1. Who is responsible for your data
Yusr Al-Tawasul Co. (شركة يسر التواصل) (Commercial Registration 7055065648, registered office Eastern Province, Kingdom of Saudi Arabia) operates Yassir and is the controller of the personal data described in this policy. For anything concerning your data, write to privacy@yassir.dev.
This policy is made available before any personal data is collected, as the Saudi Personal Data Protection Law (PDPL) and its Implementing Regulations require. It covers the Yassir website and applications and every account type on them.
Yassir does not knowingly collect data from anyone under 18. Under-18s may not hold accounts, and we delete any account we discover to belong to a minor.
2. What we collect, and why
We collect only what the platform needs to run. We do not buy data about you, enrich your profile from third-party sources, or collect anything "for later".
2.1 Everyone with an account
| Data | Why we collect it | Legal basis |
|---|---|---|
| Name (English; Arabic as well for mentors) | Identifying you to the person you meet; showing the right name on each language version | Contract |
| Email address | Sign-in, booking confirmations, security notices | Contract |
| Password | Stored only as a bcrypt hash — we cannot read it | Contract |
| Account role, locale, timezone, theme | Showing you the right interface at the right times | Legitimate interest |
| Bookings: session type, time, price, status, cancellations, check-in timestamps | Running sessions and applying the cancellation and refund rules exactly as published |
2.2 Mentees
| Data | Why | Legal basis |
|---|---|---|
| Session briefs: talking points, goals, concerns | Shared with your mentor so the hour is useful | Contract |
| Attachments you upload (e.g. CV, portfolio) | Shared with your mentor for the session | Contract |
| Private journal notes and personal checklists | Your own workspace on Your Journey | Contract |
Journal notes and checklists are never visible to mentors, other users, or staff in the ordinary course, and are never used for any other purpose.
2.3 Mentors
| Data | Why | Legal basis |
|---|---|---|
| Headline, biography, employer, role, years of experience, specialties (both languages) | Your public profile | Contract |
| Credential links and verification documents | Our verification review | Contract / legitimate interest |
| Payout account (held by our payment provider, not by us) | Paying your earnings | Contract |
| Commission records, earnings, payout history | Accounting to you and to the tax authorities | Contract / legal obligation |
2.4 Payment data
Card details are entered directly into our payment provider's systems. Yassir never receives or stores full card numbers, CVVs, or expiry dates. We hold only the transaction record: amount, currency, status, and refunds.
2.5 Collected automatically
Standard server logs: IP address, browser type, pages requested, timestamps. Used for security, abuse prevention, and diagnosing faults; retained 90 days. We run no analytics scripts, no advertising pixels, and no session recording — see the Cookie Policy.
2.6 Automated decisions
One process on Yassir is automated in a way that affects you financially: the platform measures the session time actually delivered — from recorded check-ins, check-outs, and room presence — and automatically records a session that ran short, or a no-show, and issues the corresponding refund (see the Cancellation & Refund Policy). Every automated outcome can be contested through the Complaints process, where a human reviews it and can reverse it in either direction.
3. Where your data lives
Our database is hosted by Neon on AWS infrastructure in London, United Kingdom; transactional email is sent through Resend and the application is hosted on Vercel (both US companies). Personal data is therefore stored and processed outside the Kingdom of Saudi Arabia.
We rely on the PDPL's cross-border transfer provisions, and each processor is bound by a data-processing agreement covering purpose, data categories, duration, confidentiality, breach notification, and subprocessors. If you object to cross-border processing, your remedy is to close your account and request deletion (§7); we cannot run the service without these processors.
4. How long we keep it
| Data | Kept until | Why that long |
|---|---|---|
| Account and profile | Account deletion, plus up to 30 days of winding down | Undo window; abuse prevention |
| Bookings, payments, refunds, invoices | 10 years | Commercial and tax record-keeping obligations |
| Session briefs and attachments | 12 months after the session | Long enough for disputes; then no reason to hold a CV |
| Private journal notes and checklists | The moment you delete them or your account | They are yours |
| Ratings and reviews | Life of the rated profile |
When a retention period ends, data is deleted or irreversibly anonymised.
5. Who sees your data
- The other party to your session. A mentor sees the brief and attachments the mentee shared for that booking; each party sees the other's name and relevant profile details. Mentors are contractually bound to use mentee information only to deliver the session.
- Our processors (§3) — each only what it needs.
- Authorities, where Saudi law requires disclosure, and courts where a claim requires it.
- In a corporate transaction (merger, acquisition), data transfers with the business, on notice to you and under this policy's protections.
- Nobody else. We do not sell personal data, share it with advertisers or data brokers, or use it to train third-party AI models.
6. Your rights, and exactly how to use them
Under the PDPL you may ask us to:
- Access — confirm what we hold about you and give you a copy;
- Correct — fix inaccurate or incomplete data;
- Delete — erase your data, subject to the legal retention periods in §4, which we will identify specifically if we rely on them;
- Withdraw consent — for anything that relies on consent, with effect from withdrawal;
- Restrict — pause a contested processing activity while we review it.
Procedure: email privacy@yassir.dev from the address on your account (or provide equivalent proof of identity — we verify before releasing anything). We acknowledge within 3 business days and answer within 30 days; if a request is complex we tell you why and when. Exercising these rights is free. If you are unsatisfied, you may complain to the Saudi Data & Artificial Intelligence Authority (SDAIA) as competent authority; we'll tell you in our response how to do that.
7. Deleting your account
You may close your account at any time. Confirmed future sessions are handled under the Cancellation policy first. On deletion: profile and account data are removed within 30 days; data under a §4 retention obligation is kept for that period only and only for that purpose; reviews you left may remain in anonymised form so other users' rating histories stay truthful.
8. How we protect it
- Passwords stored only as bcrypt hashes; we cannot read them.
- TLS encryption on every connection; database encryption at rest.
- Attachments stored outside the public web root, with access checked against the booking's participants on every request.
- Production access restricted to those who need it, and logged.
- No card data on our systems at all (§2.4).
No system is invulnerable. If a breach occurs that creates real risk to you, we will notify SDAIA and affected users as the PDPL requires, saying what happened, what data was involved, and what we are doing about it.
9. Marketing
We send transactional email only: bookings, cancellations, reminders, receipts, security notices, and legally required notices. We do not send marketing email and will not add it without a separate, opt-in consent that you can withdraw in one click.
10. Changes
Material changes are announced by email or a prominent site notice at least 14 business days before taking effect; the version number above changes with them. Continuing to use Yassir after the effective date means the new version applies; if you disagree with a change, close your account before it takes effect.