Privacy Policy

Your rights

You can use any of them at any time, free of charge. To get a copy of your data, correct it, object, or withdraw consent, email privacy@safqatna.bh from the email address on your account — we act only on requests from that address and reply only to it. A copy of your data goes to that address, locked with a password texted to your account’s verified phone — unless you ask us in writing to send it without one. We answer within 10 working days. Deleting your account and switching off promotional notifications you do yourself, in Settings.

• See your data — email us for a copy of everything we hold about you: the data itself, where it came from, why we use it, who sees it, and how any decision our systems make about you automatically is reached. We email it to your account’s address as a PDF locked with a password, and text the password to your account’s verified phone in a separate message. If your account has no verified phone, we ask you to add one first. We send a copy without a password only if you ask us to in writing, after we have explained the risk. Tell us once you have opened it and we have the text with the password deleted; otherwise we do that thirty days after sending.
• Correct it — change your name, phone number and addresses yourself in Settings; for anything else, email us what is wrong and we fix it.
• Erase it — delete your account from your privacy settings; "What erasure keeps" below explains the little the law requires us to keep.
• Object to processing — email us to stop using your data for something, and we stop or explain why we lawfully cannot.
• Withdraw consent — promotional notifications switch off in notification settings with one tap, as easily as they switched on; for anything else that runs on your consent, email us.

If we refuse a request and you disagree, you may complain to the Personal Data Protection Authority. The reason for any refusal is recorded and shown to you.

What erasure keeps

Erasing your account anonymises you rather than deleting history the law requires us to keep: order and payment records are retained under financial record-keeping obligations with your identity removed; our tamper-evident security log is retained as a safeguard — new entries store masked contact details only; and the messages you exchanged are kept as the other party's record of their own transaction, and as evidence if either of you raises a dispute — with your identity removed. A review you left keeps its rating and loses its words: the score stays with the transaction it describes, and the comment is deleted. Two kinds of copy outlast the moment we act, and neither is reachable from the site: your photographs, which are withdrawn immediately and then destroyed within thirty days, and our nightly backups, which are never rewritten — editing a backup would defeat its purpose — and instead expire on their own schedule. No copy survives more than thirty-one days, with two exceptions, both held by the companies that deliver our messages rather than by us. The emails we sent you — a code, a notice, or a copy of your data you asked for, with its file — stay at Postmark for up to forty-five days after they were sent, and cannot be deleted sooner; a copy of your data is locked with a password unless you asked for it without one. And text messages, because Twilio holds them, not us: we ask Twilio to delete the texts we sent you when we erase your account, and every text thirty days after we send it in any case — every text, that is, whose Twilio reference we recorded; after that, Twilio's own rules keep the phone number until one hundred and twenty days after each text was sent and the text until thirty days after, its backups and other systems can hold a deleted record for up to thirty days more, the copies Twilio keeps for its own purposes or in its error log follow Twilio's own retention rules, which we cannot shorten, and a text whose reference we never recorded stays with Twilio, by default with no end date.

Cookies

We set: sign-in cookies (required: your session, a security token for the sign-in form, and the page to return to after signing in), a language preference cookie (1 year), a random view-counting identifier (6 months) used only to avoid double-counting listing views and never stored with your account, and short-lived cookies used only while you sign up, sign in, confirm a code or add a passkey (from 1 minute to 1 hour).

What we hold, and why

Third parties

Your data is processed by the providers named here: Railway (application hosting and the database, Amsterdam, EU), Cloudflare R2 (photos, delivery evidence, and the nightly backup of the whole database, EU jurisdiction), Sentry (error reports, EU data region), Postmark (ActiveCampaign, United States) for email with Brevo (European Union, France/Belgium) as an automatic fallback, and Twilio (United States) for text messages. Error reports carry a technical description of the failure and your account identifier — never your name, email address, phone number or bank details. Verification codes and security notices sent by email are delivered through Postmark or Brevo; each receives only the message itself — your email address, the subject and the body — never our database or your browsing. A copy of your data that you ask for travels the same way, as a file attached to the message, locked with a password that only a text message carries — unless you asked us in writing to send it without one, in which case the file is readable; Postmark keeps the emails we send, attachments included, for up to forty-five days. Text messages are sent through Twilio, which receives only your phone number and the text itself. Twilio keeps its record of each text until we ask it to delete it, and we ask thirty days after the text is sent — sooner if we erase your account. Even then, Twilio's own rules keep your phone number in its systems until one hundred and twenty days after the text was sent, and the text itself until thirty days after, and a deleted record can stay in its backups and other systems for up to thirty days more. Twilio also uses message records — numbers and texts — for its own purposes, as an independent controller that decides those purposes itself: running and securing its service, preventing fraud and abuse (including training its own detection systems), meeting its legal obligations, and improving its products and its business reporting. It keeps those copies under its own retention rules, which it does not publish, and the phone companies that carry a text also handle its details under their own rules. When Twilio refuses a text, or a delivery report about a text runs into an error, Twilio's error log records the phone number — and, for a refused text, the text itself; Twilio does not commit to how long it keeps those entries, and we cannot delete them. If we never recorded Twilio's reference for a text — because Twilio did not confirm it when we sent it, or we failed to save its answer — we have nothing to ask Twilio to delete it by, so we do not ask, and Twilio keeps it, number and text, until it is deleted, which by default means with no end date. Our texts are one-way — nobody can reply to them — and we send only the codes you ask for and alerts about your account — and, when you ask for a copy of your data, the password that opens it. To stop texts to your number, contact support; buying and listing then need a verified number again. The United States is on Bahrain's adequacy list under Resolution 42 of 2022, and the transfer is also necessary to perform our contract with you. Payment capture is still simulated, so no payment provider receives your data. If you sign in with Google or Apple, that provider processes the sign-in under its own policy. Before any payment gateway is engaged, this policy and our processing register will name it.