Privacy Policy

This Privacy Policy explains how Pyro ("Pyro", "we", "us") collects, uses, discloses, and safeguards personal data when you use the Pyro platform in Saudi Arabia (KSA), the United Arab Emirates (UAE), Egypt, Kuwait, Qatar, Bahrain, Oman, Jordan, and other supported jurisdictions. Pyro is the data controller for personal data processed through the Service.

1. Data protection contact

Data Protection contact: support@pyro-app.io. Please use this address for all privacy requests and complaints.

2. Personal data we collect

• Identity & contact — full name, date of birth, phone, email, preferred language, country.
• Government identifiers — National ID / Iqama / Passport / Driver Licence and tax IDs (VAT / TRN / Tax Card / GSTIN / NTN / EIN) collected from Providers and, where required by law, from Homeowners.
• Location data — service addresses, GPS coordinates for on-site jobs, branch and household location.
• Device & job data — appliances registered, device photos, diagnostics, quotes, invoices, parts used.
• Payment metadata — payment method type, last four digits, transaction references. Full card data is processed by our PCI-DSS certified payment provider and never stored by Pyro.
• Communications — in-app chat, notification preferences, support tickets.
• Technical data — IP address, device model, OS, session logs, and cookies.

3. Purposes & legal bases

• Performance of contract — creating your account, matching Bookings, processing payments, issuing invoices, running escrow and payouts.
• Legal obligation — issuing VAT-compliant e-invoices (ZATCA, FTA, ETA, NBR, etc.), KYC/AML for Providers, tax and commercial-records retention, responding to lawful requests.
• Legitimate interest — fraud prevention, security monitoring, service improvement, aggregated analytics.
• Consent — marketing communications, optional analytics, festive greetings, and any processing that requires consent under local law. You may withdraw consent at any time.

4. Local legal frameworks we comply with

• KSA — Personal Data Protection Law (Royal Decree M/19) and SDAIA implementing regulations (2023).
• UAE — Federal Decree-Law No. 45 of 2021 (PDPL) and its Executive Regulations, plus DIFC Data Protection Law No. 5 of 2020 and ADGM Data Protection Regulations 2021 for the applicable free zones.
• Bahrain — Law No. 30 of 2018 (Personal Data Protection Law).
• Qatar — Law No. 13 of 2016 concerning Personal Data Privacy Protection.
• Oman — Royal Decree No. 6 of 2022 (Personal Data Protection Law).
• Egypt — Law No. 151 of 2020 (Personal Data Protection Law).
• Jordan — Law No. 24 of 2023 (Personal Data Protection Law).
• Kuwait — CITRA Data Privacy Protection Regulation No. 26 of 2024 (superseding the 2021 regulation).
• Other jurisdictions — the EU GDPR, UK GDPR, and CCPA rights are honoured on request for users resident in those territories.

5. Your rights

Subject to local law, you have the right to: access your data, rectify inaccurate data, request erasure ("right to be forgotten"), restrict or object to processing, obtain a portable copy, withdraw consent, and lodge a complaint with your data-protection authority. We aim to respond within 30 days of a verified request; complex requests may be extended by a further 30 days with notice.

6. How to exercise your rights

Email support@pyro-app.io from the address on file. We may ask for reasonable identity verification before disclosing or deleting data.

7. Sharing & disclosure

• Providers receive only the Homeowner data necessary to fulfil a Booking (name, contact number, service address, job scope).
• Payment processors receive payment metadata to process transactions.
• Tax authorities — invoice data is transmitted where required (e.g. ZATCA in KSA, FTA in UAE, ETA in Egypt).
• Law enforcement / regulators — on a valid legal order.
• We do not sell personal data.

8. Cross-border transfers

Where data is transferred outside your country, we apply appropriate safeguards, including approved standard contractual clauses, adequacy decisions, or transfers to jurisdictions listed by the local regulator (e.g. SDAIA-approved destinations). For KSA users, sensitive data is hosted in-region where legally required.

9. Retention

We retain personal data for the duration of your account and thereafter for the period required by local tax, commercial, and consumer-protection law — generally up to seven (7) years for transactional records (KSA, UAE, Egypt), or the period mandated in your jurisdiction. Beyond retention, data is deleted or irreversibly anonymised.

10. Security

We apply administrative, technical, and organisational safeguards: TLS encryption in transit, encryption at rest, role-based access control, row-level authorisation, MFA for administrators, audit logging, and periodic security reviews.

11. Children

The Service is not directed to children under 18. If you believe a minor has provided data, contact us for takedown.

12. Cookies & analytics

We use strictly necessary cookies to keep you signed in and secure the Service. Optional analytics and marketing cookies are enabled only with consent where required.

13. Automated decision-making

Pyro does not make solely automated decisions producing legal or similarly significant effects on you. Provider matching may use algorithmic ranking, but human review is available on request.

14. Breach notification

If a personal-data breach is likely to result in risk to your rights, we will notify the competent regulator and affected users within the statutory window (72 hours where applicable under UAE PDPL, KSA PDPL, and GDPR-parity frameworks).

15. Complaints

Please contact us first at support@pyro-app.io. You also have the right to complain to your local authority: SDAIA (KSA), UAE Data Office / DIFC Commissioner / ADGM Commissioner (UAE), Personal Data Protection Authority (Bahrain), National Cyber Governance Agency (Qatar), Ministry of Transport, Communications and Information Technology (Oman), Personal Data Protection Center (Egypt), Ministry of Digital Economy & Entrepreneurship (Jordan), or CITRA (Kuwait).

16. Changes to this policy

We will give at least 30 days' notice of material changes by email or in-app notice.

17. Language

This Policy is published in English. An Arabic translation is available on request; where both versions are provided and there is a conflict, the Arabic version prevails in KSA, UAE, Egypt, Kuwait, Qatar, Bahrain, Oman, and Jordan.

18. Contact

Privacy enquiries and requests: support@pyro-app.io.

This document is provided by Pyro for informational purposes. For binding Arabic-language versions or country-specific enquiries, contact support@pyro-app.io.