Privacy Policy — Thibrh

Who we are

Thibrh, the property and operations platform, is operated by Thibrh Company, a single-person limited liability company, Unified National Number 7054689513. It is responsible for the processing described on this page. Privacy contact: info@thibrh.com.

What we collect

You can browse the site without an account. When you visit or use the platform:

• Server logs. For each request the server records your device’s IP address, the request type and the page requested (without search text), the time, and a random request ID. We use them to run and protect the site, limit request rates and trace faults. We keep them for the period our hosting provider sets for its logs, currently seven days under our plan there.
• Sign-in with a WhatsApp message. You sign in by sending a one-time code to Thibrh’s WhatsApp number, +966532830138; the site prepares the message and you press send yourself, and the attempt is valid for five minutes. When the message arrives we receive from Meta, as the messaging provider (WhatsApp Business Platform), the sender’s phone number and the message. We use the number and the code to verify you and to create or open your account. We store the number encrypted (AES-256-GCM) with a keyed lookup hash so we can recognise it when you sign in again, and we do not store the message text or your WhatsApp profile name or photo. We do not send you WhatsApp messages. The message on WhatsApp itself is subject to WhatsApp’s terms and privacy policy.
• Your account data. On first sign-in we create an account under the generic name “Thibrh member”. What you then enter yourself, such as service requests, join applications, complaints, reviews and community posts, is stored in your account to provide the service. Do not enter anything you do not want to share. We may suspend an account for misuse or breach of platform rules, and no session is issued to a suspended account.
• Storage in your browser. We store on your device, not on our servers, your language preference and any service request draft you start, so it is not lost if you reopen the page; the draft does not reach us unless you sign in and submit it, and it is removed from your device after submission. During a sign-in attempt a one-time secret is kept in the browser tab’s session storage and disappears when the tab is closed. You can delete all of this by clearing this site’s data in your browser.
• Assistant. Text you type into the assistant is sent to our server to be analysed and answered, and is not stored. Please do not enter ID numbers, phone numbers or other personal data.

Cookies

We use no analytics or advertising cookies and load no third-party tracking tools; the site’s content security policy limits sources and connections to the site itself. The only cookie the site sets is the session cookie thibrh_session, created only after sign-in. It keeps you signed in, cannot be read by page scripts (HttpOnly), is not sent with requests coming from other sites (SameSite=Strict), is limited to encrypted connections in production (Secure), and lasts seven days or until you sign out.

Who we share data with

We do not sell your data or share it for marketing. Two providers process it on our behalf: Render, our hosting and database provider, and Meta, the messaging provider the sign-in message passes through. We may disclose data where a law or a competent authority requires.

Where data is processed and stored

The site’s servers and database are in a data centre outside Saudi Arabia (Frankfurt, Germany). Private files uploaded by users are currently kept in private storage on the application server itself; if we move to another storage provider we will update this policy first. We comply with the transfer provisions of the Personal Data Protection Law when data is transferred outside the Kingdom.

How long we keep data

We keep data for as long as its purpose requires and destroy what is no longer needed, unless a law requires it to be kept or a case is pending.

Your rights

You may ask how we process your data, request access to it, a copy in a clear format, correction or update, and destruction of data no longer needed, subject to the Personal Data Protection Law, its regulations and their exceptions. We verify the requester’s identity before acting, and reply within 30 days of receiving the request; the period may be extended by a further equal period where necessary, and we will tell you the reason. Send requests to info@thibrh.com. You may also complain to the authority competent to apply the law.

Security

Connections to the site are encrypted, phone numbers are stored encrypted, session cookies and authorisation data are masked in logs, and access to data is limited to those who need it for their work.

Changes

Any change is published on this page with its date, and we update it before enabling any new feature that collects data or uses a new provider.