Privacy Policy

Last updated August 2026

01 Who we are

Varafai is developed and operated by FAIZGEN LLC, a company registered in the Kingdom of Saudi Arabia. Tirs Labs is the developer brand under which FAIZGEN LLC publishes digital products, including Varafai. Tirs is the umbrella brand and website for Tirs Labs products. For any privacy-related question or request, contact us at info@tirs.app.

02 Information we collect

Depending on the product and features you use, we may collect account and authentication information (including identifiers provided through supported sign-in methods such as Sign in with Apple or Google Sign-In), the URLs or QR code destinations you submit for analysis, the resulting scan and security-analysis results, subscription status, device and app diagnostics, and information you voluntarily send to support.

03 Legal basis for processing

We process personal data only where we have a valid legal basis to do so under the Kingdom's Personal Data Protection Law (PDPL). Depending on the purpose, this basis is one of the following:
Contractual necessity — processing needed to provide the Service you request, such as running a scan and returning a result.
Legitimate interest — processing needed for our legitimate interests, such as preventing fraud and abuse and improving the accuracy of our detection systems, provided this does not override your rights.
Consent — processing based on your consent for optional features, such as marketing communications, which you may withdraw at any time.
Legal obligation — processing needed to comply with a legal obligation, such as responding to a valid regulatory or law-enforcement request.

04 Third-party service providers

We work with carefully selected service providers that support functions such as authentication (for example, Sign in with Apple and Google Sign-In), hosting and infrastructure, threat-intelligence and security analysis used to generate scan results, subscription and payment processing through Apple's App Store, and diagnostics. We disclose to each provider only the information reasonably necessary for it to perform that function. We select service providers that provide appropriate privacy and security safeguards and, where they process personal data on our behalf, require them to process it only for the agreed purposes and in accordance with applicable data-protection requirements. Some third-party services maintain their own privacy notices, which we encourage you to review.

05 Cross-border data transfer

Personal data may be processed by service providers located outside the Kingdom of Saudi Arabia where necessary to provide the Service. Any such transfer is made subject to appropriate contractual and technical safeguards in line with PDPL requirements.

06 Retention and security

We retain personal data only for as long as reasonably necessary to provide and secure the Service, comply with applicable legal obligations, prevent fraud or abuse, and resolve disputes. When an account deletion request is completed, associated personal data is deleted or anonymized unless retention is required or permitted for legal, security, fraud-prevention, financial, or compliance purposes. We apply technical and organizational safeguards designed to protect information, but no system can guarantee absolute security.

07 Deletion and your rights

You may request or initiate deletion of your Varafai account using the account deletion functionality provided in the app, where available. You may also contact us to request deletion of your personal data. Subject to the conditions set out in the PDPL, you also have the right to: be informed about how your personal data is processed; access the personal data we hold about you; request correction of inaccurate data; request deletion of your data; receive your data in a portable format; withdraw consent where processing is based on consent; object to processing carried out on the basis of legitimate interest; and lodge a complaint with the Saudi Data & Artificial Intelligence Authority (SDAIA). We aim to respond to any request within 30 days. To exercise any of these rights, contact us at info@tirs.app.

08 Minors

If you are a minor under applicable law, you should use the Service only with the consent or authorization of a parent or legal guardian where required. We do not knowingly collect personal data from a minor without such consent where required, and if we become aware that we have done so, we will take steps to delete it.

09 Changes to this policy

We may update this policy as our products, legal obligations, or service providers change. Where a change is material, we will provide at least 30 days' advance notice — through an in-app notice or email — before it takes effect. The updated version will be posted on this page.

10 Contact

Email: info@tirs.app
Website: tirs.app