Privacy Policy

Supermile is a Saudi-based intelligent last-mile operating platform that runs delivery operations through two core products: Enginizer, a demand-aggregation engine serving restaurants, retailers, and e-commerce; and Ostooly, a planning and operations tool for fleet operators and delivery service providers.

In this policy, "Supermile," "we," "us," and "our" refer to the entity operating the platform, which is responsible for the personal data collected through our website and products as described below. By using our website or any of our products or services, you acknowledge that you have read this policy and understand how we process your personal data.

Given Supermile's nature as a two-sided marketplace, we act in two distinct capacities depending on the data involved, consistent with the PDPL and its regulations:

When we act as a processor, the partner entity (the merchant or delivery company) remains the controller of that data, and we process it only as necessary to deliver the service and under a data-processing agreement that sets out the relevant obligations.

By "personal data" we mean any data that could identify a specific individual directly or indirectly. We collect the following categories:

a. Data you provide to us directly

• ●Account & identity data: name, email, phone number, job title, company name.
• ●Business & compliance data: commercial registration, tax number, branch addresses, and qualification documents required from delivery companies where applicable.
• ●Financial data: bank name, IBAN, and billing details, as needed to complete transactions and settlements.
• ●Integration & credentials: system integration keys, sales channels, and points of sale linked to your account.
• ●Your communications: what you send us via contact, support, or survey forms.

b. Data we process on behalf of our partners (as a processor)

• ●Order & recipient data: recipient names, delivery addresses, phone numbers, and order details received from partner platforms to fulfill deliveries.
• ●Driver data: operational identifiers, task data, and locations, managed inside Ostooly to serve the delivery company.

c. Data collected automatically

• ●Log & device data: IP address, browser type, operating system, date and time, and pages browsed.
• ●Cookies and similar technologies: as described in Section 5.
• ●Location data: we may collect precise or approximate location data to support delivery and tracking services, where you grant permission through your device settings.

d. Data from public platforms

• ●Publicly available information when you interact with our content on social media platforms.

We process your personal data on a clear, documented legal basis, for specified purposes, and in line with the data-minimization principle:

• ●Service delivery: creating and managing accounts, processing transactions and settlements, and operating Enginizer and Ostooly.
• ●Support & communication: responding to your inquiries and support requests and sending operational notifications.
• ●Improvement & analytics: understanding platform usage, improving performance, and developing features.
• ●Marketing: sending relevant marketing materials and offers, only after your explicit consent, with the ability to unsubscribe at any time.
• ●Security & fraud prevention: protecting the platform and detecting unlawful activity.
• ●Legal compliance: meeting statutory and regulatory obligations and disclosures required by law.

Supermile uses cookies and similar technologies to improve your experience, analyze site performance, and remember your preferences. The types of cookies we may use include:

• ●Essential cookies: necessary for the site to function, for login, and for core features; these cannot be disabled.
• ●Performance & analytics cookies: to measure traffic and understand how the site is used.
• ●Preference cookies: to remember your settings, such as language.
• ●Marketing cookies: to measure campaign effectiveness and personalize content; these are enabled with your consent.

We may share your data with other parties as needed and solely for the purposes of this policy, as follows:

• ●Delivery & integration partners: we share the data necessary to fulfill orders and operate the service with our delivery-company partners, order platforms, e-commerce platforms, and merchants, to the extent needed to complete delivery and provide the service.
• ●Service providers & sub-processors: parties that provide us with services such as hosting, data storage, billing, analytics, payment processing, and support. They may not use your data for any purpose other than those we assign.
• ●Legal compliance: we may disclose your data at the request of competent authorities, under legal process, or to protect our rights and those of our users.
• ●Business transactions: in the event of a merger, acquisition, or asset transfer, data may be transferred to the relevant party, which will be bound to protect your privacy consistent with this policy and the law.

We may aggregate data or convert it into an anonymized form so that it can no longer identify you or be linked to you or your device. Such data is not considered personal data.

We may use this aggregated and anonymized data for any legitimate purpose, including research, analytics, service improvement, marketing, and reporting on usage trends, and we may share it with other parties such as partners, advertisers, and promotional partners.

Your data may be stored or processed by service providers, some of whom are located outside the Kingdom of Saudi Arabia. When transferring data outside the Kingdom, we apply the safeguards required under the PDPL and its cross-border transfer controls, including necessary contractual clauses, to ensure your data receives an adequate level of protection.

We retain your personal data only for as long as necessary to fulfill the purposes set out in this policy, unless a longer retention period is required by law or by regulatory or contractual requirements. When the data is no longer needed, we securely destroy it or convert it to an anonymized form.

We apply appropriate technical, organizational, and administrative measures to protect your data from loss, misuse, or unauthorized access, disclosure, or alteration, including encryption, access controls, firewalls, and internal policies. In the event of a data breach, we will notify affected parties and regulators as required by law.

The PDPL guarantees you the following rights regarding your personal data:

• ●Right to be informed: to know the legal basis and purpose for collecting your data.
• ●Right of access: to request access to the data we hold about you and obtain a copy of it.
• ●Right to rectification: to request correction or completion of inaccurate data.
• ●Right to erasure: to request destruction of your data in accordance with legal controls.
• ●Right to withdraw consent: at any time, without affecting the lawfulness of prior processing.
• ●Right to object & restrict processing: in the cases permitted by law.

To exercise any of these rights, contact us using the details in the final section. You also have the right to lodge a complaint with the Saudi Data & AI Authority (SDAIA) as the supervisory authority.

Supermile's services are directed at businesses and professional users, and we do not intend to collect personal data from children. If you believe a child has provided us with their data, please contact us so we can take appropriate action.

Our website may contain links to third-party websites or services. The presence of these links does not imply our endorsement, and we are not responsible for their privacy practices. We encourage you to review the privacy policies of those parties.

We may update this policy from time to time to reflect changes in laws, our practices, or our services. The amended version becomes effective upon posting on the website, with the "Last updated" date above revised accordingly. We encourage you to review it regularly, and we will provide adequate notice of any material change as required by law.