Sada (صدى) is a marketplace in Saudi Arabia where brands find content creators and agencies, agree terms, and pay through escrow. This policy explains what personal data we collect when you use our website (sadacollab.com), our web app (app.sadacollab.com), our iOS and Android apps and our tracked links (go.sadacollab.com), why we collect it, who we share it with, and the choices you have.

1. Who we are

Sada (صدى) is responsible for your personal data under this policy. You can reach us at hello@sadacollab.com. We process personal data in line with the Saudi Personal Data Protection Law (PDPL).

2. The data we collect

Data you give us

• Account: your name, email address, password (stored only as a secure hash by our authentication provider), phone number, and whether you are a brand, a creator or an agency.
• Profile: your photo, bio, city, languages, fields and content types, social media handles and follower counts, your rates, and the portfolio images and videos you upload.
• Business details (brands and agencies): company name, commercial registration (CR) number and VAT number.
• Creator licence: your Mawthooq licence number and expiry date, which we use to show that you are licensed.
• Payout details (creators and agencies): your bank name and IBAN, so we can pay you.
• Your activity on Sada: requests and campaigns, offers, contracts, messages, files and content you deliver, reviews, and the post results or screenshots you share.
• Notification settings: which notifications you want, and your WhatsApp number if you turn on WhatsApp notifications.
• Ambassador applications: if you apply on sadacollab.com/ambassadors, the name, phone, email, city, handle, follower count and message you send us.
• Support: anything you tell us when you contact us.

Data from Google and Apple sign-in

If you choose Sign in with Google, Google shares your name, email address and profile picture with us. If you choose Sign in with Apple, Apple shares your name and your email address (or a private relay address if you choose to hide it). We use this only to create and sign you into your Sada account. We do not request access to your contacts, files, calendar or any other Google or Apple data.

Data collected automatically

• Device and app data: a push notification token for your device, your app language, and basic technical logs (such as browser type and error reports) needed to keep the service running and secure.
• Website analytics: we use Google Analytics on sadacollab.com and app.sadacollab.com to count visits and see which pages are used. It uses cookies and collects data such as pages viewed, approximate location, and device type. We configure it not to send the parts of web addresses that can contain sign-in tokens.
• Tracked links: when someone opens a campaign link on go.sadacollab.com, we record the time, the country and city, device type, the website they came from, and whether the visit looks automated. To count unique visitors we store a one-way scrambled code made from the IP address and browser; we never store the IP address itself.

We do not collect payment card details. Funding a collaboration on Sada is currently recorded without charging a card. If we add a payment provider later, card details will be handled by that provider, and we will update this policy.

3. How we use your data

• To create and secure your account and sign you in.
• To show your profile and portfolio to other users, and to let brands search for and match with creators and agencies.
• To run collaborations: offers, contracts, messages, deliveries, escrow, payouts, invoices and reviews.
• To send you notifications by email, push, in the app and (if you turn it on) WhatsApp about your account and your collaborations.
• To measure campaign results for brands, using tracked links and the post numbers creators report.
• To offer optional AI drafting tools (for example writing a brief, a pitch or a campaign report). The text you ask the tool to work on is sent to Google's Gemini service to produce a draft that you then edit.
• To verify creator licences, prevent fraud and abuse, and keep Sada secure.
• To understand how Sada is used and improve it.
• To meet legal, tax and accounting obligations.

We use your data because it is needed to provide the service you signed up for, because you consented (for example to WhatsApp notifications or analytics cookies), because of a legal obligation, or for our legitimate interest in keeping Sada safe and working well.

4. What other users can see

Sada is a marketplace, so parts of your profile are visible to other users: for creators and agencies, your name, photo, bio, city, fields, social handles, follower counts, rates, portfolio, reviews and licence status; for brands, your brand name, logo and description. Messages, contracts and deliverables are visible only to the people in that collaboration. Your email, phone number, IBAN, CR and VAT numbers are not shown on your public profile.

5. Who we share data with

We do not sell or rent your personal data, and we do not share it with advertisers. We share it only with the service providers that run Sada for us, under agreements that limit their use of it to providing that service:

We may also share data if the law requires it, to protect the rights and safety of our users or of Sada, or as part of a merger or sale of the business (in which case this policy will continue to apply).

6. Google user data

Sada's use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements. The only Google user data we receive is your name, email address and profile picture from Sign in with Google. We use it only to create and sign you into your account and to show your name and picture in Sada. We do not sell it, use it for advertising, or use it to train AI models, and people at Sada cannot read it except where needed for security, to comply with the law, or with your permission.

7. Where your data is stored

Our main database is hosted by Supabase in Mumbai, India, and some providers listed above process data in other countries. When data leaves Saudi Arabia, we take the steps the PDPL requires to keep it protected.

8. How long we keep it

We keep your data while your account is open. When you delete your account, we delete or anonymise your personal data within 30 days. We keep records of payments, contracts and invoices for as long as Saudi tax and commercial law requires, and we may keep a limited record where needed to resolve a dispute or prevent fraud. Reviews you wrote and messages you sent in a collaboration may stay visible to the other party, without your name.

9. Your rights and choices

• Access and correction: you can see and edit most of your data in your profile and settings at any time, or ask us for a copy.
• Deletion: you can ask us to delete your account and personal data (see below).
• Notifications: you can turn email, push and WhatsApp notifications on or off in the app's settings.
• Withdrawing consent: you can withdraw consent at any time, for example by turning off WhatsApp notifications or clearing cookies.
• Complaints: you can complain to the Saudi Data & AI Authority (SDAIA) if you think we have handled your data wrongly. We would like the chance to fix it first, so please write to us.

10. Security

Data is encrypted in transit (HTTPS) and at rest. Access to the database is controlled by row-level security rules, so each user can only read their own private data. Passwords are stored only as secure hashes. No system is perfectly secure, so if we learn of a breach that affects you, we will tell you and the authorities as the law requires.

11. Children

Sada is for people aged 18 and over. We do not knowingly collect data from anyone younger. If you believe a minor has created an account, contact us and we will delete it.

12. Changes to this policy

If we change this policy, we will update the date at the top and, for important changes, tell you by email or in the app before they take effect.

13. Contact us

Questions or requests about your data: hello@sadacollab.com.