Terms of Service (Kingdom of Saudi Arabia)

DRAFT NOTICE: These Terms of Service are a draft. They are being prepared for review by qualified legal counsel in the Kingdom of Saudi Arabia and are not yet in force. They do not create any rights or obligations until a final version is published with an effective date. Nothing in this draft is legal advice. Text in [square brackets] is a placeholder or a point still open for counsel.

1. About these terms

These Terms of Service ("Terms") are an agreement between you and [TokenNo Gulf entity legal name], a [type of entity] registered in [country of registration] under [registration number], with its registered office at [registered address] ("TokenNo", "we", "us"). [Name, Commercial Registration number and national address of any Saudi entity, branch or representative, if one is appointed.] Contact: info@tokenno.com.

They apply when you use, in the Kingdom of Saudi Arabia ("Saudi Arabia" or the "Kingdom"):

the TokenNo customer app;
the TokenNo Business app, web front desk and TV "Now Serving" board;
the website at tokenno.com; and
the TokenNo Integration API and webhooks.

Together these are the "Service".

These Terms have three parts:

Part A applies to everyone.
Part B applies to customers: people who book tokens ("hosts") and the people they invite ("guests").
Part C applies to vendors: businesses that issue tokens through TokenNo, and their staff.

Please also read our Privacy Policy for Saudi Arabia (available in the apps and on tokenno.com), which explains how we handle personal data.

By creating an account or using the Service, you agree to these Terms. You accept them electronically, which is valid under the Electronic Transactions Law, issued by Royal Decree No. M/18 dated 8/3/1428H. If you do not agree, please do not use the Service.

PART A — TERMS FOR EVERYONE

2. What TokenNo is (and is not)

TokenNo is a technology platform that helps businesses manage queues. Vendors publish their sessions and service points, customers get a token number, and everyone is told when it is their turn.

TokenNo does not provide the vendor's services. The clinic, doctor, hospital, restaurant, salon, office or event organiser you book with ("vendor") decides what service it provides and is solely responsible for it, including medical care, food, quality, safety, prices and conduct. TokenNo is not a healthcare provider and does not give medical advice. In an emergency, call 911 (unified emergency number), 997 (ambulance) or 999 (police), or go to the nearest hospital — do not rely on a TokenNo token.

TokenNo offers the Service electronically under the E-Commerce Law, issued by Royal Decree No. M/126 dated 7/11/1440H, and its Implementing Regulations. In line with that law, we show our identity and contact details in the apps and on our website, and we show the main terms, the total price and the refund rule before you confirm a paid booking. Where we collect advance payments, we do so as described in sections 15 and 23. [Counsel to confirm: how TokenNo should be classified under the E-Commerce Law (for example as an e-commerce service provider or a platform), any licence, foreign investment licence, Commercial Registration or e-commerce authentication TokenNo needs to offer the Service in the Kingdom, and the disclosures that follow.]

3. Your account

One mobile number = one identity. Your TokenNo account is linked to your mobile number, which we verify by one-time password (OTP). The same account can be used as a customer and, if a vendor adds you, as vendor staff.
You must give true information and keep your mobile number up to date. If you change or give up your number, update or delete your account, because whoever gets that number next could otherwise receive OTPs for it.
Keep your phone and OTPs secure. You are responsible for activity on your account unless it happened because of our fault.
Age. You must be at least 18 years old to create an account [counsel to confirm the minimum age and the age of full legal capacity under the laws of the Kingdom]. A parent or legal guardian may book a token for a child.

4. Acceptable use

You must not:

give false information, impersonate anyone or book tokens using someone else's mobile number without their permission;
book tokens you do not intend to use in order to block others, resell tokens, or manipulate a queue;
invite people as guests without their permission, or use the guest feature to send spam;
upload or send content that is unlawful, harmful, misleading, defamatory, obscene, contrary to public order, public morals or religious values, infringes someone's rights or privacy, or is otherwise prohibited by the laws of the Kingdom, including the Anti-Cyber Crime Law, issued by Royal Decree No. M/17 dated 8/3/1428H;
upload medical records or other health details into TokenNo (the Service does not currently support them);
interfere with or try to break the Service, its security or other users' accounts, including by scraping, reverse engineering (except as allowed by law), or overloading our systems; or
use the Service in breach of any law of the Kingdom.

We may remove content, cancel tokens obtained through misuse, or suspend or close accounts that break these rules (see sections 19 and 29).

5. Messages

To run your token, we send service messages by push notification, SMS and WhatsApp (booking confirmations, call alerts, token number changes, cancellations, refunds and "booking is now open" alerts you asked for). SMS messages are sent through licensed providers using sender names registered in line with the rules of the Communications, Space and Technology Commission (CST), and in line with CST rules on unsolicited and promotional messages [counsel to confirm the current CST requirements]. We do not send marketing messages without your consent. Message delivery depends on telecom operators, Meta (WhatsApp), Google and Apple, so we cannot guarantee that every message arrives on time.

6. Language and translation

You can use the Service in the language you choose. Vendor content (such as business and room names) is written by the vendor in one language and may be shown to you in an automatic translation. Translations may not be perfect; the vendor's original text is the reference.

These Terms are available in English and Urdu. The [Arabic/English] version prevails if there is any difference; the Urdu version is a translation provided for convenience. Until an Arabic version is published, the English version prevails. [Counsel to confirm: an Arabic version of these Terms is very likely required for consumers in the Kingdom (the Implementing Regulations of the E-Commerce Law), and the courts in the Kingdom work in Arabic; when it is added it is expected to be the prevailing consumer text.]

7. Intellectual property

TokenNo owns the Service, its software, design, the TokenNo name and logo. We give you a limited, personal, non-exclusive, non-transferable right to use the Service under these Terms. You keep any rights you have in content you submit, and you give us a licence to use it as needed to run and improve the Service.

8. Availability and changes to the Service

We work to keep the Service available, but it may sometimes be interrupted for maintenance, updates or reasons beyond our control (for example network or provider outages). We may change, add or remove features. If we remove a feature that you have paid for, we will give a fair refund or alternative.

9. Limitation of liability

Nothing in these Terms limits any liability that cannot be limited under the laws of the Kingdom, including the principles of Islamic Sharia, the Civil Transactions Law, your rights as a consumer under the E-Commerce Law and its Implementing Regulations, and any liability for fraud, deliberate wrongdoing or gross negligence [counsel to confirm the citation of the Civil Transactions Law and which limitations are enforceable under it].

Subject to that:

Waiting times, "your turn is near" alerts, distances and arrival estimates are estimates. Queues move faster or slower, and vendors can call, skip, push back or cancel tokens. TokenNo is not liable for losses caused by a vendor's decisions, by a vendor's services, or by delays you could not have avoided by using the Service.
TokenNo is not liable for indirect or consequential losses, such as loss of profit or opportunity.
For customers, our total liability to you for any claim related to the Service is limited to the amount you paid through TokenNo for the booking concerned, or [SAR amount] if you paid nothing [counsel to confirm the cap is enforceable against consumers under the laws of the Kingdom].
For vendors, the cap in section 31 applies.

10. Changes to these Terms

We may update these Terms. We will tell you about important changes in the app or by message at least [15] days before they take effect (or [30] days for changes to vendor fees), unless a change is required urgently by law. If you keep using the Service after a change takes effect, the new Terms apply. If you do not agree, you may stop using the Service and delete your account.

11. Governing law and disputes

These Terms are governed by the laws of the Kingdom of Saudi Arabia.
Talk to us first. Please contact us (section 12) so we can try to resolve the issue.
Customers (consumers): you may also complain to the Ministry of Commerce (for example through its consumer complaints channels) under the E-Commerce Law [counsel to confirm the current complaint channels]. Subject to your rights as a consumer, the competent courts of the Kingdom in [Riyadh] have jurisdiction [counsel to confirm the city and the competent court].
Vendors: disputes are resolved as set out in section 33.

12. Customer support and complaints

Contact: [Customer complaints contact name]
Address: [TokenNo Gulf entity legal name], [registered address]
Email: info@tokenno.com (subject: "Complaint")
Phone: [contact phone]

You can also raise a complaint in the app under Help. We aim to acknowledge complaints within [2] working days and to resolve them within [14] days [counsel to confirm any timelines required under the E-Commerce Law and its Implementing Regulations]. Privacy questions go to the Data Protection Officer named in the Privacy Policy.

PART B — TERMS FOR CUSTOMERS (HOSTS AND GUESTS)

13. Booking a token

When you book, you get a token number for a vendor's service point (for example a doctor's room, a counter or a table desk) and session. Token numbers restart at 1 each day for each service point.
One token covers your whole party. The host books one token for the party, up to the maximum party size the vendor allows.
Before you confirm, we show you the vendor, service point, session, party size, any amount payable (including VAT where it applies) and the vendor's refund rule.
A token is a place in a queue. It is not a fixed appointment time unless the vendor says so. The vendor decides the order in which it serves people.
No-show. Your token counts as a no-show only if it was called, the "your number is called" alert was sent to you, and you did not arrive within the vendor's grace period (set by the vendor, at least [X] minutes). The vendor or you (as host) may then cancel the token, and the vendor's no-show rule applies (section 16).

14. Changes by the vendor: push back, cancellations and holidays

Push back. A vendor may move a token later in the queue. For example, if token 28 is pushed back to 31, then tokens 29, 30 and 31 each move up by one and the original 28 becomes 31. Everyone whose token number changes, and their guests, is told of their new number.
Limits on push back. A vendor can move a token at most [N] times, and never more than [N] places in total without your consent. The vendor's push-back policy is shown to you before you book.
Your right to cancel. If the vendor pushes your token back by more than [N places / X minutes], or materially changes your session or expected time, you may cancel with a 100% refund.
Cancellations and holidays. A vendor or doctor may cancel a single session, a whole slot or a day (for example a holiday at a location). All tokens in it are cancelled and every token holder and their guests are told.
If you paid in advance and the vendor cancels, you get a 100% refund (section 16).

15. Advance payments

Some vendors require payment when you book (in full, as a deposit, or per person). If so:

TokenNo collects the payment as merchant of record through a licensed payment gateway (in Saudi Arabia, currently [Moyasar or Tap Payments — to be confirmed]), using the payment methods the gateway supports in the Kingdom (for example mada, Visa, Mastercard or Apple Pay). The token is issued only after the payment succeeds.
Amounts are charged in Saudi Riyals (SAR). The price shown is the total you pay, including Value Added Tax (VAT) where it applies, and any fees are shown before you pay.
The payment is for the vendor's service. The vendor is responsible for its service and for issuing any tax invoice it must issue for that service [tax advisor to confirm who must issue the VAT tax invoice (including under the ZATCA e-invoicing rules) to the customer when TokenNo is merchant of record].
Where a deposit is "adjusted in the bill", the vendor deducts it from your final bill.
Your card details are entered with the payment gateway; TokenNo does not see or store them.
If money is debited but your booking fails, the amount will be reversed automatically within [X working days] [counsel to confirm against the consumer law of the Kingdom].

[Counsel to confirm: that the "TokenNo collects and pays out" model complies with the Law of Payments and Payment Services and the rules of the Saudi Central Bank (SAMA) (for example by using a SAMA-licensed gateway's marketplace or split-settlement product), and whether TokenNo needs its own licence.]

16. Refunds

Vendor or doctor cancels (including a location holiday): 100% refund of what you paid for that token.
You cancel: the vendor's refund rule that applied when you booked is used. Vendors set their own rules (for example free cancellation until a certain number of hours before, a partial refund after that). Each rule has a version, and your token keeps the version you agreed to, so a later change by the vendor does not affect you.
No-show (as defined in section 13): the vendor's no-show rule that applied when you booked is used (for example the deposit may be kept). Any no-show charge is shown before you pay.
Large push back or session change: if you cancel because the vendor pushed your token back by more than [N places / X minutes] or materially changed your session, you get a 100% refund (section 14).
Guests: if you paid per person and a guest cancels, any refund for that person follows the same rule.
Refunds go back to the original payment method. We start the refund within [X working days] of the cancellation; your bank or card issuer may take [5–14] more working days to credit it [counsel to confirm timelines].

[Counsel to confirm: that vendor cancellation and no-show rules comply with the E-Commerce Law and its Implementing Regulations, including any consumer right to cancel within a set period after booking, how that right applies to time-specific services such as tokens, and any refund right that cannot be limited.]

If you think a refund is wrong, contact us (section 12).

17. Guests

A host may invite guests by entering their mobile numbers or choosing them from the phone's contacts. The host must invite only people who know them and expect to hear about the visit. A host's confirmation is not by itself our legal basis for messaging a guest: our first message to each guest names TokenNo and the host, links our Privacy Policy and offers a one-tap "stop inviting me" option (see the Privacy Policy, section 3.5).
Guests receive the invitation by push, SMS or WhatsApp, with a link to see the token in the app or in a simple web page. Guests do not have to install the app.
A guest can say whether they are coming, and can leave the party at any time. The host can remove guests or hand over the host role.

18. Location sharing

Location sharing is optional and off by default. If you turn it on for an active token, the vendor and your host can see your distance or estimated arrival time, and you may be marked as "arrived" automatically when you reach the location. It stops automatically. See the Privacy Policy for details.

19. Suspension of customer accounts

We may suspend or close an account, or cancel tokens, if we reasonably believe it is being misused (section 4), if required by law, or to protect other users. Where possible we will tell you why and give you a chance to respond. If we cancel a prepaid token because of misuse, we tell you the reason and refund the amount you paid less any documented loss the misuse caused to the vendor, which will not exceed the vendor's no-show charge under the rule version you booked under [counsel to confirm against the consumer law of the Kingdom, or refund 100%]. If we cancel for any reason that is not your fault, including by mistake or a system error, you get a 100% refund.

You can delete your account at any time in Profile.

PART C — TERMS FOR VENDORS (BUSINESSES)

These vendor terms apply in addition to Parts A and B (where relevant). "You" in Part C means the business that registers as a vendor, and the person accepting these Terms confirms they are authorised to bind it.

20. Onboarding, KYC verification and approval

You register in TokenNo Business and submit the identity and business documents we ask for in Saudi Arabia (for example a valid Commercial Registration (CR) or freelance certificate, the national ID or Iqama of the owners and authorised signatories, the business's national address, a Saudi bank account (IBAN) in the business's name, a VAT registration certificate from the Zakat, Tax and Customs Authority (ZATCA) where registered, the relevant municipal licence where required and, for clinics and hospitals, the private health facility licence issued by the Ministry of Health) ("KYC") [counsel and operations to confirm the Saudi KYC document list].
We (and our verification providers) review your documents. We may approve or reject an application, or ask for more information. We do not have to give reasons where the law does not require it.
Once approved, you receive a payment link for your plan (or a free trial, if offered to you). Your business goes live after that.
You must keep your KYC, licence and bank details accurate and tell us of changes, including if your Commercial Registration or licence expires or is suspended. We may re-verify at any time, and may pause payouts until verification is complete.

21. Your account and your staff

You decide who in your business has access (for example owner, manager, receptionist, doctor) and what they can do. You are responsible for your staff's use of the Service.
You must remove access for staff who leave.
Numbers you enter. When your staff create a phone, walk-in, QR or kiosk token, or your system creates one through the Integration API, you must tell the person, at the time, that TokenNo will process their name and mobile number to manage their token and send them messages about it, and you must have a lawful basis for giving us their details.
You set up your locations, service points, schedules (including several slots in one day), holidays, maximum party sizes, payment requirements and refund rules. You are responsible for keeping them correct.

22. Plans, fees, commission and token packs

Pricing is set per country in the TokenNo admin and shown to you before you subscribe or buy. In Saudi Arabia, fees are charged in SAR and are exclusive of VAT, which we add at the applicable rate (currently 15%) [tax advisor to confirm].
Fees may include:
- a subscription for your plan;
- a commission on advance payments collected through TokenNo (a percentage set for Saudi Arabia or agreed with you);
- token packs: bundles of tokens with an expiry date. When a token is issued, it uses the oldest valid pack first. Unused tokens in an expired pack are not refundable [counsel to confirm]; and
- SMS and WhatsApp charges, which are billed separately to your messaging ledger at the prices shown in TokenNo Business.
Payment gateway fees are either charged to you or absorbed by TokenNo, as shown in your plan.
Free trials are offered at our discretion per vendor.
We may change fees with at least [30] days' notice. Changes apply from your next billing period.
Subscription fees already paid are not refundable, except where these Terms or the law say otherwise [counsel to confirm].
We will issue tax invoices for our fees in the form required by ZATCA, including its e-invoicing rules [tax advisor to confirm TokenNo's VAT registration and e-invoicing obligations in the Kingdom].

23. Advance payments collected by TokenNo

If you require advance payment, TokenNo collects it from the customer as merchant of record through our payment gateway. We are responsible for the collection; you remain responsible for providing the service the customer paid for.
Funds are held and settled in line with the rules that apply to our payment gateway and those of the Saudi Central Bank (SAMA) [counsel to confirm].
You authorise TokenNo to collect payments for your services, deduct the amounts in section 24, and pay you the rest.

24. Weekly payouts

We pay out your balance weekly to your verified Saudi bank account (IBAN), on the payout day for Saudi Arabia (or the day agreed for your business), once your balance is above the minimum payout amount. Smaller balances roll over to the next week.
From each payout we deduct: our commission; refunds to customers; chargebacks and disputed payments; gateway fees (if you bear them); unpaid fees or messaging charges; and any taxes we must account for by law.
Taxes. You are responsible for your own taxes and zakat, including VAT on your services. We will give you statements of the amounts collected, deducted and paid out. [Tax advisor to confirm: the VAT treatment of advance payments collected by TokenNo as merchant of record, of TokenNo's commission, and of healthcare and restaurant services, any withholding tax on payments to a non-resident TokenNo entity, and who must issue tax invoices.]
If your balance becomes negative (for example after refunds or chargebacks), you must pay the shortfall, and we may recover it from future payouts.
We may hold payouts if we reasonably suspect fraud, if there is an unusually high level of refunds or disputes, if your KYC is incomplete, or if required by law.

25. Refund obligations

You must set a clear refund rule for customer cancellations and no-shows for each service point that takes advance payments. Each change creates a new version; tokens keep the version they were booked under, and you must honour it.
If you or your doctors cancel a session, slot or token, or a location holiday cancels it, the customer gets a 100% refund. Our commission on that payment is still payable and is recovered from your balance [counsel to confirm this is enforceable and fair].
Your rules must be fair, clearly stated and lawful, including under the E-Commerce Law and its Implementing Regulations. We may refuse or remove rules we consider unfair.
You must honour the push-back limits and the customer's right to a 100% refund after a large push back or session change (section 14), and you may apply a no-show rule only after the call alert was sent and your grace period of at least [X] minutes has passed (section 13). TokenNo's refund engine applies these rules automatically [product to confirm].
You must not ask customers to pay again outside TokenNo for a token already paid through TokenNo.

26. Your responsibilities for your services

You are solely responsible for the services you provide, including their quality, safety, pricing, licences and compliance with law (for example, for clinics and hospitals, the rules of the Ministry of Health; for restaurants, food safety rules of the Saudi Food and Drug Authority and the competent municipality).
You must treat customers fairly, use push back and cancellations in good faith, and not discriminate unlawfully.
Your content (business name, descriptions, room names, photos) must be accurate and lawful. You may correct automatic translations of your content.
You must handle complaints about your services and cooperate with us to resolve customer complaints.

27. Personal data and the Integration API

Data protection roles. TokenNo is the independent controller for the account and booking records held on the platform. You are a separate controller for your own service records and for any data you export through the Integration API or webhooks. The [Vendor Data-Sharing Addendum] (placeholder: link) forms part of these Terms and sets out each party's duties, including the limits on how you may use booking data you see in TokenNo. [Counsel to draft the addendum and confirm this model under the PDPL.]
Data protection. You and TokenNo each comply with the Personal Data Protection Law (Royal Decree No. M/19 dated 9/2/1443H, as amended) and its Implementing Regulations for the personal data each of you handles. Your customers' booking data is used to run your queue. You must use it only for providing your services and must not use it for unsolicited marketing. [Counsel to confirm whether a separate data processing agreement is needed and the roles of each party.]
No health data. In the current phase, you must not enter medical records, symptoms, diagnoses or other health details into TokenNo.
Integration API. If you connect your own systems (such as clinic software or a point-of-sale system) using API keys and webhooks:
- you must keep your API keys secret, give them only the scopes needed, and rotate or revoke them if they may have leaked. Keys are shown once; TokenNo stores only a hash;
- you are responsible for all calls made with your keys and for actions they perform (for example creating, calling or cancelling tokens);
- data sent to your systems is your responsibility. Once data leaves TokenNo through the API or webhooks, you are the controller of that copy and must protect it, keep it secure, give any required notices and respect people's rights over it, including the PDPL rules on sensitive data and on transfers outside the Kingdom, and any health-sector rules if your system holds health records;
- you must verify webhook signatures, respect rate limits, and use test keys and sandbox data for testing; and
- we may revoke keys, limit access or change the API (with reasonable notice for breaking changes, except for security reasons).
Messages. SMS and WhatsApp messages for your bookings are sent through TokenNo's providers in line with CST rules and WhatsApp's policies [counsel and operations to confirm whose sender name is registered under CST rules]. You must not use TokenNo to send marketing messages to customers without their consent.

28. Acceptable use for vendors

In addition to section 4, you must not:

create fake tokens or fake reviews, or manipulate queues to mislead customers;
charge customers for tokens outside the fees shown in TokenNo for the same token;
collect advance payments through TokenNo for services you do not intend to provide;
use customers' mobile numbers or other data for purposes not related to their booking; or
share your account or API keys with anyone outside your business.

29. Suspension and termination

We may suspend your account, your listings, API keys or payouts, with notice where possible, if you breach these Terms, fail KYC, your Commercial Registration or licence expires or is suspended, you have unpaid fees, you receive serious or repeated complaints, there are signs of fraud, or if the law requires.
We may terminate your account for serious or repeated breaches, or with [30] days' notice for any other reason.
You may terminate at any time in TokenNo Business or by writing to info@tokenno.com. Termination takes effect at the end of your current billing period.
On termination: you must still honour, or refund, tokens already booked and paid; we will pay out your remaining balance after deducting refunds, chargebacks and amounts owed (and after a reasonable holding period for disputes [counsel to confirm period]); and you can export your data for [30] days, after which we delete it as described in the Privacy Policy, except records we must keep by law.

30. Confidentiality

Each party will keep the other's non-public business information confidential and use it only for the Service, except where disclosure is required by law.

31. Vendor liability and indemnity

To the extent allowed by the laws of the Kingdom, TokenNo's total liability to you in any 12-month period is limited to the fees you paid to TokenNo in that period (excluding amounts collected for your services and paid out to you).
TokenNo is not liable for your lost profits, lost business or indirect losses, or for failures of telecom operators, payment gateways, app stores or other third parties beyond our reasonable control.
You will indemnify TokenNo against claims, penalties and losses arising from your services, your content, your breach of these Terms or of law, and your handling of personal data (including data sent to your systems through the Integration API).

[Counsel to confirm the enforceability of these limitations and the indemnity under the Civil Transactions Law and the principles of Islamic Sharia.]

32. Publicity

We may name your business as a TokenNo customer in our marketing unless you tell us not to. We will not use your logo without your permission.

33. Disputes between vendors and TokenNo

These Terms are governed by the laws of the Kingdom of Saudi Arabia.
The parties will first try to resolve a dispute by good-faith discussion for [30] days.
If not resolved, the dispute will be finally settled by arbitration administered by the Saudi Center for Commercial Arbitration (SCCA) under its Arbitration Rules, by a sole arbitrator, in line with the Arbitration Law, issued by Royal Decree No. M/34 dated 24/5/1433H. The seat will be [Riyadh], and the language will be [English / Arabic] [counsel to confirm the arbitral institution, the seat, the language, the citation of the Arbitration Law and the formalities needed for a valid arbitration agreement with a company].
Subject to this, the Commercial Courts in [Riyadh] have jurisdiction, including for interim relief and enforcement [counsel to confirm].

34. Contact

[TokenNo Gulf entity legal name] [registered address] Email: info@tokenno.com