This English version is provided for convenience. If there is any inconsistency between the Arabic and English versions, the Arabic version prevails.
This policy explains how pf41 collects, uses and protects your personal data, and your rights over it, in accordance with the Personal Data Protection Law of the gulf and its Implementing Regulations, to the extent they apply to our services.
1. Data we collect
Registration and account data
- Your name, email address, mobile number and password (stored encrypted in a way that cannot be read back).
- Your email verification status, member ID, your referral code, and your referrer if you signed up through a referral link.
- A hashed value of your IP address at sign-up, used to detect referral abuse — not the IP address itself.
Subscription and payment data
- Your current plan, subscription start and end dates, and your subscription request history.
- Transaction details: amount, currency, internal reference, the payment provider’s transaction ID and status (successful, failed, refunded) and the related dates.
- A bank transfer receipt, if you choose that method when it is available; it is stored in private storage that is not publicly accessible.
- We do not collect or store your card details. Card details are entered in the payment form of our payment provider, nowpayments, and processed directly by them.
Points and referral data
- Your points balance, point batches and their expiry dates, and your transaction history (earned, used, transferred and expired).
- Transfers between members, including the recipient and any optional note you write.
- Referral relationships between members, and the flags the system records when abuse is suspected.
Usage data on the platform
- The watchlists and alerts you create, your notification preferences, and the notifications sent to you.
- Support requests and the messages exchanged in them.
Technical data
- Page visit logs: a random visitor ID stored in a cookie, a hashed IP address, the page path, the browser type and your user ID if you are logged in. We use these for internal statistics on how the site is used.
- Session data: IP address, browser type and time of last activity, to run and protect logins.
2. Purposes of processing and legal bases
| Purpose | Data | Legal basis |
|---|---|---|
| Creating your account and providing the services and plans | Account and subscription data | Performance of our agreement with you (these terms) |
| Processing payments, activating subscriptions and refunds | Subscription and payment data | Performance of the agreement, and legal obligations |
| Running the points, referral and transfer program | Points and referral data | Performance of the agreement |
| Protecting accounts and preventing fraud and abuse | Technical data, hashed IP address and transaction history | Legitimate interest in protecting the platform and its members |
| Alerts and notifications you request, and service messages (email verification, password, subscription, points) | Email address and notification preferences | Performance of the agreement |
| Responding to support requests and complaints | Account data and support messages | Performance of the agreement, and legitimate interest |
| Internal usage statistics and site improvement | Page visit logs | Legitimate interest |
| Compliance with laws and requests from competent authorities | As required by the request | Legal obligation |
We do not use your data for third-party marketing, and we do not sell it.
3. Cookies
We use a small number of our own cookies:
| Cookie | Purpose | Duration |
|---|---|---|
| Session cookie | Running the site and logging in | Expires after a short period of inactivity |
| XSRF-TOKEN | Protection against request forgery | Session |
| “Remember me” cookie | Keeping you logged in if you choose | Until you log out |
| tc_ref | Remembering the referral link you opened until you sign up | 30 days |
| tc_locale | Remembering your chosen site language (Arabic or English) | 1 year |
| visitor_id | A random ID for internal visit statistics | Up to 5 years |
These cookies are encrypted, and we do not use third-party analytics or advertising tools. We also store simple preferences in your browser (Local Storage), such as light or dark mode. You can delete or block cookies in your browser settings; note that blocking session cookies prevents logging in.
4. Third parties and service providers
We share data only to the extent necessary with:
- Our payment provider, Moyasar: for online payments, Moyasar processes card details directly, and we send it the amount, internal reference, user ID and plan ID to link the transaction to your account.
- Our hosting provider: the site and database are stored on its servers.
- Our email provider: to send service messages and alerts to your inbox.
- Services your browser loads directly: Google Fonts on all pages, the Binance platform for streaming live crypto prices on some pages, and the Moyasar form on the payment page. These services receive technical data such as your IP address and browser type when they load.
- Competent authorities: where there is a legal obligation or an official request.
We do not send your personal data to market data providers; our requests to them are limited to price data.
5. Transfers outside the gulf
Some of the service providers listed above are located outside the gulf, such as Google Fonts and Binance, and other providers’ servers may also be located outside it. Only what is necessary to provide the service is transferred to them, and we observe the legal controls on transferring data outside the Kingdom.
6. Data protection
We take reasonable organizational and technical measures to protect your data, including encrypted connections (HTTPS), encrypted password storage, restricting admin panel access to defined staff permissions with activity logging, storing transfer receipts in private storage, and verifying every payment with the payment provider before activating a subscription. However, no method of transmission or storage is completely secure. If a breach affecting your data occurs, we will handle it and report it as required by law.
7. Retention and destruction
- Account data: kept for as long as your account exists.
- Payment and subscription records: kept for the period required by law and by accounting and regulatory obligations, and to evidence transactions and handle disputes.
- Points history: an unalterable accounting record kept for audit and anti-fraud purposes; it may remain after an account is deleted.
- Technical data and visit logs: kept for as long as needed for statistics and security.
When data is no longer needed for its purpose, or when you ask us to delete your account, we destroy the data or make it no longer linked to you, except for data we are legally required to keep, which we keep only for the required period.
8. Your rights
Under the Personal Data Protection Law, you have the right to:
- Be informed of how your data is collected and processed and why — as explained in this policy.
- Access your data and obtain a copy of it.
- Correct inaccurate or incomplete data. You can edit your name, email and mobile number on the Profile page.
- Request destruction of data that is no longer needed, subject to what must be kept by law.
- Withdraw consent where consent is the legal basis for processing.
9. How to exercise your rights or complain
Send your request from your registered email address to info@pf41.com, or through Support Requests in your account. We may ask you to verify your identity before acting on the request, and we will respond within the statutory period. If you are not satisfied with our response, you may file a complaint with the competent personal data protection authority in the Kingdom, the Saudi Data and Artificial Intelligence Authority (SDAIA).
10. Updates to this policy
We may update this policy when our services or the law change. We will publish the updated version here with the date of the last update, and we will notify you of material changes through the site or by email.