In short
- We collect what we need to run bookings, matches, rankings and payouts, and nothing we can't explain.
- We do not sell your personal data. We do not share it with advertisers or data brokers. Ever.
- Your card details never touch our servers; a SAMA-licensed payment gateway handles them.
- Your data is stored in the Kingdom of Saudi Arabia and protected under the Personal Data Protection Law (PDPL).
- You can see, export, correct or delete your data from the app, or by emailing us.
- Kids' profiles are created and controlled by a parent, carry no public tier, and are never used for marketing.
1. Who we are
Jawla is operated by Jawlah Go Company (شركة جولة جو), a company registered in the Kingdom of Saudi Arabia, commercial registration 7054199224, VAT registration 314763716300003, based in Riyadh. In this policy, "Jawla", "we" and "us" mean Jawlah Go Company. We are the data controller for the personal data described here.
This policy covers the Jawla mobile app, the website at jawla.ai, the partner portal at partner.jawla.ai, and any venue websites we host for partners. It applies to players, parents, venue and academy staff, coaches and visitors.
2. Data we collect
We collect data in three ways: what you give us, what the app generates while you use it, and what our partners enter about bookings you make with them.
What you give us
| Data | When | Why |
|---|---|---|
| Mobile number | Sign-up and sign-in | Your phone number is your account. We verify it with a one-time code by SMS. We do not require an email address to play. |
| Name, photo, city | Profile | Shown to players you book or match with. Photo and city are optional. |
| Sports and self-declared level | Onboarding | Seeds your Jawla Score so your first matches are at the right level. |
| Sex | Onboarding | Required to run the women's lane. It controls who can see and join women-only matches and tournaments. Never shown publicly and never used for advertising. |
| Date of birth | Onboarding | To confirm you are 18 or over, or to route a junior into Jawla Kids under a parent account. |
| Kid profile details | Jawla Kids | Name, date of birth and sports of a child, entered by the parent. See section 7. |
| Messages and posts | Groups and match cards | Posts and comments you write in groups and on match cards. There is no private chat in Jawla. |
| Support tickets | Help | What you tell us when you ask for help, so we can resolve it and track it. |
What the app generates
| Data | Why |
|---|---|
| Bookings, matches, tournament entries, results | To run the service, pay venues, and calculate your Jawla Score. |
| Jawla Score, tier, rating history | Your rating and how it changed. Derived from results, never from anything else. |
| Approximate location | To show courts and matches near you. Only while the app is open, and only if you allow it. See section 10. |
| Device and app data | Device type, OS version, app version, language, time zone, crash reports and push token. To keep the app working and send notifications you've turned on. |
| Usage events | Which screens and features you use, in aggregate, to improve the product. Not tied to advertising identifiers. |
What partners enter
When you book at a venue, that venue sees your name, the booking, and whether it is paid. Front-desk staff may record a check-in or a no-show. Coaches may record attendance for a session. Academies see enrollment details a parent submitted. Partners see only the data needed for the booking or program you are part of; they never see your phone number unless you have booked with them, and never your payment details.
3. How we use your data
- Running the service: creating your account, confirming bookings, matching you into open matches at your level, running tournaments, calculating your Jawla Score, sending confirmations and reminders.
- Payments: taking payment for bookings, splitting fees between players, refunding under a venue's cancellation policy, and settling money to venues weekly.
- Safety and integrity: keeping women-only and juniors-only lanes restricted to who they are for, detecting fake results or abuse of the rating system, and enforcing our terms.
- Support: answering your tickets and resolving disputes about bookings or results.
- Improving Jawla: understanding which features are used and where the app fails, in aggregate.
- Communication: transactional SMS and push notifications about your bookings and matches. Marketing messages only if you opt in, and you can turn them off any time.
- Legal obligations: issuing ZATCA-compliant e-invoices, keeping accounting records, and responding to lawful requests from Saudi authorities.
4. Legal basis
Under the Personal Data Protection Law of the Kingdom of Saudi Arabia (PDPL) and its Implementing Regulations, we process your data on the following bases: performing the contract you have with us when you use Jawla; your consent, where we ask for it (location, marketing, a parent's consent for a kid profile); our legitimate interests in keeping the service safe, accurate and improving, where those interests do not override your rights; and compliance with legal obligations, including tax and e-invoicing rules.
5. Who we share data with
We share personal data only with the parties below, only for the purposes stated, and under contracts that require them to protect it. We do not share it with anyone else.
| Who | What | Why |
|---|---|---|
| The venue, academy or coach you book with | Name, booking details, attendance, results | To deliver the booking or program you chose. |
| Players in your match, group or team | Name, photo, tier ring, city badge | So people know who they are playing with. Your phone number is never shown to other players. |
| Payment gateway (licensed by SAMA) | Amount, booking reference, your name | To process payments and refunds. They handle your card; we never see the full number. |
| SMS provider (CITC-licensed, in the Kingdom) | Phone number, message content | To deliver one-time codes and booking messages. |
| Cloud hosting and infrastructure | Encrypted data at rest | To run the service. Data centres in the Kingdom (see section 15). |
| Crash and analytics tooling | Device data, usage events | To find bugs and improve the app. Configured without advertising identifiers. |
| Sports federations | Name and results, only if you opt in | To have your results count toward official recognition. |
| Authorities | What the law requires | Only in response to a valid legal request under Saudi law. |
Our current list of processors is available on request at support@jawla.ai.
6. What we never do
We have never sold personal data and we never will, to anyone, for any price.
No ad networks, no ad identifiers, no retargeting, no "partners" who show you ads. Jawla has no advertising business.
Your data does not leave the parties listed in section 5.
Group posts are read by the people in your group and, if reported, by our safety team. Not by algorithms building a profile of you.
Location is used only while the app is open, and only if you allow it.
No marketing, no profiling, no public tier, no sharing beyond the parent, the venue and the coach.
7. Children and Jawla Kids
Players must be 18 or over to hold their own Jawla account. Anyone younger plays through Jawla Kids: a kid profile created by a parent or legal guardian under the parent's own account.
- The parent enters the child's name, date of birth and sports, and consents to this policy on the child's behalf.
- Kid profiles have no phone number, no login, no public tier, no card sharing and no marketing.
- Kid profiles can join juniors-only matches, academy programs and under-18 groups run by adults. They cannot join open or women's lanes.
- Coaches and academies see the child's name, age group and attendance for the sessions they run, and the parent's contact details.
- The parent can view, correct or delete the kid profile at any time. Deleting it removes the child's data except what we must keep for invoices.
If we learn that a child has created an account outside Jawla Kids, we will close it and delete the data.
8. Venues, academies and coaches
If you use the partner portal, we collect your name, phone number, role, and the details needed to onboard your business: commercial registration, VAT number, contract signatory, bank account for payouts, and the courts, programs and coaches you set up. We use this to run your account, pay you, issue e-invoices and comply with the law. Bank details are stored encrypted and shown in the portal only as the last four digits.
Partners are independent controllers for the data they enter about their own staff and for how they treat players at their premises. Our partner agreement requires them to use player data only for the booking or program concerned, to keep it secure, and never to contact players for marketing without consent.
9. Payments
Payments in Jawla are processed by a payment gateway licensed by the Saudi Central Bank (SAMA). When you pay, your card details go directly to the gateway; Jawla receives only a token, the amount, the last four digits and the result. We do not store full card numbers, expiry dates or security codes. Refunds are processed through the same gateway to the same card. Settlements to venues contain booking references and amounts, not your payment details.
10. Location
Jawla asks for approximate location to show courts and open matches near you and to sort them by distance. This is optional; you can use the app by choosing a city instead. We use location only while the app is in the foreground, we do not keep a history of where you have been, and we do not share location with partners or other players. Your city badge on your player card is the city you chose, not GPS data.
11. How long we keep data
| Data | Kept for |
|---|---|
| Account and profile | While your account is open, then deleted within 30 days of closure. |
| Bookings, payments, invoices | 10 years from the transaction, as required by Saudi tax and commercial law. Kept as financial records only. |
| Match results and rating history | While your account is open. On closure, results are kept in anonymised form so other players' ratings remain accurate. |
| Group posts and comments | Until you delete them or your account closes. Your name on old posts becomes "Deleted player". |
| Support tickets | 2 years after closure of the ticket. |
| Location | Not stored. |
| Server and security logs | 90 days. |
12. Security
Data is encrypted in transit (TLS) and at rest. Access inside Jawla is role-based and logged; partner staff see only their own venue, and our own staff access production data only for support or engineering with a recorded reason. Sign-in is by one-time code to your phone, so there is no password to leak. Our admin systems sit behind identity-based access controls with an allowlist. We review access quarterly and test the platform for vulnerabilities before major releases.
If a breach affects your personal data, we will notify the Saudi Data and Artificial Intelligence Authority (SDAIA) within the time the PDPL requires and tell you directly if the breach is likely to cause you harm, with what happened and what we are doing about it.
13. Your rights
Under the PDPL you can:
- Access the personal data we hold about you and get a copy in a usable format. In the app: Settings → Your data → Export.
- Correct anything inaccurate. Most profile fields are editable in the app.
- Delete your account and data, subject to the records we must keep by law. In the app: Settings → Delete account.
- Withdraw consent for location, marketing or federation sharing at any time, in Settings.
- Object to processing based on our legitimate interests.
- Complain to us at support@jawla.ai, and if unresolved, to the competent authority under the PDPL.
We respond to requests within 30 days and never charge for them. We will verify your identity by sending a code to your registered phone before acting on a request.
14. Cookies and analytics
The jawla.ai website uses only strictly necessary cookies (session and language preference) and a privacy-respecting analytics tool that does not use cookies, does not track you across sites and does not build a profile of you. There is no consent banner because there is nothing to consent to. The partner portal uses a session cookie to keep you signed in. The mobile app uses no advertising SDKs and does not request the advertising identifier.
15. Where data is stored
Jawla's production data is hosted in data centres located in the Kingdom of Saudi Arabia. Some processors (crash reporting, analytics) may process limited technical data outside the Kingdom; where this happens we ensure the transfer meets the PDPL's requirements, including contractual safeguards and, where required, approval from the competent authority. Personal data of players is not transferred outside the Kingdom for any other purpose.
16. Changes to this policy
If we change this policy in a way that matters, we will tell you in the app and by SMS or email before the change takes effect, and give you the chance to close your account if you disagree. The effective date at the top always tells you which version you are reading. Previous versions are available on request.
17. Contact
Questions, requests or complaints about your data: support@jawla.ai, or in the app under Help. Post: Jawlah Go Company, Riyadh, Kingdom of Saudi Arabia.