Privacy Policy

1Information We Collect

Account Registration Data

When you create an account, we collect your name, email address, phone number, password (stored in hashed/encrypted form — never in plain text), and preferred language (English or Arabic).

A unique user ID is also generated automatically (e.g., prefixed with your phone number).

Login Data

You may log in using your email or phone number and password, or via Google Sign-In (OAuth 2.0). When you use Google Sign-In, we receive your name, email address, and Google profile information from Google. We do not receive your Google password.

Appointment and Booking Data

When booking an appointment — including as a guest (no account required) — we collect your first and last name, phone number, email address (optional), appointment type (DAR Crew or Book Measurement), preferred date and time, address (optional), and any remarks or project details you provide.

Design and Project Data

When using our design and measurement services, we collect design configurations, room measurements, selected items and materials, and project notes or comments.

Payment Data

Payment processing is handled entirely by Tap Payments. We receive and store only the payment status (e.g., CAPTURED, DECLINED) and a transaction/charge ID. We do not store card numbers, CVVs, or full payment credentials. Your phone and email may be passed to Tap for payment receipts and SMS notifications.

Technical and Usage Data

We automatically collect certain technical data including your IP address, device type, operating system, browser type, and pages visited. An authentication session token (JWT) is stored in an HTTP-only cookie for security. Your language preference is also stored in a cookie.

2How We Use Your Information

• Create and manage your user account
• Process and confirm appointments and bookings
• Deliver design, measurement, and quotation services
• Process payments and send payment links via SMS
• Send appointment confirmation, status updates, and reminders via SMS or email
• Personalise your language and experience preferences
• Authenticate your identity and maintain secure sessions
• Improve, secure, and maintain our Services
• Respond to inquiries, support requests, and complaints
• Comply with applicable legal and regulatory obligations

3Google Sign-In

Our login page offers sign-in via Google OAuth 2.0. By choosing this option, you authorise Google to share your basic profile information (name and email) with us to create or access your account. We do not receive your Google password. Your use of Google Sign-In is also subject to Google's Privacy Policy.

4Third-Party Services

We work with the following third parties who may receive or process your data:

5SMS Communications

We use your phone number to send appointment confirmations, status updates, and payment links via SMS. You agree to receive these operational messages by providing your phone number during booking or account registration. These are not marketing messages — they are necessary for service delivery.

6Cookies and Local Storage

You can manage or delete cookies in your browser settings. Disabling the authentication cookie will log you out.

7Data Storage and Security

All data is transmitted over HTTPS. Authentication is managed with JWT tokens stored in HTTP-only, Secure, SameSite cookies to prevent cross-site attacks. Passwords are stored using industry-standard hashing. We take reasonable technical and organisational measures to protect your information from unauthorised access, disclosure, or loss.

No method of transmission or storage is 100% secure. If you have reason to believe your data has been compromised, please contact us immediately.

8Data Retention

We retain your data for as long as your account is active or as required to provide Services. Appointment and design data may be retained for legal, financial, and operational purposes. Technical log data is retained for a limited period for security purposes. You may request deletion of your data at any time (see Section 9).

9Your Rights and Account Deletion

We process your personal data in line with the Data Privacy Protection Regulation issued by Kuwait's Communication and Information Technology Regulatory Authority (CITRA) and the Electronic Transactions Law No. 20 of 2014. You have the right to:

• Access the personal data we hold about you
• Correct inaccurate or outdated information
• Delete your account and associated personal data
• Object to or restrict certain types of processing
• Data portability — receive a copy of your data in a structured format

To request account deletion or exercise any of the above rights, please contact us at info@dar-kuwait.com. We will process your request within a reasonable timeframe and confirm when it is complete.

Note: Some data (such as completed transaction records) may be retained for legal or financial compliance even after account deletion.

10Children's Privacy

Our Services are not directed to children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us and we will delete it promptly.

11Permissions Used by the Mobile App

The Dar Android and iOS applications may request the following device permissions:

• Internet access — Required to communicate with our servers.

We do not request access to your camera, microphone, precise location (GPS), contacts, or storage beyond what is necessary for the core Service. Any permission requests will be explained in-app at the time they are requested.

12Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top. For significant changes, we may notify you via the app or by email. Continued use of our Services after changes constitutes acceptance of the updated policy.

13Contact Us

For questions, requests, or concerns about this Privacy Policy or your personal data:

14Governing Law

This Privacy Policy is governed by the laws of the State of Kuwait — including the Electronic Transactions Law No. 20 of 2014, the Consumer Protection Law No. 39 of 2014, and CITRA's Data Privacy Protection Regulation. Any disputes will be resolved in the competent courts of Kuwait. See also our Terms & Conditions.