Version 1.0 — effective from 5 November 2026
This Policy has three parts. Part one (sections 1 to 20) is the Privacy Policy. Part two (sections 21 to 30) is the Marketing and Communications Consent. Part three (sections 31 to 47) is the Data Retention and Deletion Schedule. It applies to customers and photographers alike. It was written in Arabic and translated into English; where the two texts differ, the Arabic text prevails.
Part one: Privacy Policy
This policy explains how Sworah collects, uses, keeps and protects your personal data, whether you are a customer booking a photo session, a photographer offering services through the platform, a person who appears in a picture taken at a session booked through it, or a visitor to our website. We wrote it in plain words because you have the right to understand it without an intermediary; if anything is still unclear, write to us at the address in section 1.
1. Who we are and how to reach us
1.1 The controller of your personal data is the company operating Sworah, trading as "Sworah" through the customer app, the photographer app and the website. Its registration and contact details:
Phone: 920000000
WhatsApp: +966500000000
1.2 For anything concerning your personal data write to us through «Contact us» in the app or the details above, with the subject "Data protection".
1.3 Our personal data protection officer is reached through the same channels with the subject "Data protection".
1.5 In this policy we call the company "Sworah", "the platform" or "we"; we address you as "you" whatever your role, and say "the customer" or "the photographer" where a clause concerns one side only.
2. Who this policy applies to
2.1 Customers: anyone who creates an account in the customer app or books a photo session.
2.2 Photographers: the individuals and studios who offer their services through the photographer app, including those who work as employees of a registered establishment through its account.
2.3 People who appear in pictures: guests, family members, children, venue staff and others photographed in a session booked through the platform, or whose pictures appear in a photographer's portfolio or in a booking conversation, even though they have no account with us (section 5).
2.4 Visitors to the website and anyone who writes to us through its contact form.
2.5 Accounts moved from the old system: in September 2026 we moved accounts, bookings and conversations from the previous Sworah system into this one. If your account is one of them, this policy was not shown to you when you first registered; it is available to you in the app and on the website at all times, and you may ask for your account to be deleted at any time as set out in section 11.
2.6 Sworah staff who use the admin console are covered by a separate internal policy.
3. What we collect from you as a customer
3.1 Mandatory for creating the account: your Saudi mobile number (your account identifier and the way you sign in, with a one-time code), your name, your date of birth and your nationality. Without any of these the account cannot be created.
3.2 We ask for your date of birth to check that you have reached the age of majority (section 15); we show it to no photographer.
3.3 Nationality is a mandatory field by Sworah's decision; we use it to verify identity and eligibility and to document the booking. We do not use it to prefer one customer over another or to infer ethnic origin, and we show it to no photographer.
3.4 Optional: your e-mail address (for receipts and messages if you choose), a profile picture, your gender and your preferred language. Leaving them out does not stop you using the platform.
3.5 Booking data: the service and sub-services, the date and time, the session address and its position on the map, your notes, the offers you received from photographers and your acceptance, the booking's status history, cancellations and their reasons, and complaints and their decisions.
3.6 Your approximate location: when you use the "photographers near me" feature we take your device's position with your permission and store it rounded to about one kilometre, replacing it on each new use; we do not track your position in the background. The session address you enter in a booking is stored as you entered it, because it is part of the contract.
3.7 Your conversation with the photographer: the messages, pictures and system markers exchanged inside a specific booking (section 7.10 on screening).
3.8 The picture delivery link: Sworah does not store the pictures and files the photographer delivers to you. The photographer delivers them through a gallery link posted on the booking (https only, from a gallery service on the list Sworah approves, editable for 60 minutes after delivery, then locked once you have reviewed it). We keep the link and the time it was posted as the record of delivery. The pictures themselves stay on the photographer's gallery service under that service's own terms, privacy policy and retention periods; when you open the link your device connects to that service directly and we send it nothing, so download your pictures from there.
3.9 Payment data: the payment method, the transaction reference at the payment gateway, the amounts, VAT and status, and your wallet ledger. Your card number never reaches our servers; the licensed payment gateway alone processes it.
3.10 The ratings and comments you give photographers, and the ratings and comments a photographer writes about you after a booking (section 7.12).
3.11 Your device data: the push notification token, the device type and app version, and the IP address in the server logs.
3.12 The trace of your consent: the time you accepted the terms and this policy and their versions, and your choice about marketing messages and its time.
4. What we collect from you as a photographer
4.1 Everything in section 3 applies to you, with the following additions.
4.2 Your public profile data: your bio, the equipment you pick from Sworah's catalogue, your portfolio pictures, your services and prices, your availability and your service area. Customers see this data before booking; Sworah may hide bios platform-wide by its own decision.
4.3 Verification data before you are approved: your identity document, your freelance document or commercial register, your qualification certificate, and the licences required for particular kinds of work (such as drones and shoots in public places). We check your details against the documents and record the result of the check and its date; the documents are seen by our team only, are never shown to any customer, and are erased with your account (section 10).
4.4 Nationality is mandatory for a photographer because the Labour Law reserves self-employed work to Saudi nationals, and the platform accepts a non-Saudi only as the employee of a licensed establishment through that establishment's account; without a nationality the registration request is not accepted.
4.5 Your bank details: IBAN, bank name and account holder name; the account must be in your own name or your establishment's. We use them only to pay your earnings by bank transfer.
4.6 Your studio, if you have one: its name, address, district, city and map position. A customer sees the studio address only after booking a studio-type service, once the booking is confirmed.
4.7 Your verification status and history, your reliability record (withdrawals, lateness, cancellations), the ratings and comments customers give you (published on your profile, with the average held back until enough ratings exist), and the ratings and comments you write about customers after a booking.
4.8 Your tax status: whether you are registered for VAT and your registration number if you have one, because it decides who issues the invoice.
5. Data of people who appear in pictures
5.1 A picture of an identifiable person is that person's personal data, even if they have no account with us. The pictures Sworah stores are: photographers' portfolio pictures, profile pictures, photographers' documents and the pictures sent inside a booking conversation; we use them for nothing but the purpose they were uploaded for. The pictures a photographer delivers to a customer are not stored with us but on the photographer's gallery service (section 3.8), and we keep only the link.
5.2 We do not analyse faces, build biometric templates or use any technology to recognise people in pictures, and we do not train models on customers' pictures.
5.3 Obtaining the permission of the people who appear in a picture, and of a child's guardian, is the responsibility of the customer who requests the session and the photographer who performs it, as detailed in the Content and Image Rights Policy. Women-only occasions are private by default and their pictures never appear in a portfolio.
5.4 If you or your child appear in a picture shown on the platform (in a portfolio or a conversation) without your permission, write to us under section 1 or report the conversation in the app; we stop showing the picture within 5 working days of receiving a complete report and tell you the outcome. If the picture is in a delivery gallery on the photographer's service, we require the photographer to remove it under the photographer's agreement with us, remove the link from the booking, and point you to that service's complaint channel.
6. What is collected automatically
6.1 In the apps: your device's push token, the device type, operating system and app version, and the IP address and time of each request in the security logs of the server. We use no behavioural analytics or advertising tool in the apps today (section 17).
6.2 On the website: we store nothing in your browser but your language choice, and there are no analytics or advertising tools (section 18). If you write to us through the contact form we store your name, the contact details you entered and your message in order to answer it.
7. Why we process your data and the lawful basis for each purpose
7.1 Creating your account, signing you in and sending sign-in codes: performance of the contract between you and Sworah.
7.2 Showing you suitable photographers and ranking them by approximate distance, availability and rating: performance of the contract.
7.3 Concluding the booking, performing it, the communication within it and recording the picture delivery link: performance of the contract.
7.4 Charging the booking price, refunding it, recording wallet credits and paying the photographer's earnings: performance of the contract, and the legal obligation to keep financial records.
7.5 Keeping the records of payments, refunds and payouts, and issuing invoices once our VAT registration is in force: a legal obligation under the VAT, commercial-records and e-commerce laws.
7.6 Sending service messages (booking confirmation, reminders, delivery, refunds, security alerts, legal notices and the rating prompt after delivery): performance of the contract. These are not marketing messages and the marketing choice does not apply to them, but you can switch off the non-essential ones in your notification settings.
7.7 Verifying a photographer's identity, eligibility, licences and tax status before approval and periodically afterwards: the legal obligation that comes with the duties of an intermediary platform and the Labour Law, and our legitimate interest in protecting customers from unqualified providers.
7.8 Protecting the platform: limits on sign-in code attempts, sign-in and security logs, detection of duplicate accounts and fraud, and screening of automated requests: our legitimate interest in network and information security and the prevention of fraud.
7.9 Keeping the list of banned numbers and checking it at every registration: our legitimate interest in preventing someone banned for abuse or fraud from returning with a new account; the reason for a ban is recorded as one of our policy categories, never as a criminal allegation.
7.10 Automatically screening the conversation for direct contact details or attempts to pay outside the platform, blocking or flagging them, and a trained staff member reading a conversation when a complaint is opened or the filter flags it: our legitimate interest in users' safety and in completing the booking on the platform that protects both sides; nobody reads your conversation outside these two cases.
7.11 Handling complaints and disputes and deciding between the parties on the evidence (the conversation, the pictures, the booking records): performance of the contract, and our legitimate interest in settling disputes.
7.12 Ratings in both directions: after a booking is delivered or completed the customer rates the photographer (a rating published on the photographer's profile, with the average held back until enough ratings exist), and the photographer may rate the customer (a non-public rating that you see in the app under the display and timing rules stated there, and that Sworah uses in the reliability record and when handling complaints). Basis: performance of the contract both parties accept, and our legitimate interest in both sides' trust and in an honest reliability record. Comments pass the contact-details and bad-language filters, and are removed when they breach the content policy or when an objection to them is upheld (section 11.1).
7.13 Sending offers and news: your consent alone, given through a separate choice and withdrawable at any time (section 13).
7.14 Answering requests from the competent authorities and courts and carrying out their decisions: a legal obligation.
7.15 Improving the service: we use aggregated statistics that do not identify you; we involve no external analytics tool today.
7.16 We do not process your data for a purpose incompatible with the one it was collected for. If we need a new purpose we tell you before we start, and ask for your consent where the law requires it.
8. Who receives your data
8.1 The photographer you book sees your name, your profile picture, the booking details, the session address, your notes and the booking conversation; the photographer does not see your mobile number, your date of birth, your nationality or your financial data, because communication runs through the booking conversation. Under the photographer's agreement with us, the photographer may use your data only to perform the booking and must delete it afterwards. The rating a photographer writes about you is not published and no other photographer sees it; you see it in the app under the display rules, and Sworah alone uses it.
8.2 Before booking, the customer sees only the photographer's public profile (name, picture, bio, equipment, portfolio, services and prices, ratings, and the distance in whole kilometres), and never the photographer's position, contact details, documents or bank details; the studio address appears to the customer for studio services only, after the booking is confirmed.
8.3 Server and file hosting provider: hosts the platform's server and the uploaded files (pictures, documents and logs) in the United States of America, as a processor acting for us.
8.4 Database provider: hosts the database in Germany, as a processor acting for us.
8.5 Push notification services: we send your device token and the notification text to a push service operating from the United States, and from there to Apple's or Google's notification service depending on your device.
8.6 SMS provider: a messaging provider licensed in the Kingdom or an international provider, which receives your mobile number and the message text in order to send sign-in codes and service messages, and marketing messages if you have agreed to them.
8.7 Instant messaging and e-mail services, where used: a provider that receives your mobile number or e-mail address and the message text in order to deliver it.
8.8 Payment service provider: when card payments are enabled, a payment service provider licensed by the Saudi Central Bank, named on the payment screen, processes your card data on its own systems; we receive from it only the transaction reference, the amount and the status.
8.9 Map services: your device connects directly to the map service to display map tiles, and we send it none of your data; to name the district and city we send only a coordinate, with nothing that identifies you, to an open-source place-naming service (section 17).
8.10 The team's alert channel: the operations team receives automatic alerts (a late session, an error, a security event) through a messaging service outside the Kingdom; an alert carries only what the team needs to act (a booking or account identifier and, where needed, a name or number) and reaches the Sworah team only.
8.11 Uptime monitoring: an external service checks that the website and server are reachable and receives no personal data.
8.12 App stores and the update service: Apple, Google and the app update service receive no personal data from us.
8.13 Competent authorities: we disclose your data to the Public Prosecution, the courts or the regulators on a lawful request and within its limits, and we document every request.
8.14 Our professional advisers (accountant, lawyer) when needed and under a duty of confidentiality; and whoever takes over the business if it is sold or merged, with prior notice to you.
8.15 We do not sell or rent your personal data or share it with advertisers, and we give your contact details to no photographer or other party for their marketing.
8.16 We contract with every processor under a written agreement that binds it to process only for us and on our instructions, to notify us without delay of any security incident, and to delete the data when the contract ends.
9. Transfers of your data outside the Kingdom
9.1 Your data is stored outside the Kingdom today: the database in Germany, the server and the uploaded files in the United States of America, and the notification data passes through the United States (section 8).
9.2 We make these transfers to provide the service to you and to run the platform centrally, we limit them to the minimum the service needs, and we store no sensitive data, in the meaning of the Personal Data Protection Law, outside the Kingdom.
9.3 Every recipient outside the Kingdom is bound by written contractual commitments requiring a level of protection no lower than Saudi law requires (the standard contractual clauses issued by SDAIA or their equivalent), and we carry out a written risk assessment before each transfer.
9.4 You may ask for a copy of these contractual commitments under section 1; we send it to you with commercially confidential information redacted.
9.5 Sworah plans to move the database and the files to a data centre inside the Kingdom; when the move is complete we update this section, so that nothing remains outside the Kingdom but what the notification services and the team's alerts need and what we expressly list here.
9.6 This section applies to customers' conversations with photographers, portfolio pictures, photographers' documents and delivery links alike; we add no new recipient outside the Kingdom before listing it here.
10. How long we keep your data
10.1 The rule: we keep data while your account exists and while the purpose remains or the law requires a period, and then delete or anonymise it. The full detail for each category is in the Data Retention and Deletion Schedule, which forms part of this policy; the headlines follow.
10.2 Account and profile data and the profile picture: for the life of the account, erased 30 days after its deletion.
10.3 The mobile number and the ban record (reason and date): kept after the account is erased, to prevent re-registration with the same number and to keep the ban in force, for as long as the ban stands and at most 5 years from the ban's date; the list is reviewed every 12 months and a ban no longer justified is lifted; the number is used for nothing else.
10.4 Bookings, payments, invoices, credit notes, payout statements and the wallet ledger: 10 years from the end of the financial year, as commercial and tax records, attributed to an anonymous identifier once the account is erased.
10.5 The record of your acceptance of the terms and policies, their versions and the trace of your consents: at least 3 years after the relationship ends and for the limitation period.
10.6 Booking conversations: kept with the booking record for the same period as the booking, because they are its evidence in complaints, then deleted with it.
10.7 Pictures: the delivery link remains with the booking record (section 10.4). The delivered pictures themselves are not on our servers but on the photographer's gallery service under its own retention periods, so download them from there at delivery. Portfolio pictures: for as long as the photographer shows them or until the consent to them is withdrawn. Conversation pictures: with the conversation (section 10.6). Profile picture: section 10.2. Photographer's documents: section 10.8.
10.8 Verification documents: kept for the life of the account, seen by our team only, and erased with the account; the result of the check and its date remain with the booking records.
10.9 Approximate location: replaced on each use and deleted when the account is erased; the session address remains with the booking record.
10.10 Evidence of marketing consent and the record of its withdrawal: for as long as we message you, and for the limitation period after withdrawal, to prove that we stopped.
10.11 Sign-in codes: 10 minutes. Sessions, sign-in and security logs and the admin console activity log: 12 months. Web server access logs: 90 days.
10.12 Messages from the website contact form: 12 months after they are answered.
10.13 Encrypted backups: refreshed periodically; what has been deleted from the system is dropped from them in the following cycle, within 90 days at most.
10.14 The record of processing activities, the assessments and the incident register: 5 years after the processing ends.
10.15 Ratings and comments in both directions and the reliability record: for as long as the rated party's account exists, attributed to an anonymous identifier once the author's account is erased; a comment is deleted when an objection to it is upheld.
11. Your rights and how to exercise them
11.1 You have the right to know the basis and purpose of the processing of your data (which this policy provides), to access your data, to obtain a copy of it in a readable electronic format, to have it corrected, completed or updated, to ask for its deletion, to withdraw any consent you gave, to object to marketing messages at any time, and to object to a rating or comment written about you and ask for its human review within 10 working days.
11.2 How to ask: in the app you can correct your details from your account, switch offers and news off in Settings and delete your account from Account; for a copy of your data or anything else, write to us through «Contact us» or the details in section 1. We log every request, including oral ones.
11.3 Verifying your identity: we carry out a request after confirming it comes from you, usually with a code to your registered mobile number; we may ask for one more piece of information if the request comes from outside the app, and we delete what we asked for once the check is done.
11.4 Timing: we answer within 30 days of receiving the request. If the request needs unusual effort or you have made several requests, we may extend the period once by a further 30 days, and we tell you about the extension and its reason before the first period ends.
11.5 What we cannot do: we refuse a request that is repetitive or manifestly unfounded, and we do not disclose another person's data in your copy (such as the other party's messages in a conversation). With every refusal we state the reason and how to complain.
11.6 Deleting your account: on your request we hide your account at once so that nobody sees it, and we erase your personal data and files 30 days later, a period that lets you change your mind and lets us complete any booking or refund in progress. An account with an unfinished booking or an unsettled amount is deleted only once it is completed.
11.7 What remains after deletion and why: your mobile number and the ban record if you were banned (section 10.3), the financial record of bookings and invoices attributed to an anonymous identifier because the law requires it to be kept (section 10.4), and anything relating to a pending dispute. The deletion confirmation message tells you what remained and why.
11.8 Withdrawing consent does not affect the lawfulness of processing done before it, and does not stop processing that rests on another basis; withdrawing is as easy as giving it was.
11.9 You may claim compensation before the competent court for material or moral damage caused by a breach of the Personal Data Protection Law.
12. Complaints
12.1 If you believe we processed your data contrary to this policy or the law, write to the data protection officer under section 1; we acknowledge your complaint within 3 working days and answer it within 30 days.
12.2 You may in any event complain to the Saudi Data and Artificial Intelligence Authority (SDAIA) through the National Data Governance Platform, within 90 days of becoming aware of the incident, whether or not you have written to us first.
12.3 Complaints about a booking or a photographer's service go through the Complaints and Dispute Resolution Policy; complaints about unwanted messages may also be raised with the Communications, Space and Technology Commission.
13. Marketing messages
13.1 We send you offers and news only if you switch on the "Offers and news" choice yourself; it is off by default, separate from accepting the terms, and not a condition of the service.
13.2 One choice, «Offers and news», covers every channel we may use (push notifications, text messages, e-mail and messaging apps); switching it off stops them all.
13.3 You withdraw your consent in Settings or through the unsubscribe link in every marketing message; we stop within 24 hours at most, free of charge.
13.4 Marketing text messages, when we send them, come from a sender name registered to Sworah, so that you can tell them from service messages, and we do not send them between 10 pm and 8 am.
13.5 For every consent and withdrawal we record the time and the choice, to prove that we messaged you with your permission and stopped when you asked.
13.6 We send no marketing messages on anyone else's behalf, give your data to nobody to message you, and put no marketing content inside service messages. The detail is in the Marketing and Communications Consent policy.
14. Automated processing and decisions
14.1 The platform automatically selects the photographers shown to you and their order, based on the requested service, approximate distance, availability, rating and reliability record; nothing about your nationality, gender or age affects the ranking.
14.2 At every registration the mobile number is checked automatically against the list of banned numbers, and registration is refused if the number is under a ban in force.
14.3 An automatic filter screens conversation messages for direct contact details and attempts to pay outside the platform, and may block a message or flag it for human review.
14.4 Automatic controls limit sign-in attempts and code requests, detect duplicate accounts and signs of fraud, and may suspend an account temporarily.
14.5 We take no decision affecting your rights (such as a permanent ban, a refused verification or the decision of a dispute) by automated means alone; a trained staff member reviews it. If an automated step affects you (a blocked message, a temporary suspension, a refused registration), you may ask for human review under section 1, and we answer within 10 working days.
14.6 We use no face recognition and no biometric identification of people.
15. Children
15.1 The platform is for people aged 18 or over; we accept no account for anyone younger, and a guardian books for a child in the guardian's own name. If we learn of a child's account we close it and erase its data.
15.2 Pictures of children in a session or a portfolio are taken and shown only with the guardian's documented permission, and the guardian may ask for their removal at any time under section 5.4.
15.3 We report suspected abuse of a child to the competent authorities as the Child Protection Law requires.
16. How we protect your data
16.1 We encrypt the connection between your device and our servers, and we encrypt the backups and keep their key in a separate place.
16.2 Sign-in uses a one-time code with limits on attempts and sending, and we can end any sign-in session; admin staff sign in with defined permissions and their actions are logged.
16.3 Private files (documents and conversation pictures) open only through signed links that expire, and we test this automatically at every platform update; location and camera data are stripped from pictures uploaded to the platform; file types and sizes are limited. We accept a delivery link only over https and only from an approved gallery service.
16.4 We store no card numbers; old codes, sessions and logs are deleted automatically on schedule.
16.5 In this we follow recognised security practice and the controls issued by the National Cybersecurity Authority as they apply to us, and we review our measures periodically. No system is completely secure, which is why we say what we do and promise no more than that.
16.6 If an incident affects your data we notify SDAIA within 72 hours of becoming aware of it, and we notify you without delay if it could harm you, in clear language and with our advice on what to do.
17. Annex: third-party tools in the apps
17.1 Push notification and update service (Expo): receives your device token and the notification text to deliver it through Apple or Google, and delivers app updates without any personal data. Basis: performance of the contract. Provider: a United States company. Country: United States.
17.2 Google Maps: your device requests map tiles from Google directly to display session and studio locations, so Google receives your device's request data under its own policy; we send it nothing. Basis: performance of the contract. Country: outside the Kingdom.
17.3 Place naming (OpenStreetMap Nominatim): our server sends only a coordinate to learn the district and city name, with no identifier of yours. Basis: performance of the contract. Country: outside the Kingdom.
17.4 Payment service provider's SDK: once card payments are enabled, the provider named on the payment screen collects your card and device data on its own systems to complete the payment and prevent fraud under its own privacy policy. Basis: performance of the contract. Country: Kingdom of Saudi Arabia.
17.5 The apps contain no behavioural analytics, advertising or tracking tools, and no error-monitoring tool today; if we add an error-monitoring tool we list it here before enabling it and limit what reaches it to pseudonymous identifiers.
18. Annex: cookies on the website
18.1 The website stores in your browser only your language choice (Arabic or English), which is necessary to show the pages in your language and needs no consent.
18.2 The website uses no analytics, advertising or tracking cookies and no third-party tools.
18.3 If we add an analytics tool in future it will run only after your consent through a choice bar you can change at any time, and we will update this annex first.
18.4 The unsubscribe page for marketing messages shows nothing about you.
19. Changes to this policy
19.1 We may update this policy when our services, recipients or the law change; every version carries its number and effective date.
19.2 A material change (a new purpose, a new recipient outside the Kingdom, a change to retention periods or to your rights) is announced in the app and on the website one week before it takes effect; the version in force is always the one published there.
19.3 Earlier versions are available on request under section 1.
20. Language and version
20.1 This policy is issued in Arabic and English; the Arabic text prevails in case of any difference.
20.2 This policy is read together with the Terms of Use, the Photographer Agreement, the Data Retention and Deletion Schedule, the Marketing and Communications Consent policy, the Content and Image Rights Policy and the Complaints and Dispute Resolution Policy.
20.3 Version 1.0 — effective from 5 November 2026
Part two: Marketing and Communications Consent
This part explains when Sworah sends you offers and news, how you agree to that and how you withdraw, and which messages reach you in any case because they are part of the service. It complements the Privacy Policy (Part one of this Policy) and does not replace it.
21. A separate, unticked choice
21.1 Sworah sends you offers or news only if you chose that yourself by switching on «Offers and news»; the choice is separate from accepting the terms and the privacy policy, and it is off when the account is created.
21.2 Declining offers does not affect your account or any service you book.
21.3 The messages are limited to Sworah’s own offers, services and news; Sworah does not market anyone else through your contact details and does not hand them to anyone to market with.
21.4 The channels that may be used for offers are app notifications, text messages, e-mail and messaging apps; your one choice covers all of them.
21.5 No sensitive data, and no data not collected from you directly, is used for offers.
22. What Sworah keeps as evidence of your consent
22.1 On every consent and every withdrawal Sworah records its time and the choice, with your account identifier.
22.2 This record is kept for as long as your account exists and is erased with it, under the Data Retention and Deletion Schedule (Part three of this Policy).
23. How to withdraw
23.1 You can stop offers at any time from within the app: Account, then Settings, then «Offers and news».
23.2 At the foot of every marketing message there is a link that stops offers with one press and no sign-in, and its page shows nothing about you.
23.4 Withdrawal takes effect as soon as it is recorded, after which no marketing message reaches you, and in every case within 24 hours at most.
23.5 Withdrawal is free and needs no reason, and it does not affect the lawfulness of what was sent before it.
23.6 If you delete your account, offers stop with it.
24. Sender identity
24.1 Marketing text messages, when Sworah sends them, come from a sender name registered to Sworah and marked as advertising as the regulator requires.
24.2 Service messages (section 26) come from a different sender name reserved for them, and carry no promotional content.
24.3 Every marketing e-mail names Sworah and gives its contact details as on the About page.
25. Sending hours and content
25.1 No marketing message is sent between 10 pm and 8 am Riyadh time, and Sworah observes any further limits the Communications, Space and Technology Commission sets, including in Ramadan.
25.2 Every marketing message is truthful, identifies itself as advertising, and names the advertised service and Sworah as the advertiser.
25.3 A promotional price is stated with its end date and its conditions, and what is advertised binds Sworah.
25.4 Marketing messages do not exceed one a week on any channel.
25.5 Flash messages and personal numbers are not used for marketing.
26. Service messages that are not marketing
26.1 These reach you in any case, because the booking does not work without them: confirmation of the request, the acceptance and the payment; changes in the booking's status; the appointment reminder; delivery of the pictures; refund notices; sign-in codes; legal notices such as a change of terms or a security alert; and the reply to your complaint.
26.2 Among them is the request to rate the photographer after delivery, which is never tied to an incentive.
26.3 Service messages carry no offer and no invitation to book again; otherwise they would be marketing under section 21.
26.4 You can switch off non-urgent notifications with the «Notifications» choice in your account; sign-in codes, security alerts, legal notices and what is needed to perform a booking in progress reach you as long as you have an account.
27. Tailoring offers
27.1 If you agreed to offers, Sworah may choose which ones reach you by your city, your language and the kind of services you have booked or searched for, and nothing more.
27.2 This choice is not built on sensitive data, and no decision affecting your right to a service or a price is made by it.
27.3 You can ask to stop the tailoring and receive only general offers, or stop offers altogether, from the same place described in section 23.
28. Photographers
28.1 The same rules apply to marketing messages to photographers: a separate consent, withdrawal with the same ease, a disclosed sender name and the sending hours.
28.2 Sworah does not hand customers’ contact details to any photographer or anyone else for marketing, and a photographer may not address a customer outside the booking’s chat to offer services; a breach is dealt with under the Photographer Agreement.
28.3 Service messages reaching a photographer about their requests, bookings and earnings are not marketing.
29. Your complaint
29.1 If a message you did not agree to reaches you, or your withdrawal is not acted on within 24 hours, tell us through «Contact us» in the app or the contact details at the head of this Policy, and we answer within 10 days.
29.2 You may in any case complain to the Saudi Data and Artificial Intelligence Authority about your data, to the Communications, Space and Technology Commission about unwanted messages, and to the Ministry of Commerce about advertising.
30. Version
30.1 Material changes to this part take effect one week after they are announced in the app, and never extend your consent to a new channel or purpose without a new choice by you.
30.2 The Arabic text prevails; the English text is a translation of it.
30.3 Version 1.0 — effective from 5 November 2026
Part three: Data Retention and Deletion Schedule
This schedule sets out what Sworah keeps of your data, for how long, why, and what happens then. It is the only retention table in Sworah's documents; the Privacy Policy (Part one of this Policy) and the other documents refer to it and do not repeat it. The periods are maximums: what has served its purpose earlier is deleted earlier. Where it says "erased", the data is made unreadable, unrecoverable and impossible to link to you.
31. Account data
31.1 What: your mobile number, name, gender, date of birth, nationality, language, e-mail if you gave one, account picture, your devices’ notification tokens, and the stamp of your acceptance of the terms and the privacy policy with their version number.
31.2 How long: for as long as your account exists, then 30 days from your deletion request.
31.3 Why: performing the account and booking contract; the retention period gives time to finish what is open and to undo an unintended deletion.
31.4 Then: the personal fields, the picture and the device tokens are erased; the mobile number alone remains under block 40, and the acceptance stamp remains for its contract’s period under block 34.
32. Identity verification and documents
32.1 What, for a photographer: the documents uploaded for verification (identity document, freelance document or commercial register, certificate and licences), the result of verifying them, the date of verification, each document's expiry date where given, and the name of the staff member who verified.
32.2 How long: the documents and the result for as long as the account exists; the result and the dates then with the booking records in block 33 if there were bookings.
32.3 Why: confirming a photographer's eligibility before acceptance is a condition of their agreement, and proving that the check was made.
32.4 Then: the document images are erased with the account; the result remains as part of the booking file and is erased with it.
33. Bookings, payments and payouts
33.1 What: the booking, its service, date, place, price and status, the delivery link, the date and reason of any cancellation or refund, payment references without card numbers, wallet entries, the photographer's payouts, and — once invoicing is in force — the invoice and credit note with the customer's name on them, and the photographer's name and IBAN on the payout record.
33.2 How long: 10 years from the end of the tax year of the transaction.
33.3 Why: the law requires commercial books and tax records to be kept, and electronic invoices to be kept inside the Kingdom.
33.4 Then: the record is erased; aggregate totals that point to no person remain.
34. Contracts, acceptance logs and document versions
34.1 What: the text of every version of the terms and policies with its effective date, the log of your acceptance of it (version number, time, account identifier and device), and your separate consents, such as the consent to show pictures in a photographer’s portfolio.
34.2 How long: at least 3 years from the end of the contract and, in every case, until the limitation period for any claim under it has run, which is 10 years from the right falling due.
34.3 Why: an intermediary platform must keep the data of contracts concluded through it for three years, and must be able to prove what was agreed until claims are time-barred.
34.4 Then: the acceptance log is erased; the versions’ texts remain because they concern no person.
35. Chat
35.1 What: the messages between customer and photographer on each booking, their pictures and markers, and the result of the screening for contact details and language.
35.2 How long: for as long as the booking record in block 33 is kept; the chat is part of that record.
35.3 Why: the chat is the evidence in complaints, refund requests and card disputes, and is not kept longer than the transaction needs.
35.4 Then: the messages and their pictures are erased with the booking record.
36. The delivery link, portfolio and account pictures
36.1 What: the gallery link the photographer posts on the booking, which is the address of the gallery on a hosting service from the list Sworah accepts; the photographer’s portfolio pictures on the platform; and your account picture. Chat pictures are covered by block 35.
36.2 How long: the link with the booking record under block 33; portfolio pictures for as long as the photographer shows them and the consent of the people in them stands; the account picture with the account under block 31.
36.3 Where the delivered pictures stay: Sworah does not keep them; they are on the photographer's gallery service under that service's terms, and under their agreement the photographer must keep them available to you for at least 90 days from delivery. Save your pictures with you within that time.
36.4 Why: the link is the record that delivery happened and its evidence in complaints; a picture of an identifiable person is their personal data and is not kept past its purpose; the pictures are yours once paid for and their permanent home is with you.
36.5 Then: the link is erased with the booking record; a portfolio picture is removed within 7 days of consent being withdrawn or removal being requested; what is deleted from the server leaves the backups under block 45.
37. Location
37.1 What: the session location you set in the booking, your device’s last known position rounded to about a kilometre, and the photographer’s studio location.
37.2 How long: the session location with the booking record in block 33; the last known position is overwritten on each use and erased with the account.
37.3 Why: distance to photographers, the service area and arranging the session; Sworah does not track your movements.
37.4 Then: nothing of it remains outside the booking after erasure.
38. Marketing consent and withdrawal log
38.1 What: your «Offers and news» choice and the time it was last changed.
38.2 How long: for as long as your account exists; it is erased with the account under block 31.
38.3 Why: proving that what was sent was consented to, and making sure nothing is sent after your withdrawal.
38.4 Then: the choice is erased with the account.
39. Ratings and complaints
39.1 What: your rating of the photographer and its text, your reports on bookings and the Sworah team’s decisions on them, and what you provided to support an exceptional refund request.
39.2 How long: the rating for as long as the photographer is on the platform, attributed to an identifier rather than a name once your account is deleted; the complaint and its decision with the booking record in block 33; proof of an emergency or a death only until the decision.
39.3 Why: ratings are part of the photographer’s reputation others rely on; decisions are part of the transaction record; the proof is not needed after the decision.
39.4 Then: the proof is deleted as soon as the decision is made, and your name is erased from the rating when your account is erased.
40. Banned numbers
40.1 What, for a banned account: the mobile number, the ban's reason, its date and who decided it.
40.2 How long: for as long as the ban stands and at most 5 years from the date of the ban, with a review of the list every 12 months to lift what is no longer justified.
40.3 Why: preventing someone banned for abuse or fraud from creating a new account with the same number; a legitimate interest of Sworah and its users, with a written assessment.
40.4 Then: the number and the ban record are erased, and the number may register a new account.
41. Security and access logs
41.1 What: sign-in times, devices and connection addresses, failed sign-in attempts, the log of what Sworah staff do in the console, security events, and the website server’s logs.
41.2 How long: 12 months.
41.3 Why: detecting and investigating fraud and intrusion, and holding to account anyone at Sworah who reaches your data.
41.4 Then: the logs are deleted; what relates to a reported incident is kept until the incident is closed.
42. Compliance records
42.1 What: the record of processing activities, impact assessments and legitimate-interest assessments, the incident register and its notifications, and the log of your requests about your data and the answers given.
42.2 How long: the period of the processing, then 5 years from its end.
42.3 Why: the law requires every organisation processing personal data to keep these records and to produce them on request.
42.4 Then: they are deleted.
43. Sign-in codes and sessions
43.1 What: the sign-in code sent to your phone and the number of attempts at it, and your sign-in sessions and those revoked.
43.2 How long: the code for 10 minutes, after which it is void and deleted within hours; a session for its lifetime, then one day.
43.3 Why: secure access to your account, preventing code guessing, and signing a lost device out of every session.
43.4 Then: they are deleted.
44. Website contact messages
44.1 What: your name, e-mail or number and the text of your message sent from the website’s contact form, and Sworah’s reply.
44.2 How long: 12 months from the message being closed.
44.3 Why: answering you and following up what you asked, and proving what was said if the matter returns.
44.4 Then: they are deleted.
45. Backups
45.1 What: an encrypted copy of the database and files, to restore the service after a failure.
45.2 How long: each copy for 90 days at most.
45.3 Why: continuity of the service and recovery of what might be lost.
45.4 Then: the copy is deleted in its cycle, so what was erased from the server leaves the backups no later than 90 days after its erasure; a backup is restored only to rescue the service, and erasure is re-applied to it when restored.
46. How to delete your account and what happens next
46.1 Request deletion from within the app: Account, then «Delete my account». Your sign-in by phone code is the verification that you are the account's owner; if you request deletion by another means, we verify your identity first in the same way.
46.2 If you have an open or paid booking not yet completed, or a wallet balance, the app tells you what must be completed or settled first, because your right and the other side’s are not deleted.
46.3 On confirmation your account is hidden at once: it leaves search and every screen, your devices are signed out, and all messages stop.
46.4 After 30 days your personal data is erased under the blocks above: the personal fields, pictures, documents, device tokens, bank details and location; the erasure cannot be undone.
46.5 After erasure there remains, attributed to an identifier rather than a name: the record of bookings, invoices and payments for the period in block 33; the mobile number and the ban record if the account was banned, for the period in block 40; the ratings you wrote, without your name; the acceptance log for the period in block 34; and whatever relates to an open dispute or is required by a judicial authority, until it ends.
46.6 On request we tell you when erasure is complete, what was erased, what remains, why and until when; if part of your request was refused, the reason is given.
46.7 If your number returns to the app after erasure it is treated as a new account, unless it is banned, in which case the ban stays on the number.
46.8 Your other requests about your data, such as access, a copy and correction, are answered within 30 days through «Contact us» in the app or the contact details at the head of this Policy, under the Privacy Policy (Part one of this Policy).
47. Version
47.1 Material changes to this schedule take effect one week after they are announced in the app; a change never lengthens the retention of data collected before it except under a law.
47.2 The Arabic text prevails; the English text is a translation of it.
47.3 Version 1.0 — effective from 5 November 2026
Version 1.0 — effective from 5 November 2026