Sada Privacy Policy

This English version is a translation for convenience; if there is any difference, the Arabic version prevails.

Version: 2026-11-04.2 (4 November 2026). Effective date: 4 November 2026.

1. Who we are

This policy explains how Sada Digital Technology (صدى للتكنولوجيا الرقمية), a Single Person Company (S.P.C.), registered in the Commercial Register under No. 255426, whose address is Doha, State of Qatar, processes your personal data when you use the «Sada» app, its website and its services. Sada is responsible for processing this data (the controller) and complies with Law No. (13) of 2016 on the Protection of Personal Data Privacy.

The app is distributed on the App Store, for the time being, through an individual developer account in the name of the company's owner on the company's behalf; the company is the party responsible for processing.

Privacy contact: info@sdt.qa.

2. Data we collect

Data you provide

• Your Qatari phone number, used to create the account, sign in and verify it, and shown to signed-in users on your listings as described in section 4.
• The password you set to sign in with your number. The authentication provider stores it in an encrypted form that cannot be recovered, and we cannot see it. To link it to your account, an internal sign-in identifier based on your number is created; it is never shown to anyone and no messages are sent to it.
• Your email address, if you choose to add and confirm it.
• If you sign in with an Apple or Google account: your account identifier with that provider, your email address (or Apple's private relay address if you choose to hide your email), and your name if the provider shares it. We do not receive your password.
• Your display name, city and your declaration that you are 18 years of age or older.
• Listings and their photos, the video if you add one, specifications and prices, and purchase requests, comments and ratings.
• Price offers you send or receive in a chat and the replies to them, the confirmation that a deal was completed and its final amount, and your star rating of the seller with an optional note. Offers are not binding and no money is paid through them.
• «Alert me if the price drops» requests you turn on for listings, and «I accept a swap» on your own listings.
• The messages you send in chats within the app.
• The reports you submit about listings, comments, messages, users or stores, and your requests for reconsideration.
• The list of users you have blocked, which no one else can see; it is deleted when you unblock them or delete your account.
• Store or productive-family application data: first name, family name, trade name, commercial registration or licence number, username and an image of the licence. The licence image is kept in private storage that only authorised reviewers can access.
• The notes and photos you choose to send to create an assisted listing draft, when this feature is enabled.

Data generated during use

• Your account identifier, the dates of creation and sign-in, and the account status.
• A record of your acceptance of the Terms of Use, the Privacy Policy and the Merchant Terms: the document name, its version number, and the time and source (app or website) of the acceptance, without your network address or device data.
• Your device's notification token (push token), to send alerts, if you allow notifications.
• Favourites, saved searches and alert settings, and interest signals inferred from your browsing when personalisation is enabled.
• When personalisation is enabled and you are signed in: the searches you make (category, text, city and specifications, without the listings shown to you), to order the home categories by your repeated searches and, if you turn it on, to save a repeated search automatically in «My saved searches». They are deleted after 30 days.
• The number of your completed deals as a seller and your average star rating.
• Aggregate statistics on listing views.
• Security and operational logs: sign-in attempts, changes to contact methods, review operations and administrative actions, and network addresses and technical device data recorded by hosting providers for security purposes.
• A record of seller-number reveals: the listings on which you tapped «Show seller's number» and when, to apply the reveal limit and prevent number harvesting. It is deleted after 30 days.
• Crash reports in the iOS and Android apps, if we enable them: the crash trace, error type and message, device model, operating system, app version, available memory and storage, the time of the crash, and a random installation and session identifier. They do not include your number, email, account identifier or location, and we do not link them to your account. The error message may include text that was visible in the app at the time of the crash.
• The results of automated listing screening and review decisions, including duplicate signals derived from text and photo fingerprints.
• When personalisation is enabled: the search results shown to you and the ones you tapped, linked to a random session key that is not linked to your identity, and deleted after 90 days.

Approximate location

Only when you choose «Use my current location» or the «Nearest» sort, we ask for permission to use your device's approximate location; it is sent rounded (to about 1 km) with the search request to order the results, and we do not store it on our servers. The location shown for a listing is the area or city the seller sets, not its exact location.

Data stored on your device

The app stores some preferences locally on your device, such as the home screen layout, the chosen city, category visits and your last 5 text searches (per account on the device, never sent to our servers; you can remove any of them or clear them all from the search box), as well as the session data needed to keep you signed in. On the website, these preferences are stored only with your consent, as described in section 11.

If you turn on «Sign in with Face ID» on iPhone, your number and password are stored only in the device Keychain, can be unlocked only by the face enrolled on that device, are not backed up and are not sent to us. The device's operating system performs the face check, and we receive no data about your face. This data is erased when the faces enrolled on the device change, at the first sign-in attempt after your password changes, or when the account is deleted.

3. Purposes of processing and their basis

• Providing the service: creating the account, signing in and verifying the email address or phone number, publishing listings, chats and alerts. Basis: your consent at registration and the necessity of performing the service you requested.
• Publishing and content moderation: your listing is published as soon as it passes the automated checks (the listing text, the status of its photos, the account status and publishing quotas), without waiting for a moderator's approval. Listings containing expressly prohibited goods are rejected automatically, and listings the checks find suspicious are referred to human review before publication. After publication, our team reviews reported listings, comments, messages and accounts and anything later checks detect, and may hide or remove them. Videos are not screened automatically; they are subject to reports and human review. Basis: the necessity of performing the service, and the legitimate purpose of keeping the Platform and its users safe.
• Security and fraud prevention: protecting accounts, limiting abuse (including limiting how many seller numbers each user can reveal per hour and per day), screening listings under the Prohibited Goods Policy, and handling reports. We compare text and photo fingerprints automatically to detect duplicate listings; the result refers the listing to human review and does not remove anything. When you sign in, we use a bot-protection service provided by the phone verification provider, which collects technical signals from your device or browser to prevent abuse. Basis: the legitimate purpose of Sada and its users, and legal obligations.
• Reviewing stores and productive families: verifying licence details before approval. Basis: your application and consent, and the legitimate purpose of protecting consumers.
• Personalisation: ordering categories by your visits and repeated searches, suggesting listings close to your interests, and saving a search you repeat automatically so you are alerted to matching listings (we tell you when it is saved; you can delete it or turn off its alert, and we never save a search you deleted again). When it is enabled, we also record which search results are shown to you and which you tap, using a random session key that is not linked to your identity, and delete them after 90 days, to improve the ordering of results. In Settings you can turn off personalisation entirely, or only the automatic saving, and clear the inferred interests. Turning personalisation off stops new searches from being recorded. Basis: our legitimate interest in improving the service, with your right to turn it off.
• App stability: if we enable crash reports, we use them only to detect and fix crashes, not for advertising or tracking. Basis: the legitimate purpose of operating the service.
• Aggregate statistics: we compute aggregate statistics on the use of the Platform to improve it; they do not identify any person. Basis: the legitimate purpose of Sada.
• Communicating with you: in-app notifications and emails relating to your account (such as email confirmation or notice of an administrative change to your business details). We do not send marketing messages without your consent.
• Legal compliance: responding to requests from competent authorities in accordance with the law, and keeping the necessary records.

We do not sell your personal data, and we do not use it to make fully automated decisions that have legal effects on you. Publishing is automated as described above, and automated rejection of a listing is limited to expressly prohibited goods, and you may request reconsideration through human review. Decisions on removal, bans, approval of stores and productive families, and verification are made by people.

4. Who can see your data

Other users

• Shown publicly: the published listing, its photos and its video if any, the seller's display name, the city, and the store name and its public page, if any.
• The other party in a chat sees your messages and your display name, and the offers and confirmations you exchange.
• The number of a seller's completed deals and their average star rating are shown publicly next to the seller's name. The identity of the person who rated and the written note are not shown publicly.
• A seller sees how many people turned on «Alert me if the price drops» for their listing, not who they are.
• Seller's number: when a signed-in user taps «Show seller's number» on one of your published listings, they see your confirmed sign-in number (or the call number a store sets on its page) and can call you. The number is not shown to visitors who are not signed in, or between two users where one has blocked the other, and each user has a limit on how many numbers they can reveal per hour and per day. The app does not currently let you hide the number on your listings; if you do not want it shown, do not publish a listing, or delete your listings.
• WhatsApp: the «WhatsApp» button on your listings uses the same number and is on by default for new accounts. You can turn it off at any time in Settings under «Show WhatsApp on my listings»; the number and the call button remain.
• Your email address is not shown to other users.

Service providers

We use providers that process data on our behalf and on our instructions, under contracts that bind them to confidentiality and security, and only to the extent needed to provide their service:

• The hosting, database, storage and authentication provider.
• The provider that sends verification codes by text message, verifies phone numbers and provides bot protection at sign-in.
• The provider of push notifications to devices.
• The email delivery provider.
• The artificial intelligence model provider for creating drafts, which receives only what you choose to send to create the draft, and only when the feature is enabled.
• The provider of the fonts used to display the interface.
• The provider of crash reporting in the app, when enabled.

In this policy we describe service providers by their category, not by their names, and we ensure that what each of them receives is limited to what its service needs.

External sign-in services

If you choose to sign in with an Apple or Google account, that provider processes your sign-in under its own policy as an independent party, and shares with us only what is listed in section 2.

Competent authorities

We may disclose specific data to the competent judicial, security or regulatory authorities where the law requires it or on the basis of a valid official request, or to protect persons from serious danger.

5. Transfer of data outside Qatar

Some service providers may process or store data in data centres outside the State of Qatar: in India (database, storage and authentication), and in the United States and other countries (phone verification, sign-in through external accounts, push notifications, email delivery, fonts, and the artificial intelligence model and crash reports when enabled). The website is hosted within the State of Qatar. We transfer data only to the extent necessary for the service, with appropriate contractual and technical safeguards, and in a manner that does not contravene the provisions of Law No. (13) of 2016 or cause you serious harm.

6. Retention period

• We keep account data, listings and chats for as long as the account exists.
• When the account is deleted, the account data, listings and their photos, and the chats you took part in are deleted as described on the «Account deletion» page.
• We may keep specific records after deletion for the period required by law or to protect rights, such as security logs, administrative actions and transaction records, if any. Security and administrative logs are kept for two years, and financial transaction records, if any, for the period required by law.
• Licence images and store and productive-family application documents are kept for as long as the account exists. Once the account deletion is completed, they remain locked in private storage for 30 days, during which no one can access them through the app or the admin console, and are then permanently deleted.
• The record of your acceptance of the legal documents is deleted when the account is deleted.
• When you delete a listing, it disappears from everyone immediately, its photos and video are removed from the listing and their files are scheduled for deletion from storage. The listing record is kept for 30 days for reports and evidence, after which its title and description are erased. If the listing has an open report, its photos remain available to moderators only until the report is closed and 30 days have passed. Chats about the listing stay with their participants, and reports and the administrative action log are kept for their own periods.
• Fixed periods for usage data: searches recorded for personalisation 30 days; search results and taps 90 days; interest signals 120 days; read in-app notifications 180 days; closed reports two years after closing; seller-number reveal records 30 days; crash reports about 90 days with their provider; withdrawn or expired price offers stay with the conversation.
• When the account is deleted, your offers, price-drop alerts, saved searches (manual and automatic), search history and the ratings you wrote are also deleted.
• Documents of a rejected or abandoned store or productive-family application are deleted when the account is deleted, as above, or earlier at your request to info@sdt.qa within 30 days.
• Backups are replaced periodically within 30 days.

7. Data security

We apply reasonable technical and organisational measures, including: encrypted connections, row- and column-level access permissions in the database, keeping licence images in private storage with temporary links, restricting the administration team's permissions and logging its actions, and not placing secret keys in the app. No system is completely secure, so please protect your device and do not share your verification code.

8. Your rights

In accordance with Law No. (13) of 2016, and within the limits set by the law, you have the right to:

• Access the personal data we process about you and obtain a copy of it.
• Correct or update inaccurate data.
• Request deletion of your data when it is no longer needed or when you withdraw your consent.
• Object to processing that is not necessary to achieve its purposes, or to processing for marketing purposes.
• Withdraw your consent at any time, without affecting the lawfulness of prior processing.
• Be informed of the processing and its purposes, and of any inaccurate disclosure of your data.

You can edit your basic data and turn off personalisation directly in the app. To exercise the other rights, write to us at info@sdt.qa from the email address or phone number linked to your account. We may ask to verify your identity, and we will reply within 30 days.

9. Account deletion

You can request deletion of your account from the app: «Account» then «Delete account». The details, what is deleted and what is kept are explained on the «Account deletion» page.

10. Minors

The Platform is not directed at persons under 18 years of age, and we do not allow them to create an account. If we learn that an account belongs to a minor, we disable it and delete its data in accordance with the law.

11. Cookies and local storage

Sada's website stores small items of data in your browser's local storage, and does not currently set any cookies of its own, except the protection cookie on the sign-in screen described below. We divide what is stored into three categories:

• Strictly necessary (always on): the sign-in session data needed to keep you signed in and protect your account; the record of your choice in the consent window (the categories you chose, the time of the choice and the version number of this policy); the list of your acceptances of the legal documents waiting to be sent to the server; and the date until which the email confirmation reminder is postponed. On the sign-in screen only, the bot-protection provider may set a cookie needed for security, which is not used for advertising. The website does not work without them, and they are not used to track you or for advertising purposes.
• Preferences (optional, require your consent): the home screen layout, the chosen city, the number of your visits to each category used to order the categories, when we offered to enable notifications so that we do not repeat the offer, and the alerts and in-app announcements you hid so that they do not appear to you again, and your last 5 text searches. We do not store them before your consent. If you decline them or withdraw your consent, we delete them from your browser, and the website works fully with the default values.
• Analytics and advertising: we do not use analytics files or advertising tracking, or any third-party tracking tools, except the protection cookie on the sign-in screen. The Platform may show featured listings and business advertisements labelled as such, without using your personal data to target them.

On your first visit to the website we show a window offering «Accept all», «Necessary only» or «Settings» to choose each category, and no optional category is enabled in advance. You can change your choice at any time from «Settings» then «Cookies and storage». If we change the categories or what they include, we ask for your choice again.

The browser also keeps temporary copies of images and website files in its usual cache to speed up browsing, and the browser itself manages them. Browser notifications are not currently enabled on the website; if we enable them later and you allow them, the browser stores the subscription data needed to deliver them, and you can turn them off in your browser settings.

You can also clear the storage from your browser settings, which may sign you out and show the consent window again. In the iOS and Android apps, the session and preferences are stored on your device to run the app, as described in «Data stored on your device».

12. Breach notification

If a breach of your personal data occurs that is likely to cause you serious harm, we will notify the competent authority and notify you as required by law, and we will take the necessary measures to limit its effect.

13. Changes to this policy

We may update this policy. We publish the new version with its effective date, and we inform you within the app of material changes before they take effect.

14. Contact and complaints

• For enquiries or requests: info@sdt.qa, or by post to the company's address in Doha, State of Qatar.
• If you are not satisfied with our response, you have the right to submit a complaint to the authority competent for personal data protection in the State of Qatar (the National Data Privacy Office of the National Cyber Security Agency).