Privacy Policy

Effective Date: 7 September 2026

Petroly ("we", "us", or "our") operates the Petroly mobile application and related services (the "Service") in the Kingdom of Saudi Arabia. This Privacy Policy explains what personal data we collect, how we use and protect it, and the rights you have. By creating an account or using the Service, you agree to the practices described here. We process personal data in accordance with the Personal Data Protection Law (PDPL) of the Kingdom of Saudi Arabia and its Implementing Regulations.

1. Who We Are

Petroly is the data controller responsible for the personal data processed through the Service. If you have questions about this policy or your data, contact us using the details in the "Contact Us" section below.

2. Information We Collect

We collect only the data needed to provide the Service:

• Account information: your name, mobile number, email address, and, for business accounts, company and vehicle/fleet details.
• Verification data: a one-time password (OTP) sent to your mobile number or email to verify your identity and secure your account.
• Transaction and wallet data: your fuel and wallet transactions, charge requests, uploaded payment receipts, balances, and reference numbers.
• Payment data: payments are processed by our licensed payment partners (including NearPay and bank payment gateways). We do not collect or store full card numbers or CVV codes; we retain only a payment status and a masked reference needed to reconcile your transaction.
• Location data: with your permission, your device location to show nearby stations and provide navigation. You can disable this at any time in your device settings.
• Device and usage data: device model, operating system, app version, log data, and how you interact with the app, used for security and to improve the Service.

3. How We Use Your Information

• Create and manage your account and verify your identity.
• Process fuel purchases, wallet top-ups, charge requests, and refunds.
• Show station locations, pricing, and navigation.
• Send service messages such as OTPs, receipts, and transaction and account notifications.
• Prevent, detect, and investigate fraud, abuse, and security incidents.
• Comply with legal, tax, and regulatory obligations.
• Improve the reliability, performance, and features of the Service.

4. Legal Basis for Processing

We process your personal data where it is necessary to perform our contract with you (providing the Service), to comply with a legal obligation, to protect legitimate interests such as security and fraud prevention, or based on your consent (for example, location access and marketing messages). You may withdraw consent at any time.

5. Sharing Your Information

We do not sell or rent your personal data. We share it only when necessary and with appropriate safeguards, including:

• Payment processors and banks to complete and reconcile your transactions.
• Service providers (such as hosting, SMS/email delivery, and analytics) acting on our instructions and bound by confidentiality obligations.
• Fuel stations and fleet administrators only to the extent required to fulfil a transaction or manage a business/fleet account you belong to.
• Authorities where required by applicable law or a valid legal request.

6. Data Retention

We keep personal data only for as long as needed to provide the Service and to meet our legal, accounting, and regulatory obligations. Transaction and financial records may be retained for the period required by Saudi law. When data is no longer required, we securely delete or anonymize it.

7. How We Protect Your Information

We apply administrative, technical, and physical safeguards to protect your data, including encryption in transit (HTTPS/TLS), access controls, and secured servers. No method of transmission or storage is completely secure, but we work continuously to protect your information and to respond promptly to any incident.

8. Your Rights

Subject to applicable law, you have the right to:

• Access the personal data we hold about you and obtain a copy of it.
• Correct inaccurate or incomplete data.
• Request deletion of your data, subject to legal retention requirements.
• Withdraw consent (for example, disable location access or opt out of marketing).
• Object to or restrict certain processing.

To exercise any of these rights, contact us using the details below. We will respond within the period required by applicable law.

9. Account & Data Deletion

You can request deletion of your account and associated personal data at any time from within the app (Profile → Delete Account) or by emailing us at support@petroly.com from your registered email address. Once verified, we will delete your account and personal data, except records we are required to retain by law (such as financial transaction records), which we will keep only for the legally required period and then delete.

10. Children's Privacy

The Service is not directed to individuals under the age of 18, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so we can remove it.

11. International Processing

Your data is processed within the Kingdom of Saudi Arabia. Where any processing or transfer outside the Kingdom is necessary, we do so only in accordance with the PDPL and with appropriate safeguards in place.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Effective Date" above and, where appropriate, notify you within the app. Your continued use of the Service after an update means you accept the revised policy.

13. Contact Us