FilFil Privacy Policy
Effective date: 8 July 2026
This Privacy Policy explains how FilFil collects, uses, stores, shares, and protects your personal information when you use the FilFil mobile app and related services (together, the "Service"). FilFil is a meal-kit service: you browse recipes, subscribe to plans, and receive ingredient boxes delivered to you in Riyadh, Saudi Arabia.
By using the Service, you agree to the practices described in this policy. If you do not agree, please do not use the Service.
1. Who we are
The Service is operated by شركة سوفرا كوان (Sufra quan Company) ("FilFil", "we", "us", or "our"), Commercial Registration 7051799778, based in Riyadh, Kingdom of Saudi Arabia.
We are the party responsible for deciding how and why your personal data is processed (the data controller under the Saudi PDPL).
For any privacy question or to exercise your rights, contact us at support@filfil.net.
2. Information we collect
We collect only the information we need to run the Service. The categories below reflect what the app actually does. We do not collect health or medical information, and the Service has no health data features.
2.1 Account and contact information
- Name (full name, and first and last name if you provide them).
- Email address.
- Mobile number.
- Password, which we store only as a secure one-way hash, never as plain text.
We use this to create and secure your account, sign you in, contact you about your orders, and fulfil delivery.
2.2 Profile information
- Gender and date of birth, if you choose to enter them in your profile.
These are optional and are used to complete your profile.
2.3 Delivery address and location
- Delivery address details: your default address, area, city, national address, building number, floor number, street name, and any address description or notes you enter.
- Location coordinates (latitude and longitude): with your permission, the app uses your device location and a map to help you set and confirm your delivery point. The chosen coordinates are saved with your account so we can deliver to the right place.
You can grant or deny location access in your device settings at any time. Denying location may limit the map feature, but you can still enter your address manually. We use this information only to deliver your ingredient boxes to the correct location.
2.4 Orders and subscriptions
- The recipes, ingredient boxes, plans, and subscriptions you select, and your order and subscription history.
We use this to provide and manage the Service you have asked for.
2.5 Communications
- Messages you send us (for example, support requests by email) and your contact details for replying to you.
2.6 Technical and operational data
We do not run advertising trackers or in-app analytics SDKs (see Section 4). Our servers do keep standard operational logs, including technical details such as the type of request, response status, timing, and basic diagnostic information, through Microsoft Azure Application Insights. We use these logs only to keep the Service running, to diagnose problems, and to protect against abuse. They are not used to build advertising profiles.
2.7 Payment information
FilFil currently accepts payment by cash on delivery only. We do not collect or store card numbers or other online payment details in the app.
Note for a future update: if online payment is added later, we will name the payment provider here and update our Apple and Google data declarations.
3. Why we use your information and our legal basis
We process your personal data on these legal bases under the Saudi PDPL:
- Your consent, which you give when you create an account and use the Service, and which you give separately for device location access through your device's permission prompt. You can withdraw consent at any time, as described in Section 8.
- Performance of the service you asked for and our agreement with you (create and manage your account, show recipes, take and deliver your orders, manage your subscriptions, set your delivery location, and take cash payment on delivery).
- Compliance with our legal obligations, including tax and accounting record-keeping.
- Our legitimate interest in keeping the Service secure, preventing fraud and abuse, and fixing problems, balanced against your rights.
We do not sell your personal data.
4. How we share your information
We share personal data only as needed to run the Service, with the following categories of recipients. We do not allow them to use your data for their own unrelated purposes.
- Hosting and infrastructure (processor): our backend and database run on Microsoft Azure (Azure Container Apps and Azure SQL Database), in the UAE North region. Your data is stored on this infrastructure. See Section 5 for the cross-border transfer.
- Maps and location (processor): we use Google Maps to display the map you use to set your delivery location. Your use of the map is also subject to Google's privacy policy.
- Delivery: the people and services who fulfil and deliver your order receive the delivery details they need to reach you (such as your name, address, and contact number).
- Legal and safety: authorities or professional advisers, where we are required to share information by law or to protect our rights, our users, or the public.
We do NOT use advertising trackers, and we do NOT share your data with advertising networks. The app does not currently run a Firebase, Google Analytics, or crash-reporting SDK: an old configuration file from the app's template predecessor remains in the app package, but the Firebase service is not activated in the production build and does not collect or transmit your data. We plan to remove or replace that leftover file. If we later turn on analytics, crash reporting, or push messaging, we will name the provider here and update our Apple and Google data declarations.
5. Where your data is stored and international transfers
Your personal data is stored and processed on Microsoft Azure in the UAE North region (United Arab Emirates). This means your data leaves Saudi Arabia and is transferred to and stored in the UAE.
We rely on this cross-border transfer because it is necessary to provide the Service to you, and we make it under the conditions permitted by the Saudi PDPL and its regulations on transfers of personal data outside the Kingdom. Microsoft Azure provides contractual and technical safeguards for data hosted on its platform. We will move hosting to a Saudi Azure region if and when that becomes a better fit, and we will update this policy if our storage location changes.
Google may also process map-related requests on its own global infrastructure when you use the in-app map.
6. How long we keep your information
We keep your personal data for as long as your account is active and for as long as we need it for the purposes described in this policy.
When you delete your account (see Section 8), we anonymize your record promptly: we overwrite your name, email, mobile number, password, addresses, and location. Your record can no longer identify you after this. We keep order and subscription records in anonymized form (no longer linked to your identity) where we need them for legal, tax, and accounting obligations.
Retention window (interim, under legal review). We are finalizing a specific retention and backup-purge window with our Saudi legal advisers and will update this section when it is confirmed. Our current practice: when you delete your account, the anonymization described above takes effect in our active systems immediately. Residual copies of earlier data can remain in our database backups until those backups expire and are replaced in the normal backup cycle.
7. How we protect your information
We use reasonable technical and organizational measures to protect your data, including:
- Encrypted connections (HTTPS) between the app and our servers, with cleartext traffic disabled in the app.
- Hashed passwords: we never store your password in plain text.
- Authentication and access controls: each account can only access its own data; you cannot read or change another user's account.
No method of transmission or storage is completely secure, so we cannot guarantee absolute security, but we work to protect your data and to respond to any incident appropriately.
If a data breach happens
If a personal data breach occurs that could harm you or your data, we will act in line with the Saudi PDPL and its regulations. We will notify the Saudi Data and Artificial Intelligence Authority (SDAIA) within the time required by law, which is within 72 hours of becoming aware of the breach, and we will notify you without undue delay where the breach is likely to cause you serious harm.
8. Your rights and choices
Under the Saudi PDPL you have the right to:
- Be informed about how we collect and use your data, and why (this policy);
- Access the personal data we hold about you;
- Obtain a copy of your personal data in a readable and clear format, and ask us to transfer it to another data controller where this is technically possible (data portability);
- Request correction of data that is incomplete, inaccurate, or out of date. You can edit most of your details, including your profile and delivery address, directly in the app;
- Request destruction of your personal data, including by deleting your account;
- Withdraw consent at any time, including for location access (through your device settings). Withdrawing consent does not affect processing we carried out before you withdrew it.
How to delete your account and data
You can delete your account yourself in the app: Profile > Delete Account. This permanently anonymizes your record as described in Section 6 and signs you out. You can also ask us to delete your data by emailing support@filfil.net.
To exercise any other right, contact us at support@filfil.net. We may need to verify your identity before acting on a request. We will respond within the period required by the PDPL, which is within 30 days of receiving your request.
If you believe we have not handled your data properly, you may also contact the Saudi Data and Artificial Intelligence Authority (SDAIA), the supervisory authority for the PDPL.
9. Children's privacy
The Service is intended for users aged 18 and over. It is not directed to children, and we do not knowingly collect personal data from children below this age. If you believe a child has given us personal data, contact us at support@filfil.net and we will delete it.
10. Changes to this policy
We may update this policy from time to time. When we make material changes, we will update the effective date above and, where appropriate, notify you in the app. Your continued use of the Service after a change means you accept the updated policy.
11. Contact us
شركة سوفرا كوان (Sufra quan Company)
Commercial Registration 7051799778
Riyadh, Kingdom of Saudi Arabia
Email: support@filfil.net
This policy is published at https://filfil.net/privacy.