DRAFT — needs Saudi lawyer review. Not legal advice and not yet in force. Items in [square brackets] are decisions or facts still to be filled in by CLSTRA.
Privacy Policy
Last updated: [date]. Applies to the CLSTRA iOS app and the clstra.com website.
1. Who we are
CLSTRA is a marketplace where people in Saudi Arabia buy and sell second-hand items with each other, and post «Wants» (requests for something they are looking for). The party responsible for your personal data is [legal entity name, commercial registration no., address in the Kingdom]. Contact: [privacy email].
2. What we collect
- Account: your email address (to sign you in with a one-time code), a handle, a display name, and optionally a bio, city and profile photo.
- Pieces you list: photos, caption, title, category, condition, flaws, measurements, price, city, and the status (live, reserved, sold, hidden). Drafts are saved on your phone and, when you publish, on our servers.
- Wants and offers: what you ask for, offers you make or answer, and pieces a seller proposes in reply.
- Messages and reservations: chat messages, reservations («حجز») and orders between you and another person, and the history of their status.
- Safety: reports you send, people you block, and the reports made about you.
- Technical: what our hosting provider needs to run the service, such as IP address and request logs, and the sign-in session kept on your phone.
We do not use advertising or analytics trackers, we do not track you across other apps or websites, and we do not sell your data. We do not collect your precise location. The app asks for access to your photos or camera only when you add a picture.
Waitlist: if you join the waitlist on clstra.com we store your email address and the date, and use it only to tell you about CLSTRA.
3. Why we use it
- To create and secure your account, and let you sign in.
- To show your pieces, Wants and profile to other people, and let you reserve, offer and chat.
- To keep the marketplace safe: handle reports, blocks and misuse, and keep a record of what happened in a deal.
- To send you the sign-in code and notices about your account. [Push notifications: not yet; this section will change when they are added.]
- To meet legal obligations. [Lawyer: confirm legal bases under the PDPL — consent, contract, legitimate interest, legal duty.]
4. Who can see it
- Everyone using the app: your handle, display name, bio, city, profile photo, live pieces and their photos, and your Wants.
- The other person in a deal or chat: your messages, offers, and the reservation or order between you. Photos of pieces are private files, shown only to signed-in people through the app.
- Our service providers: Supabase provides our database, sign-in, and photo storage; [email delivery provider, e.g. Resend] sends sign-in emails; [hosting provider for clstra.com]. They process data for us under their terms. [Lawyer: confirm processor contracts and the region where Supabase data is stored: [region].]
- Authorities where the law requires it.
Your data may be processed outside the Kingdom by these providers. [Lawyer: confirm the PDPL cross-border transfer conditions and what we must tell you.]
5. Messages and photos are not end-to-end encrypted
Chat messages and photos are stored on our servers so the conversation works on both phones. Never send passwords, card numbers or ID documents in chat. CLSTRA will never ask for them.
6. Keeping and deleting your data
You can delete your account in the app: You → Edit profile → Delete account. When you do:
- your login and email are deleted, your handle is released and renamed, and your name, bio, city and profile photo are removed;
- pieces nobody has talked about are deleted with their photos; other unsold pieces are hidden and their photos removed;
- waiting offers are declined and unanswered Wants are deleted;
- so the other person's record stays whole, messages you sent, completed or cancelled orders, accepted or declined offers, and sold pieces you listed may be kept without your name, shown as “Deleted account”. [Lawyer: confirm how long, and whether messages and pieces must be erased or redacted on request. Today nothing purges them.]
Deletion is refused while a reservation or order with someone is still open; finish or cancel it first. Backups [retention period] may take time to expire. Waitlist emails can be removed by writing to [privacy email].
7. Your rights (PDPL)
Under the Saudi Personal Data Protection Law you may ask to know what we hold about you, to receive a copy, to correct it, to have it destroyed, and to withdraw consent where we rely on it. Write to [privacy email]; we will answer within [period]. You may also complain to the Saudi Data and AI Authority (SDAIA). [Lawyer: confirm wording and any registration or DPO duties.]
8. Children
CLSTRA is for people aged [18]+. If you think a child has an account, tell us and we will remove it. [Lawyer: confirm minimum age.]
9. Security
Access to data is limited by database rules so people see only what they should, photos are private, and connections are encrypted. No system is perfectly secure. [Describe incident notification once confirmed.]
10. Changes
If we change this policy we will update the date above and, for important changes, tell you in the app.
11. Contact
[privacy email] · [postal address]