Post an ad free
Post an ad free

Privacy Policy

Last updated: October 2026

Sample draft — review with a lawyer before going live.

1. Who we are

SAMH (getsamh.com) is a Saudi peer-to-peer marketplace. We are the controller responsible for your personal data under the Saudi Personal Data Protection Law (PDPL) and its Implementing Regulation.

This policy explains what data we collect, why, who we share it with, how long we keep it, and what your rights are. It applies to your use of the platform.

2. Data we collect

We collect the following data only:

  • Account data: your name, your email address, your password stored in an irreversible hashed form, and a profile picture if you add one.
  • Listing data: the title, description, price, category, city, region, photos and the detail fields you choose to fill in.
  • Content and communication: the messages you exchange with other users, the listings attached to a conversation, and the comments and questions on listings.
  • Your activity: saved listings, saved searches, your block list, and in-app notifications.
  • Safety and reporting: reports you file or that are filed about your content, and the record of the moderation decisions taken on them.
  • Technical data: your IP address and browser type, recorded with your sign-in session for security and abuse prevention.

3. What we do not collect

Data minimisation is a principle for us, so we state plainly what we do not collect:

  • We do not ask for your phone number, do not verify it, and do not display one on your behalf.
  • We do not ask for your national ID or any sensitive data (health, religious, ethnic or financial).
  • We do not process payment card data. Buying, selling and payment happen between users outside the platform.
  • We do not collect your precise location from your device, and we do not track your movements.
  • We do not use analytics or advertising trackers in this version, and we never sell your data.
  • We do not read the contacts or files on your device.

4. Our lawful basis

We only process your personal data on a lawful basis set out in the PDPL and its Implementing Regulation, and the basis depends on the purpose:

  • Running your account, publishing your listings, operating chat and notifications, and sending verification and password-reset emails: performance of our agreement with you — the basis the Regulation calls your actual interest.
  • Making your listing public and searchable: on your instruction to publish it, to serve your own goal of selling or buying.
  • Protecting the platform: preventing spam, fraud and abuse, rate-limiting requests, reviewing reports and keeping security records: our legitimate interest in a safe platform, balanced against your rights and interests, using the least data necessary.
  • Legal obligations: responding to lawful requests from the competent authorities.
  • Marketing messages: we send none today. If we ever do, it will be on your explicit consent only, with an unsubscribe option in every message.

5. Your listing and what other users see

This is a listings platform, so some of what you post is public by nature. We therefore state the boundaries plainly:

  • Listings and comments are public: your listing's title, description, photos and the city you choose are visible to all users and may appear in search-engine results.
  • Your photos are re-processed before publication, so any GPS coordinates, camera details or original capture time stored inside the image file are not published.
  • We never show your email address to another user, and we never pass it on.
  • However, if you type your phone number, email or address into a listing description, a chat message or a comment, it is visible to whoever can see that content. Once the other party has it we cannot control what they do with it — so post only what you are comfortable making visible.
  • Conversations are private between their two participants. We store them to operate the service and to review them when a report is filed.

6. Messages we send you

We email you about your account only: address verification on sign-up, password reset, and any important security notice. We do not use your address for marketing without your consent.

Platform notifications — a new comment, or the outcome of a listing review — appear inside the platform and are not emailed.

7. Cookies and technical data

We use cookies and local browser storage for these essential and functional purposes only:

  • Session cookie: keeps you signed in. The platform cannot work without it.
  • Your preferences: language (Arabic/English) and appearance (light/dark).
  • We use no tracking or advertising cookies in this version, and share no cookie data with ad networks.

8. Transfer outside the Kingdom

The platform runs on global providers whose servers are outside Saudi Arabia. We transfer data to them only as far as running the service requires, on the basis of our agreement with you and relying on safeguards recognised by SDAIA — such as standard contractual clauses and the data-processing agreements we hold with each provider. We never transfer your data to a party for its own marketing purposes. The providers are:

  • Database: Neon — European Union (Frankfurt, Germany).
  • Image storage and delivery: Cloudflare (R2 and its content-delivery network).
  • Application hosting, real-time messaging and caching: Cloudflare (Workers and Durable Objects) — global network.
  • Email delivery: Resend — United States.

9. How long we keep data

We keep data for as long as the purpose it was collected for requires, then erase it or make it impossible to link to you:

When you delete your account we erase your personal data (name, email address, photo, password, sign-in credentials and sessions) and delete your listings together with their photos. The conversations you had with other users, and the comments you wrote on their listings, remain — they are a shared record with another person — shown as “Deleted user” with nothing that identifies you.

  • Account data: while your account exists, and erased when you delete it.
  • Listings: while published or kept in your account, or while a report about them still needs review. When you delete your account, your listings and their photos are deleted.
  • Conversations: while both participants' accounts exist, because a conversation is a shared record that neither side can erase for the other.
  • Security records and session data: for as long as needed for security and abuse prevention.
  • Reports and the moderation record: kept to resolve reports and protect the platform from repeat abuse.

10. Your rights

The law gives you the following rights, which we honour free of charge:

  • Right to be informed: to know what we collect about you and why — which is what this policy sets out.
  • Right of access: to request a copy of your personal data.
  • Right to correction: to fix inaccurate data from your account settings, or by asking us.
  • Right to destruction: to delete your account yourself from your account settings — which also deletes your listings and their photos — or to ask us to erase specific data.
  • Right to withdraw consent: for any processing based on consent, at any time, without affecting processing carried out before the withdrawal.
  • Right to complain to the Saudi Data and Artificial Intelligence Authority (SDAIA) if you believe we have breached the law in processing your data.

11. Security

We apply reasonable technical and organisational measures to protect your data, including encrypted connections, hashed passwords, controlled administrative access, rate limiting, an audit record of moderation actions, and database backups.

No system is perfectly secure. If an incident affects your personal data, we will notify you and SDAIA as the law requires.

12. Children

The platform is intended for people aged 18 or over. We do not knowingly collect children's data, and we will erase it if we learn that we have.

13. Features we have not launched yet

We plan to add the following features. None of them is active today and none of them processes your data now. We list them so you know in advance what may change:

  • Usage analytics to understand how the site is used and improve it.
  • Location-based features, such as showing listings near you.
  • Phone-number verification, and an optional phone contact on a listing.

14. Changes to this policy

Before activating any new feature that processes your data, or when the law changes, we will update this policy and its date, and we will ask for your consent where the law requires it. If a change is material, we will tell you in-app or by email.

15. Contact us

For any question about this policy, or to exercise any of your rights, write to us from the address registered on your account at privacy@getsamh.com, and we will respond within the period the law allows.