data Protection Law (PDPL), its Implementing Regulations, and other applicable privacy and consumer protection requirements.

2. Controller and Contact

For personal data processed through the Elegance Code platform, the platform operator identified in the Platform Owner and Operator Information section acts as the data controller unless a specific written arrangement states otherwise. For privacy, correction, deletion, objection, or data-rights requests, contact: elegancecode.app@gmail.com.

3. Service Context: Expert-Led Consultation

Elegance Code is not designed as an instant automated digital download service. Personal data may be processed to allow a human expert to review a request, prepare for a session, provide appearance consultation support, and document the consultation outcome. Digital reports and recommendations are part of that expert-led workflow.

4. Personal Data We May Collect

• Identity and contact data: name, phone number, email address, account ID, user role, and preferred language.
• Expert public-profile data: preferred name, biography, city, service information, and an optional professional photograph or salon/studio logo that the expert has the right to use. This information may be displayed to clients in the expert-selection list and expert profile.
• Booking and service data: appointment details, expert assignment, booking status, attendance records, QR/ticket events, preferences, notes, and support messages.
• Smart Wardrobe data: clothing and accessory images uploaded by the client, wardrobe labels, categories, style notes, colour tags, and related metadata. These files may be stored in Firebase / Google Cloud Storage under user-specific paths such as users/{uid}/wardrobe/.
• Smart Mirror and AI image inputs: images voluntarily captured or uploaded for virtual styling or Sumayah AI consultation. These images may be processed temporarily through cloud functions and third-party AI services such as Google Gemini API to generate a response and are not intended to be stored as permanent account files by Elegance Code unless the feature clearly states otherwise.
• Chat attachments: images, files, or messages voluntarily exchanged between a client and an expert or submitted to support. Order chat attachments may be stored under a path such as order_chats/{orderId}/.
• Payment support data: payment receipts, refund receipts, transfer screenshots, receipt review status, and related dispute notes. Receipt files may be stored under paths such as orders/{orderId}/receipts/.
• Appearance consultation data: preferences, measurements, style notes, selected answers, body or face proportion observations, colour preferences, and other consultation materials submitted by the user or generated during the service.
• Generated outputs: consultation reports, recommendations, expert notes, decision logs, image annotations, and service summaries.
• Technical data: device type, operating system, app version, IP-related technical logs, timestamps, authentication logs, error logs, security events, and storage metadata.
• Location data: approximate or precise location only where enabled by the user or needed for appointment coordination.
• Privacy requests and safety reports: account deletion requests, wardrobe image deletion requests, data export requests, abuse, fraud, or privacy reports, blocking requests, review status, reasons, timestamps, and related administrative records. This data may be stored in collections such as account_deletion_requests, data_requests, and abuse_reports.

5. Images, Measurements, AI Processing, and Sensitive Data

Because the service may involve appearance-related information, wardrobe images, user-selected photos, measurements, or style preferences, some data may be personal or sensitive in nature. We process such data only for defined platform purposes such as user-requested features, expert-led consultation, report generation, support, security, quality control, and dispute handling.

The expert does not receive a general gallery of the client's wardrobe, body images, face images, iris images, skin images, vein images, or Smart Mirror / Sumayah AI images. An expert may see only content that is deliberately shared in the relevant order workflow, such as a chat attachment or receipt connected to that expert's service.

Unless explicitly stated and separately consented to, Elegance Code does not use face or body images for biometric identification, identity recognition, public profiling, or sale to third parties. We do not sell personal data.

6. Legal Bases and Purposes

We process personal data where one or more of the following applies:

• the user has provided consent;
• processing is necessary to provide the requested consultation workflow;
• processing is necessary for account security, fraud prevention, support, and platform integrity;
• processing is necessary to comply with legal obligations or respond to competent authorities;
• processing supports legitimate operational interests, provided those interests do not override user rights under applicable law.

7. How We Use Personal Data

The platform may use technical logs and automated alerts to help administration detect fraud or misuse; however, material actions such as account suspension, dispute review, or abuse-report handling may be reviewed by administration or an authorised team where appropriate.

8. Human Review and AI-Assisted Processing

The platform may use AI-assisted tools to organise information, draft recommendations, classify style-related inputs, or support report creation. These tools are used to assist the expert-led consultation workflow and are not intended to make final medical, legal, financial, or clinical decisions about users.

Where practical, important consultation outputs may be reviewed, corrected, or approved by a human expert or authorised operator.

9. Direct Payment, Receipts, Refund Proof, and Financial Data

Under the direct payment model, consultation fees are generally settled directly between the client and the independent expert. Elegance Code does not collect, hold, or process the consultation fee and does not need to store full card numbers, bank passwords, or sensitive payment credentials for this model. The platform does not intervene in financial arrangements between the client and the expert.

The platform provides a receipt-based verification tool for both parties. This tool allows a client to upload her payment receipt for expert review, and allows an expert who cancels a session to upload a refund receipt for the client to confirm. Receipt images may be stored in Firebase / Google Cloud Storage under the related order and may be reviewed by the assigned party and authorised administrators for support, safety, and dispute handling.

Users should avoid uploading unnecessary sensitive financial details, including full account numbers, card numbers, passwords, one-time passcodes, or unrelated private documents. Elegance Code is not responsible for incorrect transfers caused by incorrect IBAN, account number, beneficiary name, amount, bank, or payment reference entered by the client or expert.

10. Sharing Personal Data

We do not sell personal data. We may share limited personal data only where necessary:

• with the assigned expert for service delivery and consultation review, limited to the information needed for that order or chat;
• with authorised platform administrators and technical support staff where needed for support, security, fraud prevention, legal compliance, dispute handling, or platform integrity;
• with secure cloud, authentication, storage, hosting, analytics, crash reporting, messaging, email, or AI service providers, including Firebase / Google Cloud services and AI processing providers where the user requests AI-supported features;
• with legal, regulatory, law-enforcement, court, or dispute-resolution authorities where required or permitted by law;
• with professional advisers where necessary to protect legal rights, security, or compliance.

Smart Wardrobe images are not shared with experts by default. Smart Mirror and Sumayah AI images are processed for the user-requested feature and are not made visible to experts unless the user separately sends them through a feature that shares content.

11. Cross-Border Transfers

Some cloud services, support systems, or technical providers may store or process data outside the Kingdom of Saudi Arabia. Where personal data is transferred outside the Kingdom, we aim to apply appropriate safeguards, minimise the transferred data, and follow applicable PDPL requirements for cross-border transfer.

12. Data Retention

We retain personal data only for as long as necessary for the purposes described in this Policy, including service delivery, user support, legal compliance, security, dispute handling, and platform integrity.

• Smart Wardrobe images: retained while the user keeps them in her wardrobe or account, unless deletion is requested or required by law, technical necessity, or platform integrity needs.
• Smart Mirror and Sumayah AI images: not intentionally retained by Elegance Code as permanent files after the requested processing unless the user separately saves them or the system must temporarily process them for technical delivery, security, or error handling.
• Chat attachments: retained as part of the order or conversation record for service continuity, support, safety, and dispute handling.
• Payment and refund receipts: retained as operational evidence for a reasonable period needed for verification, support, fraud prevention, and dispute handling.
• Account and booking records: may be retained while the account is active and for a reasonable period thereafter where required for legal, accounting, security, or dispute purposes.
• Security logs: may be retained for a limited period necessary to detect and investigate misuse or unauthorised access.
• Data deletion requests: the platform may retain a record of the deletion request and its status for a reasonable period to prove fulfilment and legal compliance.
• Financial receipts: may be retained for up to 7 years or the period required by applicable financial, tax, or dispute-related obligations.
• Dispute and abuse-report records: retained until review or final resolution, and may be retained afterwards for a limited period to protect rights or prevent repeated misuse.
• Blocking records: retained while the block is needed to protect the user or prevent unwanted contact, or until the user requests unblocking where the platform allows it.

13. Security Measures

We use technical and organisational measures intended to protect personal data, including access controls, authentication, role-based permissions, encrypted transmission, secure cloud infrastructure, logging, monitoring, and restricted expert access. No system is completely risk-free, and users should protect their own login credentials.

14. User Rights

Subject to applicable law, users may have the right to be informed, access personal data, request correction, request deletion/destruction, withdraw consent, obtain a copy in a readable format, object or restrict certain processing where applicable, and contact competent authorities.

To exercise privacy rights, contact elegancecode.app@gmail.com. We may need to verify identity before responding.

15. Account Deletion

Both clients and experts may request deletion of their accounts from inside the application. Clients can find the option in the Account tab, while experts can find it in Expert Account Settings. If the app cannot be accessed, the request may be submitted through the Data Deletion Request page in the legal centre or by contacting support.

A request creates an administrative review state and does not cause immediate deletion. Before completion, we check for active bookings, unfinished sessions, pending payments or refunds, receipts, disputes, reports, or other unresolved obligations. Final deletion is not completed until obligations that may affect the rights of a client or expert, or platform integrity, are resolved.

Once approved, the authentication account, operational profile, and deletable data are removed, and linked records are deleted or de-identified where appropriate. Limited records may still be retained where required for legal compliance, security, accounting, dispute handling, fraud prevention, or backup integrity. Basic requests are typically processed within 7 business days, and cases involving disputes, legal obligations, or financial records may take up to 30 days.

16. Children and Minors

The platform is not intended for unsupervised use by children. Independent registration and booking are intended for users aged 18 or older. If a consultation, wardrobe, image, payment, or chat interaction relates to a minor, a parent or legal guardian must provide clear consent, supervise the use of the platform, approve any direct payment, and remain responsible for the request and submitted data.

Elegance Code is not responsible for bookings, payments, uploads, or consultations submitted by minors without the knowledge or permission of their parent or legal guardian. Where we become aware of unauthorised minor use, we may restrict the account, request guardian confirmation, delete data where appropriate, or take other action required by law.

17. Marketing and Communications

We may send service-related notifications, including booking, receipt, appointment, and report updates; direct chat messages between a client and an expert; administration and support replies; security notices; or policy changes. The operating system grants one device-level notification permission, while the app provides separate preferences for service, chat, and support categories. Dr Sumayah initiative messages and style reminders remain optional and are enabled only with the user's consent. Any marketing messages are managed according to applicable consent and opt-out requirements.

18. Cookies, Analytics, and Website Logs

Our website and legal centre may use basic cookies, hosting logs, analytics, or security tools to keep the website functional, secure, and reliable. Users may manage browser settings where applicable.

19. Data Breach Handling

If we become aware of a personal data breach that may cause harm or prejudice to user rights, we will take appropriate steps according to applicable law, including investigation, mitigation, notification to competent authorities, and notification to affected users where required.

20. Policy Updates

We may update this Privacy Policy to reflect legal, technical, operational, or service changes. The updated version will be posted on our website or app, and continued use of the platform after publication means acceptance where permitted by law.

21. Contact

Privacy requests and questions: elegancecode.app@gmail.com.