Privacy Policy

1. Who We Are

Sana is a platform for browsing, requesting, communicating about, and booking photography services. The owner of the application and the party responsible for processing your personal data is Darh.

2. Data We Collect

We collect the data needed to provide the service, including:

• Account data: name, email address, mobile number, city, and gender, together with the account identifier held at Apple or Google when signing in through them.
• Request and booking data: order details, dates, event locations, and any notes entered by the user.
• Service-provider data: portfolio, packages, prices, and availability, and what is needed to verify the activity and activate the profile.
• Financial data: bank information (such as the IBAN) needed to transfer the service provider's dues, and transaction and payout data.
• User-generated content: messages, conversations, voice notes, images, and locations shared within the application.
• Technical data: device and operating-system information, application identifiers, usage data, and logs necessary to operate and secure the service, including crash reports.

3. How We Collect Data and the Basis for Processing

We collect data directly from what the user provides upon registration and use, and automatically through use of the application. We process it on the basis of the user's consent, the necessity of performing the requested service and meeting legal obligations, and the legitimate interest of the company without prejudice to the user's rights.

4. Purposes of Processing

• Creating, verifying, and enabling access to the account.
• Enabling browsing, booking, and communication between users and service providers.
• Operating, improving, maintaining, and securing the application.
• Communicating with the user regarding services, requests, and notifications.
• Meeting legal requirements, handling complaints, and preventing misuse.

5. Disclosure and Sharing

We do not sell personal data. We may disclose it, to the extent necessary, to:

• Technical service providers acting on our behalf as processors bound by confidentiality and protection no less than this Policy requires, including: Supabase for hosting, database, and storage; StreamPay, through Moyasar, for payment processing (card details are processed by them, and we do not store them); Firebase Crashlytics, a Google service, for crash reporting; and Apple and Google for sign-in, in addition to messaging and maps services.
• The AI translation service Google Gemini: when a service provider chooses to translate their introductory bio, a package name, or a package description using the "Translate using AI" button, only the text concerned is sent to that service for translation, and only upon their explicit request each time.
• Competent authorities where required by law, or to protect rights and prevent harm.

6. Processing Outside the Kingdom

Some data may be processed or stored by our providers outside the Kingdom of Saudi Arabia. Where this occurs, we apply appropriate safeguards consistent with the Personal Data Protection Law and its Regulation.

7. Data Retention

We retain data for as long as necessary to fulfil the purposes set out in this Policy, or for the period required by law, after which we securely destroy it or render it anonymous.

8. Data Security

We apply appropriate organizational and technical measures to protect data against unauthorized access, disclosure, or destruction. As no method of electronic transmission or storage is absolutely secure, we exercise reasonable care without providing an absolute guarantee.

9. Your Rights

In respect of personal data, and as provided by law, the user has the following rights:

• The right to be informed of the reasons for collecting the data.
• The right to access the data and obtain a copy of it.
• The right to request its correction or updating.
• The right to request its destruction when no longer needed.
• The right to withdraw consent to its processing.

To exercise these rights, contact us at the address below; we respond within the periods set by law. The user may also lodge a complaint with the competent authority.

10. Account Deletion

The user may delete the account from within the application, from "Account" and then the account-details edit button ("Edit profile" for clients, "Edit my details" for photographers). The account is deactivated once the request is confirmed, and the data is then permanently deleted or anonymized after a grace period of fourteen days, unless the law requires retaining some of it; at that point the account's Apple or Google sign-in link is revoked. A user who can no longer access the application may request account deletion via the contact address in section 13.

11. Eligibility

The application is intended for those who have reached the legal age of majority. We do not knowingly collect data from minors, and where this becomes apparent we promptly delete it.

12. Changes to this Policy

We may update this Policy from time to time. Any update takes effect from the date it is published within the application, and continued use thereafter constitutes acceptance of it.

13. Contact

For any inquiry or request relating to this Policy or your personal data, you may contact us at:

14. Governing Law

This Policy is governed by the laws of the Kingdom of Saudi Arabia, foremost the Personal Data Protection Law and its Implementing Regulation.