Privacy Policy
Last updated: October 12, 2026
Here's what data we collect, how we use it, and who can access it — in the simplest terms possible.
1. Who controls your data
The data controller is Mhalli, CR 7055088194, Saudi Arabia. For privacy and rights requests, contact support@mhalli.co.
2. What we collect and where it comes from
Directly from organizers: name, phone number for sign-in, event details and content. From organizers about guests: name, phone and email if supplied. From guests: RSVP, companion count and names, their message and answers. We keep limited technical and security logs to operate and protect the service. We never store card numbers or security codes.
3. Purposes and legal bases
We process data to create and send invitations, record replies, manage entry, provide support, collect payment and protect the service. The basis is the requested service, the organizer’s instructions as controller of guest data, consent where required, and a documented legitimate interest for service security. We do not sell data or use it for advertising.
4. Required and optional data
Sign-in details, event name and date, and recipient details needed for delivery are required; without them, the account or invitation cannot be provided. A guest reply, message and questions marked optional are voluntary. Required questions are clearly identified before submission.
5. Who receives data
Only the organizer and authorized team members can see an event’s data, with database-level isolation. Operational providers receive only what they need: our hosting and database provider to store data and files and run sign-in; Meta/WhatsApp for delivery and replies; our email provider for email; the SMS provider for login codes and text-message invitations; the payment gateway licensed by the Saudi Central Bank to process payment, without our storing your card details; and our error-monitoring provider for technical errors, with personal data minimized.
6. Retention and deletion
48 hours after an event ends, guest names, phone numbers, emails, messages and written answers are deleted; only non-identifying attendance counts and statistics remain. Entry cards are deleted after seven days and backups after at most 14 days. Account and event data remains until deletion or a valid erasure request, unless financial or legal records must be retained by law.
7. Security and breaches
We use encrypted connections, provider encryption at rest, row-level isolation, least privilege, server-only secrets and private backups. If an incident may cause harm, we assess and document it, notify SDAIA within 72 hours when the reporting threshold is met, and notify affected people without undue delay when harm is likely.
8. Transfers outside Saudi Arabia
Some providers may process data outside Saudi Arabia. We transfer only what is necessary, review processing locations, safeguards and transfer risks, and use the appropriate lawful safeguards while preserving your rights.
9. Your rights and requests
You may know the basis and purpose of processing, access your data and obtain a clear copy, correct or complete it, request destruction, and withdraw consent where consent is the basis. Email support@mhalli.co; we may verify identity and respond within 30 days, extendable by 30 more days with advance notice and reasons.
10. Updates and contact
Effective 12 October 2026. The current version is published here and we will give notice of material changes where required. For questions, complaints or privacy requests: support@mhalli.co.
Registration and contact
- Trade name
- Mhalli
- CR
- 7055088194
- Address
- Kingdom of Saudi Arabia
- support@mhalli.co
- +966 57 988 4410
We reply within two business days.