Privacy Policy
Effective date: 3 August 2026 · Last updated: 3 August 2026
Applies to the AlRayah Driving School mobile app (Android package qa.rds.app and the same app on iOS) and the services it connects to.
1. Who we are
AlRayah Driving School (“AlRayah”, “we”, “us”) is a licensed driving school in Qatar. We are the data controller for the personal information described in this policy.
| Address | Umm Salal Ali, Doha, Qatar |
|---|---|
| info@rds.qa | |
| Phone | +974 44999949 |
If you have any question about this policy or about your personal information, contact us using the details above. We answer privacy requests within 30 days.
2. Scope
This policy covers the AlRayah mobile app used by trainees, instructors and school administrators. It explains what the app collects, why, who it is shared with, how long it is kept, and the choices you have.
It does not cover the separate websites or systems of third parties we link to, such as your bank, Google Wallet or Apple Wallet. Those are governed by their own policies.
3. What we collect and why
We only collect what the school actually needs to enrol you, train you, present you for testing, take payment and support you. We do not collect anything to build advertising or marketing profiles.
3.1 Identity and enrolment data
| Data | Where it comes from | Why we need it |
|---|---|---|
| Full name (Arabic and English), Qatar ID (QID) number, date of birth, nationality, profession, ID expiry date | Scanned from your Qatar ID, then shown to you for correction before submission | Legal requirement to verify the identity of every trainee and to register you with the traffic authority |
| Photographs of the front and back of your Qatar ID | Camera capture inside the app | Identity verification and enrolment file |
| A selfie photograph | Camera capture inside the app | To confirm the person enrolling is the ID holder, and for your trainee record and licence card |
| Foreign driving licence image (if you are exchanging a licence) | You upload it | Licence exchange procedure |
| Eye test certificate image | You upload it | Mandatory medical fitness evidence |
| Mobile phone number | You enter it at sign-in | To send your one-time sign-in code and service notifications |
| Email address | You enter it at payment time only | To send your payment receipt |
3.2 Training and account data
Course and package enrolled in, lesson bookings and attendance, instructor assigned, evaluation results and scores, theory and practical test dates and outcomes, progress stage, invoices, receipts, payment history and outstanding balance, support tickets and complaints you submit (including any file you attach), and messages you exchange with the in-app assistant.
3.3 Device and technical data
| Data | Detail |
|---|---|
| Device identifier | A random identifier the app generates on first install and stores on your device. It is not your IMEI, serial number, MAC address or advertising ID, and it cannot be linked to you outside our service. It exists so we can secure your session and recognise trusted devices. |
| Push notification token | Issued by Google Firebase Cloud Messaging so we can deliver notifications. Deleted when you sign out. |
| App version, platform and language | For compatibility and to send you notifications in the right language. |
| Sign-in security signals | Times of sign-in, refresh and failed attempts, used to detect account takeover and abuse. |
| Diagnostic and crash reports | If the app encounters an error, it may send us the error message, the technical stack trace, the screen you were on, the app version and a short trail of the actions leading up to it. These go only to our own servers. They are not sent to any analytics company. |
| Anti-abuse signals | When you request a sign-in code, Cloudflare Turnstile runs a silent check on the device and network characteristics of the request to confirm you are not an automated script. |
3.4 What we do not collect
- We do not collect your location. The app requests no location permission and contains no location tracking of any kind.
- We do not use advertising identifiers, and we do not serve advertising.
- We do not use third-party analytics or tracking SDKs. There is no Google Analytics, no Firebase Analytics, no Crashlytics, no Sentry, no Meta SDK and no advertising network in this app.
- We do not track you across other companies’ apps or websites.
- We do not read your contacts, call log, SMS messages, calendar, microphone or files beyond a document you deliberately choose to upload.
- We never sell your personal information, and we never share it for advertising.
4. Device permissions the app asks for
| Permission | Used for | If you refuse |
|---|---|---|
| Camera | Scanning your Qatar ID, taking the enrolment selfie, and scanning attendance QR codes | You can still use the app, but you must complete enrolment at the school in person |
| Photos / files | Only when you choose to attach an existing document — eye test, licence, support evidence | You can take a new photo instead |
| Notifications | Lesson reminders, schedule changes, payment confirmations and attendance alerts | The app works, but you will miss reminders |
| Face ID / fingerprint | Optional faster sign-in (see section 5) | Sign in with your phone number and one-time code as normal |
You can withdraw any of these permissions at any time in your device settings.
5. Biometrics — Face ID and fingerprint
If you turn on biometric sign-in, your device creates a cryptographic key inside its secure hardware (Android Keystore or Apple Secure Enclave). Your fingerprint or face only unlocks that key locally. The app sends us the public half of the key and a signature proving the key was unlocked. That is all. Turning the feature off removes the key from your device.
The selfie you take during enrolment is a separate thing: it is an ordinary photograph, handled as described in section 6. It is not used for face recognition or biometric matching.
6. How we handle your ID documents and photographs
Government identity documents are the most sensitive data we hold, and we treat them accordingly.
- Photographs of your Qatar ID are read by text-recognition software on our own servers to extract your name, QID number, date of birth, nationality and expiry date. You are shown every extracted field and can correct it before anything is submitted.
- Our servers may automatically crop the portrait area out of your ID photograph and your selfie so your trainee record and licence card display correctly. This is image cropping only. It is not facial recognition and it does not match your face against any database.
- During selfie capture, the app checks locally on your device that exactly one face is visible, so you do not upload an unusable photograph. This check runs entirely on your phone and no data from it is transmitted.
- Your enrolment documents are filed into the school’s main records system, which is the same system used for trainees who enrol at our office in person.
7. Payments
To create the payment, we pass QIB the billing details it requires: your name, contact details, the amount, the currency and a description of what is being paid for. We receive back only the result of the payment. We confirm every payment by asking QIB’s servers directly for the status — we never treat a return to the app as proof of payment.
We keep your invoices, receipts and payment history as accounting records.
8. The in-app assistant
The app includes an assistant that answers questions about your schedule, fees and the school’s procedures.
- Before your message is stored, we automatically strip out Qatari phone numbers, QID numbers and email addresses and replace them with
[redacted]. - Stored conversations are encrypted.
- Conversations are retained for 90 days, after which they are withdrawn and are no longer available to you or to our staff in the app.
- You can delete any conversation yourself at any time from the chat screen.
- Do not send payment card details or passwords to the assistant.
9. Who we share your information with
We share personal information only with the parties below, only to the extent each one needs it, and only to deliver the service or comply with the law.
| Recipient | What they receive | Why |
|---|---|---|
| Qatar Islamic Bank (QIB) | Name, contact and billing details, amount, payment reference | To process your card payment |
| Ooredoo Qatar | Your mobile number and the message text | To deliver your one-time sign-in code by SMS |
| Google (Firebase Cloud Messaging) | Your push token and the notification content | To deliver push notifications to your device |
| Cloudflare | Technical signals from your sign-in request | To block automated abuse of the sign-in system |
| Google Wallet / Apple Wallet | The contents of the licence pass, only if you choose to add it | To add your card to your phone’s wallet |
| The Qatari traffic and licensing authorities | Enrolment, training, examination and licensing records | Legal obligation as a licensed driving school |
| Our IT service providers | Hosting and maintenance access, under contract and confidentiality | To operate the service |
| Courts, regulators and law enforcement | Only what is legally required | When we are legally compelled |
We do not share your information with anyone else, and we never sell it.
10. Where your information is stored
Your information is held in the school’s systems and in our hosted server environment. Some of our infrastructure, and the services of Google, Cloudflare and Apple named above, may process data outside Qatar. When that happens we require those providers to protect the information to the standard described in this policy under their own contractual and data-protection commitments.
11. How long we keep your information
| Category | Retention |
|---|---|
| Assistant conversations | 90 days |
| Push notification token | Until you sign out or uninstall |
| Sign-in and session security logs | 12 months |
| Diagnostic and crash reports | 12 months |
| Enrolment records, ID documents, training, examination and licensing records | For as long as required by Qatari traffic and licensing law after your file closes |
| Invoices, receipts and accounting records | For the period required by Qatari commercial and tax law |
When a retention period ends, the information is deleted or irreversibly anonymised.
12. Your rights, and deleting your account
You may ask us to:
- access a copy of the personal information we hold about you;
- correct anything inaccurate — you can edit most of your profile in the app directly;
- delete your account (see below);
- object to or restrict a particular use;
- withdraw consent for anything you opted into, such as biometric sign-in or notifications.
To exercise any of these, email info@rds.qa or call +974 44999949. We do not charge for this and we will not treat you differently for asking.
Deleting your account
You can request deletion of your account in two ways:
- In the app: open More → Account → Delete my account, and confirm.
- On the web, without installing the app: visit https://rds.qa/delete-account and submit the form.
When you delete your account we permanently close your sign-in, revoke every device registered to you, remove your saved biometric key, delete your push tokens, and delete your assistant conversations, notification history, and your support tickets, complaints and any images you attached to them.
13. How we protect your information
- All traffic between the app and our servers is encrypted with TLS.
- Sign-in tokens and the device identifier are stored in your phone’s encrypted secure storage (Android Keystore / iOS Keychain), not in ordinary app storage.
- Sensitive stored content, including assistant conversations, is encrypted at rest.
- Administrative accounts require a second authentication factor.
- Access to trainee records is limited by role, and privileged actions are logged.
No system is perfectly secure, but we take these measures seriously and review them regularly.
14. Children
This app is intended for people who are legally eligible to hold or train for a Qatari driving licence, and is not directed at children under 18. We do not knowingly collect personal information from anyone under 18. If you believe a child has provided us with information, contact us and we will remove it.
15. Changes to this policy
If we change how we handle your information, we will update this page and change the “Last updated” date. If a change is significant, we will tell you in the app or by notification before it takes effect. The current version is always published at https://rds.qa/privacy.
16. Contact us
AlRayah Driving School
Umm Salal Ali, Doha, Qatar
Email: info@rds.qa
Phone: +974 44999949
If you are not satisfied with our response, you may complain to the competent data protection authority in Qatar.