A privacy policy for a Saudi app should explain clearly, in Arabic: who you are and how to contact you, what data you collect and how, for what purposes, who you share it with, where it is stored and whether it leaves the Kingdom, how long you keep it, how you protect it, and what rights customers have and how to use them. It must be visible before data is collected, match what your app actually does, and align with the Personal Data Protection Law overseen by SDAIA.
- how to write a privacy policy for an app
- privacy policy template saudi arabia online store
- saudi pdpl privacy policy requirements
- is a privacy policy mandatory for an online store in saudi arabia
- what should a privacy policy include
What is a privacy policy, and why does your Saudi app need one?
A privacy policy is a page that tells customers clearly what data you collect, why, who you share it with and how they can exercise their rights. To write a privacy policy for a Saudi app, start from a map of the data you actually handle, then cover the elements required by the Personal Data Protection Law (PDPL), which is overseen by SDAIA and has been enforceable since 14 September 2024, and write it in Arabic a normal customer can understand.
The policy is not only a legal box to tick. It is also a practical requirement: Apple and Google require a privacy policy link for apps, payment gateways and business partners ask about it when you sign up.
The most common mistake: copying a foreign policy that cites other laws and services. The policy must describe what your app actually does; if you say you never share data and then send it to an analytics tool, both the text and your compliance have a problem. So start with the Saudi PDPL checklist for apps before you write.
What should a privacy policy include?
These are the sections most apps and stores in Saudi Arabia need.
| Section | What it answers | Short example |
|---|---|---|
| Who we are | Who is responsible for the data and how to reach them? | Business name, commercial register or freelance document number, email, phone |
| Data we collect | Which data exactly? | Name, phone, National Address, order history |
| How we collect it | How does it reach us? | Directly from you at sign-up, automatically during use |
| Purposes | Why do we use it? | Fulfilling orders, delivery, invoices, support, marketing with your consent |
| Sharing | Who do we share it with? | Payment gateway, carrier, messaging provider |
| Storage and transfers | Where is it stored? Does it leave the Kingdom? | Servers in the region, plus any transfer abroad and its safeguards |
| Retention | How long do we keep it? | For the life of the account, then the legal period for invoices |
| Protection | How do we protect it? | Encryption, permissions, backups |
| Your rights | What are you entitled to and how do you ask? | Be informed, access, correction, destruction, withdraw consent |
| Updates | How do we tell you about changes? | Last-updated date and an in-app notice |
Steps to write the policy from scratch
- 1Map the data
List every field in the app and every connected tool: payments, shipping, messaging, analytics, ads.
- 2Assign a purpose to each item
Link each data item to a clear reason. If there is no reason, remove it from the app before you write about it.
- 3List who receives data
Name the categories of recipients (or the recipients), what each receives, and where it is processed if outside the Kingdom.
- 4Draft in Arabic
Use the structure from the table above, clear headings and short sentences, then prepare an English version if your audience needs it.
- 5Match the text to the app
Open the app and check every sentence: does that field exist? Does the button you mention really exist?
- 6Review with a professional
Especially if you handle health, financial or children's data, or transfer data outside the Kingdom.
- 7Publish with a date
A visible link at sign-up, checkout and in the menu, with a last-updated date and version number.
A good privacy policy is an honest description of your app, not a document to protect you from your customers.
A privacy policy structure for a Saudi store or app
This is a structure to build on, not final text to copy. Replace the brackets with your app's reality and delete what does not apply.
- Introduction: We are [business name] and we respect your privacy. This policy explains how we handle your data when you use [app name]. Last updated: [date].
- Data we collect: a short list of what you provide and what is collected automatically, such as device type.
- Why we collect it: one line per purpose, stating that marketing messages require your consent and can be stopped.
- Who we share it with: the payment gateway to complete payment, the carrier for delivery, and we do not sell your data.
- Where we store it: hosting location, and any transfer outside the Kingdom and why.
- How long we keep it: periods per data type, and what happens after.
- How we protect it: the key measures in plain language.
- Your rights and how to use them: from the My data page or via [email/phone], and the expected response time.
- Contact and complaints: how to reach us, and that you may file a complaint with the competent authority.
- Changes to this policy: how we notify you of material changes.
Make the policy a standalone page with a stable link, not a pop-up. Keep it separate from your terms and from your return and refund policy.
App Store and Google Play requirements
If you have a mobile app, a privacy policy is not optional in practice. Both the App Store and Google Play require a publicly accessible privacy policy link and ask you to fill in a form describing the data your app collects and how it is used. A mismatch between that form, your policy and the app's real behavior is a common cause of rejection or review delays.
- A policy link that is broken or opens a blank page
- The app requests location or camera with no explanation in the policy
- The store privacy form says no data collected while the app has a login
- No way to delete the account from inside the app
- A stable link that works in the app and on the store listing
- A clear explanation for every permission the app requests
- Store form, policy and app behavior all match
- A visible delete-account option in settings
For more on publishing and review, read our guide to publishing on the App Store and Google Play.
Common privacy policy mistakes in Saudi apps
- A copied foreign template that cites laws that do not apply to you and ignores the Saudi law.
- English only while your audience speaks Arabic; Arabic first is the norm in the Saudi market.
- Promises you do not keep, like we never share your data with anyone, while you use a carrier and a payment gateway.
- Vague phrases like we may use your data for other purposes, with nothing specific.
- No date or version, so nobody knows what the customer agreed to.
- Rights with no path: you mention deletion but there is no button or email that gets answered.
- Forgetting small tools like a chat widget or ad pixel that also sends data.
How to build the privacy page and rights tools with Fanann
In Fanann you describe what you want in Arabic or English, and the agent builds the pages, database and permissions. It can draft a policy from the app it built, but that draft is a starting point for you and a professional to review, not final legal text.
In my store app (perfume and incense, Saudi Arabia, Arabic first with an English version): 1) Create a Privacy policy page with a stable link, shown in the footer, on the sign-up screen and at checkout, displaying the last-updated date and version number. 2) Draft the policy from the data the app actually uses: name, phone, National Address, order history. State that payment goes through a payment gateway (mada, Apple Pay, Tabby, Tamara) and we never store card details, that shipping goes through a delivery company, and that hosting is in the region. Mark any sentence that needs my confirmation with [review]. 3) Add a My data page to view and edit details, and a Request account deletion button that creates a request in the admin panel. 4) A separate, unticked consent checkbox for WhatsApp offers; store the consent date and the policy version the customer accepted. 5) When the policy is updated, show customers a notice on their next login.
Try it in FanannThen review every sentence marked [review], and make sure the other Saudi e-commerce law requirements are visible in your store, such as merchant identity and cancellation terms. See how we handle security in our Trust center.
Key takeaways
- Write the policy from your actual app after a data map, not from a copied foreign template.
- Core sections: who you are, data, purposes, sharing, transfers, retention, protection, rights, contact and updates.
- Arabic first, visible at sign-up and checkout, with a version and date.
- Apple and Google require a privacy policy link, and your store privacy answers must match it.
- This is a general guide, not legal advice; check SDAIA guidance and a legal professional.
Frequently asked questions
Is a privacy policy mandatory for an online store in Saudi Arabia?
Can I copy a privacy policy from another website?
Does the privacy policy have to be in Arabic?
How often should I update my privacy policy?
Can Fanann write the privacy policy for my app?
Ask your AI assistant about this
Copy this prompt into the AI assistant you use, then add the details of your own case.
I am reading this guide: “How to write a privacy policy for a Saudi app (what to include)” https://fanann.com/en/blog/privacy-policy-saudi-app/ My question: how to write a privacy policy for an app Use that page as a source and explain the answer step by step for my situation, tell me what to check before I start, and cite the page link.