Privacy Policy

1Who we are and scope

The Sknak platform is owned and operated by Cellix Technical Solutions in the Kingdom of Saudi Arabia. This policy explains how we collect, use, and protect your personal data when you use the website, the apps, and the platform portal, in compliance with the Saudi Personal Data Protection Law (PDPL) and its implementing regulations.

2Data we collect

We collect the minimum needed to operate owners' association services:

• Account data: name, email, mobile number, unit number, and platform role (chairman, owner, or vendor).
• Complex data: complex name and type, unit count, association registration number, budget and payment records, contracts and vendors.
• Usage content: maintenance tickets and their comments, announcements, votes, utility bills, and uploaded documents and photos.
• Technical data: device identifier, notification token (FCM), browser type, and sign-in and usage logs.
• Payment data is processed by a licensed local payment gateway; we never see or store your card details on our systems.

3Purposes of processing

We process data only for the following purposes:

• Operating the association's daily services: tickets, collection, contracts, preventive maintenance, and voting.
• Sending service-related notifications and alerts (emergencies, announcements, dues).
• Managing subscriptions, billing, and issuing financial documents.
• Improving the platform, measuring performance, preventing abuse, and protecting security.
• Complying with Saudi regulations and responding to binding legal requests.

4Legal basis for processing

We rely on the performance of the contract with the association or the user, explicit consent where required, our legitimate interest in operating and securing the platform, or legal obligation — as determined by the Personal Data Protection Law.

5Data sharing and processors

We do not sell or trade your personal data. We share it only with:

• Google Firebase (authentication, database, storage, notifications) acting as a data processor under the Data Processing Agreement (DPA) with Google and its contractual commitments.
• The licensed local payment gateway that processes subscription payments.
• Members of your complex according to role and permission: for example, the chairman can view owner names, unit numbers, and payment status for operational purposes.
• Government or judicial authorities where there is a binding legal request.

6Storage and data transfers

Platform data is hosted on Google Cloud infrastructure and may be stored or processed in data centers outside the Kingdom. We apply the data-transfer controls of the Personal Data Protection Law, with appropriate contractual and technical safeguards including encryption in transit and at rest.

7Retention period

We keep data for as long as the account or complex is active. When an account is closed or the contractual relationship ends, we delete or anonymize personal data within ninety (90) days, unless the law requires longer retention (such as financial records and audit logs).

8Your rights under the law

As a data subject, you have the following rights:

• To be informed of how your data is collected and processed.
• To request a copy of your personal data in a readable format.
• To request correction or completion of inaccurate data.
• To request deletion (destruction) of your data when the purpose of processing no longer applies.
• To withdraw consent for consent-based processing at any time.
• To lodge a complaint with the competent authority (the Saudi Data & AI Authority — SDAIA) if you believe our processing violates the law.

9In-app account deletion

You can request account deletion directly inside the platform via the "Delete account" page or from the app settings. After identity verification the account is deactivated immediately, and your personal data is deleted or anonymized within the retention period above, except for records the law requires us to keep.

10Information security

We apply transport encryption (TLS), fine-grained role permissions, full isolation of each complex's data, hardened database-level access rules, an audit log for sensitive operations, and periodic security reviews.

11Cookies and local storage

We use local storage and strictly necessary cookies only to manage your sign-in session and language preference. We do not use advertising trackers and we do not share your data with ad networks.

12Minors' privacy

The platform is intended for adult members of owners' associations and vendors; we do not knowingly collect data from anyone under eighteen.

13Changes to this policy

We may update this policy from time to time. We will publish the updated version on this page with a revised "last updated" date, and we will notify you inside the platform of any material change.

14Contact and exercising your rights

To ask a question or exercise any of your rights, contact us at privacy@osusplus.app or via the contact page. We respond to requests within the statutory timeframes.