Who we are and how to contact us
DAR is a property marketplace operated by Softfm, which determines the purposes and means of processing service data. For privacy requests and exercising your rights, contact Support@softfm.com. For general inquiries: info@softfm.com.
Data we process and its sources
- Account: display name, email address, registration, sign-in and recovery data. Passwords are stored as Argon2id verification hashes, never as plaintext. App session tokens are held in Apple Keychain, with only their hashes stored on the DAR server.
- Profile: your name, optional photo and information you choose to add.
- Properties and interactions: requests, budgets, cities, neighborhoods, property details and photos, addresses and coordinates you select on the map, offers, conversations and their timestamps, message read status, ratings, reports and your block list.
- Notifications: the device token used for Apple push delivery, alert language, offer and message preferences and delivery attempt results, when the device is registered for this service.
- Security and support: correspondence with support and connection data needed to operate and protect the service, such as IP address, request time, sign-in results, errors and administrative action logs. Hosting may process request and browser information in its operational logs.
Data comes from what you enter or upload, your use of the service, people interacting with you through offers, messages, ratings or reports, and service providers as needed for their functions. DAR does not request payment card details or record calls, and does not currently provide an AI assistant within the service.
Required and optional data
A display name, email address and password are needed to create an account. Essential request or property details are required when you use those features. Without necessary data, the corresponding feature may be unavailable. A profile photo and optional notes are not required to create an account. You select the photos you share from your device, and you can use DAR without enabling push notifications.
Selecting a property's location is not continuous tracking of your own location. Avoid adding health or financial information, official identity documents or sensitive data unnecessary for the interaction. Do not share other people's details or photos without an appropriate basis.
Purposes and legal bases for processing
- Providing the service and performing the user agreement: account creation and recovery, posting requests, showing relevant offers, saving properties, messaging, ratings, export and deletion.
- Choices requiring your consent: we obtain consent where legally required and device permissions needed for optional features. You can withdraw consent for processing based on it or change device permissions; the associated feature may stop without cancelling other services.
- Protecting the service and its users: preventing abuse and unauthorized access, handling reports and diagnosing errors under the applicable legal basis, including legitimate interests where permitted and subject to your rights and interests.
- Legal obligations: responding to binding requests from competent authorities and retaining legally required records within the scope of the obligation.
Using DAR does not give blanket consent to process your data for any purpose. If a changed purpose requires a new notice or consent, we explain it before the new processing and obtain consent where required.
What other users see and who can access data
Requests, your name, photo and ratings are visible to users allowed to view them, subject to blocking controls. DAR does not display your account email or phone number as public profile fields; contact details you put into a request, message or photo may be seen by its recipients.
Saved properties, their photos and precise details are available to their owner and the recipient of an associated offer under service permissions. Conversations are accessible to their participants, and read status is shown to the sender. Reports and block lists are not part of your public profile.
Authorized administrators can access account details, reports and associated content as needed for support, safety and administration. Ordinary users do not receive these permissions. A recipient may keep a copy or screenshot outside DAR; contact support if your data is misused.
Service providers and sharing outside DAR
- InMotion Hosting and DAR's hosted mail service: operating the API, accounts, database, photos and email, including password recovery and relevant support and report correspondence.
- Apple: app distribution, maps, address search and push delivery. Notifications use a device token and technical identifiers for delivery and routing; we do not include conversation text or personal contact details in the payload. Necessary map information and search requests may reach Apple when you use its maps.
- Google: choosing to open a Short Address search in Google Maps sends that address to Google, whose policy applies to use of its service.
- Competent authorities: specific data may be disclosed when a binding request or other legal basis applies, limited to what is necessary.
We do not sell personal data. The current version does not include third-party advertising trackers. Hosting, maps and notification delivery may involve processing outside Saudi Arabia; any transfer is subject to applicable legal requirements and safeguards. You can request information about processing locations and providers through our privacy email.
How we protect data
We use encrypted connections, access controls and permission checks, with administrator privileges separated from user accounts. Uploaded photos are stored on DAR hosting and reprocessed to remove embedded EXIF/GPS metadata; this does not remove locations you enter in property details.
Conversations are not end-to-end encrypted. No electronic system is risk-free; protect your device and password and do not share recovery codes. If a data incident requires notification to you or the competent authority, we follow the applicable notification requirements.
Retention and destruction
We retain account and interaction data while needed for the service or a specific lawful purpose. Retention depends on data type, continuing need, destruction requests, statutory periods and disputes requiring preservation. Session and recovery tokens have limited validity according to their function; these do not keep access active after account deletion.
Deleting your account removes its associated records from the service database, including related requests, properties, offers, conversations, ratings and reports, revokes its sessions and queues hosted photos for removal. Photo file removal may require retries after record deletion. Deletion can affect conversations and ratings visible to the other participant.
If a legal requirement calls for preserving a specific record, retention is limited to that record and the necessary period. Handling destruction requests also covers applicable backups and hosting logs; removing an account from the app does not mean every provider's copies are erased at the same instant. You can request clarification about the scope and timing of destruction. There is no single retention period for all record types and legal grounds.
Your rights and how to exercise them
Under Saudi Arabia's Personal Data Protection Law and applicable limits and exceptions, you can be informed of the basis and purposes of collection, access your data and obtain a clear copy, request correction, completion or updating, request destruction, and withdraw consent when it is the basis for processing. Withdrawal does not affect the lawfulness of earlier processing.
Email Support@softfm.com with your request and account email. We may ask for necessary identity verification, never your password or sign-in code. We handle rights requests without delay and within 30 days. Where legal grounds for extension apply, we notify you beforehand of the reason for an extension of no more than a further 30 days. If we cannot fulfill all or part of a request, we explain the applicable legal reason.
You can complain to support about data handling, and may also complain to Saudi Arabia's competent personal data protection authority, the Saudi Data and Artificial Intelligence Authority (SDAIA), through the National Data Governance Platform.
Exporting data and deleting your account
For export, open More → Export data. A ZIP contains your records and hosted photos, excluding passwords, sign-in tokens and other people's private data you are not authorized to receive. Keep this unencrypted file private; export is not an account restoration feature.
For deletion, open More → Profile (Account) → Delete account and confirm permanent deletion. Export is optional and is not required for deletion. If you cannot sign in or use the button, contact support for help exercising your right. Destruction is subject to the scope described in the retention section above.
Notifications, cookies and external links
Offer and message alerts are service notifications. Change their preferences in the app or disable notifications in device settings. DAR does not currently send direct marketing campaigns. If introduced, we will explain the purpose, obtain required consent and provide a way to stop them.
The administrator dashboard uses necessary session and security cookies, separate from mobile app sessions. Current public pages do not include advertising tracking cookies. When you open external maps or websites, their policies govern collection within their services.
Children and policy updates
DAR is intended for people aged 18 and older and is not directed at children. If you become aware of a child's account or data, contact support so we can investigate and take appropriate action.
Updates are published here with a revised last-updated date. Material changes receive an appropriate notice, with renewed consent where required. The policy is available in Arabic and English; contact us about any discrepancy. No translation reduces your statutory rights.