Last updated: 4 October 2026
Rakha (“Rakha”, “we”, “us”) operates rakhaapp.com and the Rakha mobile app, a marketplace for booking spa and wellness services in Saudi Arabia. This policy explains what personal data we collect, why, who we share it with and the choices you have. It is written to comply with the Saudi Personal Data Protection Law (PDPL).
Account data: your name, mobile number, email address, password (stored only as a hash) and, if you sign in with Google, the name, email and profile picture Google shares with us.
Booking data: the centers, services, team members, dates and times you book, notes you add, cancellations, reviews and ratings.
Payment data: the amount, currency, payment method and status of online payments. Card details are entered directly with our payment provider, MyFatoorah, and never reach Rakha's servers.
Device and usage data: the push-notification token of your device, your language preference, app version, and technical logs (IP address, browser or device type, pages visited) needed to run and secure the service.
Partner data: if you register a spa center, its business details, team members' names and contact details, bank details for payouts and the records of its bookings and payments.
To create and secure your account and sign you in (sign-in codes are sent to your mobile number or email).
To make, confirm, remind you of and manage bookings, and to let the center you booked prepare for your visit.
To process online payments and refunds, settle proceeds to centers and keep the accounting records the law requires.
To send booking confirmations, reminders and updates by WhatsApp, email and app notifications. Marketing messages are sent only if you opted in, and you can opt out at any time from your account settings.
To answer support requests, prevent fraud and abuse, and improve the service.
The spa center you book: your name, mobile number, email, the booked services and any notes you add, so they can deliver the service and contact you about your visit.
Service providers acting on our instructions: MyFatoorah (payments), Meta WhatsApp Business and our email provider (messages), Google Firebase (app notifications), Google (sign-in, if you choose it) and our hosting and database providers. They may process data only for the purposes above.
Authorities, when the law requires it, and professional advisers under confidentiality.
We do not sell your personal data.
We keep account and booking data while your account is active and for the period required for accounting, dispute and legal purposes afterwards (generally up to ten years for payment records). Sign-in codes expire within minutes and message logs are kept for a limited time for support and auditing.
You can access and correct your data from your account at any time, and ask us to delete your account, export your data, restrict or object to processing, or withdraw consent for marketing. Write to support@rakhaapp.com and we will respond within the time the PDPL allows. Deleting your account does not remove records we must keep by law, such as payment records.
Data is encrypted in transit and stored with reputable cloud providers with access controls, logging and backups. Some providers process data outside Saudi Arabia; we only use providers that offer appropriate safeguards.
Rakha is intended for adults. We do not knowingly collect data from children under 18 without a guardian's consent.
We may update this policy; the date above shows the latest version and material changes will be announced in the app or by email. Questions and requests: support@rakhaapp.com.