Privacy Policy

1. Who we are

ASAS is a marketplace that connects customers in Kuwait with engineering offices, contractors, service providers and material vendors. In this policy "ASAS", "we" and "us" mean the operator of the ASAS platform, and "you" means any person who creates an account or otherwise uses the platform.

The platform has three front ends that share one backend: the customer mobile app (iOS, Android and web), the vendor/company web portal, and the internal administration portal. This policy covers all of them.

2. Information we collect

We collect only what the platform needs in order to work. Depending on how you use ASAS, that may include:

• Account details — full name, mobile number with country code, email address, profile picture, preferred language (English or Arabic), and a securely hashed password. We never store your password in readable form.
• Sign-in identifiers from Google or Apple — if you choose social sign-in, we receive the identifier issued by that provider and, where you allow it, your name and email. We never receive your Google or Apple password.
• One-time passwords (OTP) — a short code and its expiry used to verify your mobile number when you register or reset your password, together with the number of attempts made.
• Project data — the plans (projects) you create, the drawings, photos and documents you upload, the specialization and services you request, the budget and timeline you set, and the governorate, area and map location of the site.
• Engagement data — invitations you send, proposals you receive or submit, negotiation history, site-visit requests and their fees, service bookings, work reports and completion confirmations.
• Marketplace data — your cart, favourites, delivery address and contact details for an order, order history, out-of-stock replacement choices, and delivery fees applied by each vendor.
• Payment data — the amount, currency, status and reference of each payment, the invoice identifiers returned by our payment gateway, wallet balances, escrow holds, earnings and transaction history. Card numbers, CVV and bank credentials are entered on the payment gateway’s own secure page and are never received or stored by ASAS.
• Payout details for providers — bank account holder name, IBAN and bank name, used only to pay out earnings owed to you.
• Verification documents — for companies and vendors, the commercial licence, civil ID and other documents requested during onboarding, together with their review status.
• Messages and content — chat messages and attachments exchanged with the other side of a project or an order, reviews and ratings you publish, reports you file, disputes you open, and messages you send to support through Contact Us.
• Device and technical data — the notification token of each device you sign in on and its platform, the devices holding an active session, IP address, request identifiers and timestamps written to our server logs, and failed sign-in counts used to lock an account that is under attack.

3. How we use your information

• To create and secure your account, verify your mobile number, and keep you signed in on each of your devices.
• To run the core service: publishing your plans to the providers you choose, delivering proposals and invitations, arranging site visits and bookings, and tracking a project through to completion.
• To process marketplace orders, calculate delivery fees, handle out-of-stock replacements, and deliver goods to the address you provide.
• To take payment, hold funds in escrow where the service requires it, release them on completion, settle vendor and provider earnings, and issue refunds.
• To send you service notifications — a new proposal, a status change, a payment result, a chat message — by push notification, SMS or email. Operational messages of this kind are part of the service and cannot be switched off individually, though you may disable push notifications from your device settings.
• To moderate content, review verification documents, investigate reports and resolve disputes between the two sides of a transaction.
• To detect and prevent fraud, abuse and unauthorised access, including locking an account after repeated failed sign-in attempts.
• To meet our accounting, tax and other legal obligations, and to keep the records the law requires us to keep.
• To measure and improve the platform in aggregate. We do not use your project files or chat messages for advertising, and we do not sell your data.

4. Who we share it with

We share personal information only where it is necessary, and only with:

• The other side of your transaction — a company you invite or that applies to a plan you published sees the plan details, its files and location, and your contact name; a vendor sees the delivery address and contact number of the order it fulfils. A company that has not been invited, and cannot apply to your plan, does not see it.
• Our payment gateway (MyFatoorah), which processes card, KNET and Apple Pay payments and returns the result to us.
• Cloud infrastructure and storage providers (Amazon Web Services), where the database, the uploaded files and the server logs are hosted.
• Google Firebase Cloud Messaging, which delivers push notifications to your device.
• Our SMS gateway and email provider, which deliver verification codes and service emails.
• Delivery and logistics partners engaged to deliver a marketplace order.
• Professional advisers, auditors and law enforcement or regulators, where we are legally required to disclose information or need to establish, exercise or defend a legal claim.
• A successor entity, if the ASAS business is reorganised, merged or acquired. Your information stays subject to a policy at least as protective as this one.

5. Verification codes and SMS

We use one-time codes to confirm that a mobile number belongs to you. Depending on how the service is configured in your region, the code is either sent by our SMS gateway or handed to the ASAS app so that the app sends it from your device. A code is valid for a short period, may be entered only a limited number of times, and is invalidated as soon as it is used.

6. How long we keep it

We keep your account information for as long as your account is open. When you delete your account, your profile is erased or irreversibly anonymised straight away, as described in the section on your rights below.

Records of completed transactions — orders, invoices, payments, payouts, escrow movements and disputes — are retained in a de-identified form for as long as accounting, tax and anti-fraud law requires, because they concern another party as well as you. Server logs are kept for a limited period for security and troubleshooting.

7. How we protect it

• Passwords are stored only as a salted one-way hash and are never readable by us or by anyone else.
• Access is granted by short-lived tokens, one session per device, so signing in or out on one device does not expose the others.
• Repeated failed sign-in attempts temporarily lock the account, and every request is rate-limited.
• Uploaded files are held in access-controlled cloud storage and are reached through time-limited links rather than public URLs.
• Traffic between your device and our servers is encrypted in transit.
• No system is perfectly secure. Keep your password private, and tell us at once if you believe your account has been accessed by someone else.

8. Your rights and choices

• Access and correction — you can view and edit your profile at any time from the app or the vendor portal.
• Deletion — you can delete your account from Settings inside the app, or from this website at asasapp.net/delete-account. Deletion is permanent and cannot be undone.
• Withdrawing consent — you can turn off push notifications from your device settings and stop using the platform at any time.
• A copy of your data — write to us using the contact details below and we will provide the personal information we hold about you.
• Complaints — if you are not satisfied with how we have handled your information, contact us first and we will try to put it right.

9. Children

ASAS is not directed at children and is intended for users aged 18 and over. We do not knowingly collect information from a child. If you believe a child has given us personal information, contact us and we will delete it.

10. Where your data is processed

Our infrastructure and service providers may process and store data outside Kuwait. Where that happens we rely on providers who apply recognised security and data-protection standards, and we require them to use the data only for the services they perform for us.

11. Cookies and tracking

These public pages set no cookies and carry no advertising or analytics trackers. The vendor and administration portals use local browser storage only to keep you signed in and to remember your language.

12. Changes to this policy

We may update this policy as the platform changes. The revision date at the top of this page always shows the current version, and material changes will be announced in the app.

13. Contact us

For any question about this policy or about your personal information, write to us at support@asasapp.net, or use Contact Us inside the ASAS app.