1. Introduction
The Malaa app (malaa.tech) brings together two regulated services. This Policy covers both, and tells you which company is responsible for which part of your data. We serve adults in the Kingdom of Saudi Arabia; our services are not directed to or available to anyone under 18, and we do not knowingly collect their data. It explains what personal data we collect, why, how we protect it, and the rights you have under the Saudi Personal Data Protection Law (PDPL).
Each company is an independent data controller for its own processing:
- Malaa Information Technology Company: Unified CR 7015866812. Account aggregation and financial planning, under the supervision of the Saudi Central Bank (SAMA).
- Malaa Financial Technology Company: Unified CR 7031264620. Investment and robo-advisory services, under the supervision of the Capital Market Authority (CMA).
Both companies share the same registered address: Double Two Center, 3087 Anas Bin Malik, Alnarjas, Riyadh 13323, Saudi Arabia. They share certain data with each other as described in section 6.
This Policy is based on the following laws and regulations:
- The Personal Data Protection Law (PDPL) and its Implementing Regulation.
- The Regulation on Personal Data Transfer outside the Kingdom.
- The SDAIA Privacy Policy Developing and Elaboration Guideline.
- The SAMA Open Banking Framework and the CMA Capital Market Institutions Regulations.
- The Anti-Money Laundering Law and the Credit Information Law, and their implementing regulations.
Key terms used in this Policy:
- Personal data: any data that identifies you directly or indirectly.
- Processing: any operation performed on personal data, such as collection, use, storage, disclosure or destruction.
- Controller: the party that determines the purposes and means of processing; here, each of the two Malaa companies for its own processing.
- Competent authority: the Saudi Data and AI Authority (SDAIA).
2. Contact details and updates to this Policy
You can reach us through the Malaa app or using the details below.
- Privacy and your rights: data.privacy@malaa.tech
- Customer support: support@malaa.tech
- Account reopening after deletion: compliance@malaa.tech
- Website: malaa.tech
- Postal address: Double Two Center, 3087 Anas Bin Malik, Alnarjas, Riyadh 13323, Saudi Arabia
- Last updated: July 2026; this version becomes effective on approval.
We review this Policy periodically and whenever our processing changes, record each change in our internal update record, and notify you of material changes through the app or by email. Related documents, including our Terms & Conditions, are available in the app.
3. What personal data we collect
| Category | Examples |
|---|---|
| Identity | Full name, National ID or Iqama number, date of birth, gender, nationality, mobile, national address |
| Account data | IBAN and account numbers, account type, balances, transaction history, standing orders |
| Financial & employment profile | Income estimates, employment and education details, spending categories, declared assets and liabilities, affordability indicators |
| Investment data | Investment objectives and experience, portfolio holdings, orders, deposits and withdrawals (investment service) |
| Screening | Sanctions and PEP screening results, risk flags |
| Preferences | Product and app preferences, including Zakat and Shariah purification settings |
| Location | Approximate and precise (GPS) location, where you enable it |
| Communications & support | Support chat and messages, in-app notifications, and marketing interactions |
| Account & device | Email, phone, device identifiers, app usage and log data, cookie data (data collected through website log files and cookie or similar technologies) |
Identity and account data are necessary to use Malaa's core services: without them we cannot verify you or aggregate your accounts. Other data, such as marketing preferences, is optional and you choose whether to provide it.
4. How we collect your personal data, and why
We collect personal data in two ways:
- Directly from you: when you sign up and use the app, for example your contact details, preferences and settings, through in-app forms.
- Indirectly: from your banks through SAMA Open Banking (account and transaction data), from government services (Nafath, Yaqeen, Elm) for identity verification, and automatically from your device (device identifiers, app usage and log data).
Where we obtain your personal data indirectly rather than from you, we inform you within 30 days, unless you already have this information.
On our website and app we use cookies and similar technologies, such as pixels, web beacons and SDKs. We use them to keep the service working, remember your preferences, and collect usage statistics through analytics providers (see section 8) that help us improve Malaa. This analytics data can include identifiers and transaction-related attributes, is processed on the basis of your consent, and we are actively minimizing it. You can control or disable cookies through your browser or device settings, though some features may not work without them. Our website does not currently respond to browser "Do Not Track" signals.
5. How we use your personal data
We use your personal data for the following purposes:
- Aggregate and display your accounts, and provide financial planning, insights and advisory.
- Verify your identity and operate and support the service.
- Meet anti-money-laundering, sanctions-screening and other regulatory obligations.
- Protect against fraud and secure our systems.
- Send marketing communications where you have opted in.
We collect only the personal data necessary for each purpose, and we do not use your data in a way that is incompatible with the purpose for which it was collected.
Your choices. Where you have opted in to marketing, you can opt out at any time: use the unsubscribe link in any marketing email, reply STOP to a marketing SMS, or manage notifications in your device settings. Opting out of marketing does not affect your use of the service.
We use models to generate financial insights and categorize spending; these produce insights, not decisions with a legal or similarly significant effect on you. For the investment service, any portfolio allocation or rebalancing suggestions are advisory: investment decisions are not made solely by automated means, and a person is involved in decisions affecting your investments, under the CMA framework.
6. How we disclose your personal data
- Cloud hosting: OCI and GCP host our systems within Saudi Arabia under data processing agreements.
- Your banks: as the source of your account data, under open banking.
- Government services: Elm, Nafath and Yaqeen for identity and verification.
- Investment partners: for the investment service, a licensed custodian and a brokerage/execution partner (located outside the Kingdom; see section 8); AML-screening and payment providers are in-Kingdom.
- Regulators and authorities: SAMA, the CMA, SDAIA or law enforcement, only where the law requires.
Within the Malaa group, Malaa Information Technology Company and Malaa Financial Technology Company, together with our sister company Credit Line Company, share limited personal data with each other, under an intra-group data sharing agreement and limited to the minimum necessary, for: marketing and analytics; identity verification and data-accuracy checks; service quality and transaction efficiency; and fraud prevention and the detection of unlawful activity. Marketing and analytics rely on your consent, and you can opt out at any time; the other purposes rely on our legitimate interest. No credit or anti-money-laundering data is shared for these purposes.
These disclosures are ongoing for as long as you use the service, not one-off, and we never rent, sell or trade your personal data.
7. Legal basis for collecting and processing your personal data
| Purpose | Lawful basis |
|---|---|
| Aggregate and display your accounts | Your consent and our contract with you |
| Verify your identity | Legal obligation and contract |
| Anti-money-laundering and sanctions screening | Legal obligation (SAMA/AML) |
| Financial planning, insights and investment advisory | Contract; consent where applicable |
| Operate and support the service | Contract |
| Protect against fraud and secure our systems | Legitimate interest and legal obligation |
| Send marketing (if you opt in) | Your consent |
Before we access any account, we obtain your consent through the SAMA Open Banking consent flow. Our access to your accounts is read-only, and we never see or store your bank login credentials. Your consent is specific, granular (per data type and per bank) and valid for one year, after which we ask you to renew it. You can withdraw consent at any time in the app; when you withdraw, we stop aggregating your data and delete it, except where the law requires us to keep certain records (see section 8).
Giving consent for a feature is not a condition for using unrelated parts of the service. For account aggregation we rely on your consent through the SAMA open-banking consent flow, and we handle credit data in line with the Credit Information Law.
8. Where we store your data, transfers, retention and destruction
Your core account and financial data is stored and processed within Saudi Arabia, on cloud infrastructure (OCI and GCP) in in-Kingdom regions, and our backups stay in the Kingdom.
Some personal data is processed on our behalf by service providers located outside the Kingdom: for the app generally (analytics, marketing, attribution, error monitoring, and location services on Huawei devices) and, for the investment service, brokerage and execution. These transfers are, by category of recipient:
| Category of recipient | Purpose | Country |
|---|---|---|
| Analytics providers | Product, usage and website analytics (event data, which may include transaction-related attributes) | United States |
| Email and marketing provider | Email communications and marketing | European Union |
| Attribution provider | Mobile attribution | European Union / United States |
| Error-monitoring provider | Application error monitoring | United States |
| Device services provider (Huawei-device users only) | Location services on Huawei devices | China |
| Brokerage and execution partner (Malaa Finance) | Investment brokerage and trade execution | United States |
The specific service providers within each category are recorded in our internal Records of Processing Activities, available to the competent authority on request.
Where we transfer personal data outside the Kingdom, we do so only where the PDPL and the Personal Data Transfer Regulation permit it, limited to the minimum data necessary for the stated purpose, and protected by appropriate safeguards (such as standard contractual clauses) following a transfer risk assessment. We do not transfer your bank login credentials, and your data is not used for any purpose beyond those described in this notice.
We keep personal data for the following periods:
| Data | Period |
|---|---|
| Anti-money-laundering records | At least 10 years (required by law) |
| Transaction and account data | Duration of your relationship plus 10 years |
| Consent records | Life of the consent plus 10 years |
| Marketing data | Until you withdraw consent |
When a retention period ends, we securely destroy personal data by cryptographic erasure or an equivalent method, so that it cannot be viewed or recovered. Where we reuse data for analytics, we anonymize it so it no longer identifies you.
You can delete your account in the app: open the app, tap the Account icon, tap Personal Account, then tap Delete My Account. We delete your personal information and the data shared through open banking.
We protect your data with encryption in transit and at rest, anonymization or pseudonymization where possible, strict access controls on a need-to-know basis, logging and monitoring, aligned with the SAMA Cyber Security Framework. The level of protection reflects the sensitivity of the financial data we hold. If a personal data breach occurs that is likely to cause serious harm to your data, rights or interests, we will notify the competent authority and inform you, as required by the PDPL.
9. Your rights regarding your personal data
Under the PDPL you have the following rights:
- The right to be informed: You have the right to know how we collect your personal data, the lawful basis for collecting and processing it, and how it is processed, stored, destroyed and to whom it is disclosed. You can find the full details in this Privacy Policy or by contacting us using the details below.
- The right to access your personal data: You have the right to ask us to view your personal data.
- The right to obtain your personal data: You have the right to request your personal data held by the controller in a readable and clear format, provided in a commonly used electronic format or as a printed copy where practicable.
- The right to correct your personal data: You have the right to ask us to correct, complete or update your personal data.
- The right to destroy your personal data: You have the right to ask us to destroy your personal data in certain circumstances, without prejudice to the legal justifications and the limitations on the right to erasure.
- The right to withdraw your consent: You have the right to withdraw your consent to the processing of your personal data at any time, unless a legal justification requires otherwise.
Beyond these statutory rights, we also honour requests to object to or restrict certain processing where this is feasible and permitted by law.
You will not be required to pay any fee to exercise these rights, and we respond within 30 days. When you ask for access or a copy, we provide it unless doing so would reveal another person's data or infringe the rights of others, such as intellectual property or trade secrets.
10. Data Protection Officer
Our Data Protection Officer oversees privacy at Malaa and is your point of contact for any question about how we process your personal data or to exercise your rights. Please use the in-app channel or email data.privacy@malaa.tech.
11. Complaint or objection filing method
If you believe we have not complied with the PDPL, or we have not allowed you to exercise your rights within the time stated above, you can complain to our Data Protection Officer / Privacy Office at data.privacy@malaa.tech. We handle privacy complaints within 30 days. If you are not satisfied with our response, you may lodge a complaint with the Saudi Data and AI Authority (SDAIA), the Competent Authority, within 90 days of the incident or of becoming aware of it (Implementing Regulation Art 37).