Privacy Policy

1. Data we collect

• Account: email, password (via our auth provider), country, language, and your mobile number, which is required on every account. Email confirmation is required. If you sign in with Google we receive your Google e-mail address and basic profile (name and picture) only.
• Profile: display name, city, bio, avatar, the visibility you choose for your mobile number (show/hide), optional contact links.
• Cattery: name, public slug, description, breeds, logo/cover images, and contact details you choose to publish.
• Cats & listings: name, breed, date of birth, colour/EMS code, photos, certificates, registration/microchip, price, status, pedigree, and litters/breeding records.
• Health records: per-cat health notes and any health documents you upload (stored privately; survive an identity transfer with the cat).
• Cattery review: cattery name and the registration/certificate image you upload (stored privately).
• Interactions: messages, comments, reviews and replies, reservation/inquiry details (incl. name and contact you provide), notifications.
• Store orders (where the Store is offered): the order and its status, delivery choice and city, the handover appointment and place, the veterinary certificate the breeder uploads, handover and report records, and invoices. Card details are entered on the payment gateway's page and never reach SANORIYAT; we keep only the payment reference, the kind of method, the amount and the status.
• Breeder payout details: IBAN, account-holder name and bank, for breeders who sell through the Store.
• Your acceptance of the Store's terms: when you accept the sale-and-refund terms by paying for a purchase, or the consignment agreement before offering a cat, we record the version you accepted, a fingerprint of its text, the amounts shown to you, the time, your IP address and your browser type, as evidence of the agreement.
• Communications: whether you chose to receive WhatsApp notifications, and the delivery status of e-mails we send you (delivered, bounced, and opened or clicked where that tracking is enabled).
• Consent & compliance: the terms/privacy version you accepted and when, age confirmation, and moderation/appeal records and an internal audit log.
• AI usage metadata: counts, model, token usage and cost (operational metering — not the content of your conversations).
• Technical: device/app and basic security and diagnostic data; our own page-view records (page path, a pseudonymous visitor id, and the referrer and campaign of your first visit); and a referral code kept in a cookie when you arrive through a partner's link.

2. How we use it & legal basis (PDPL)

• Provide and secure the platform — performance of contract / legitimate interests.
• Accounts, cattery review, messaging, marketplace discovery — contract.
• Store orders, payments, invoices, refunds and breeder payouts — contract / legal obligation (commercial and accounting records).
• Fraud prevention, abuse moderation, safety, audit — legitimate interests / legal obligation.
• AI-assisted features — your explicit consent (see §5).
• Product analytics and reliability/error monitoring — legitimate interests (pseudonymous; no advertising).
• Reaching you by e-mail or phone about your account, your cats and your orders — contract / legitimate interests. WhatsApp notifications — only with your opt-in, which you can withdraw in Settings.

3. Public vs. private information

Your cat, cattery, and listing content and your Reviewed Breeder status are public. Your mobile number is shown to signed-in members on your cats' and listings' pages so they can reach you, unless you set it to “Hide” in your profile; it is not shown to visitors who are not signed in. In the Store, the buyer learns who the breeder is, and the breeder sees the buyer's name and number, only after payment; if the sale is cancelled before handover the breeder's identity is hidden from that buyer again. Health records and documents, messages, reservations you receive, cattery-review documents, order and payment records, payout details, and account data are NOT public; access is restricted by row-level security, and private documents (health and cattery-review) are served only to authorised users via short-lived signed links.

4. Sharing & processors

• Hosting, database, storage, authentication — our cloud/database provider.
• AI features — Anthropic and/or OpenAI process documents/photos you submit to AI tools to extract or generate data only; per their terms this data is not used to train their models.
• E-mail — an e-mail delivery provider sends account, confirmation, order and notification e-mails on our behalf (it receives the recipient address and message content) and reports back whether each message was delivered.
• Payments — Tap Payments, a gateway licensed by the Saudi Central Bank, processes Store payments and refunds and receives your name, e-mail and mobile number for that purpose; where instalments are offered, the instalment provider you choose (Tabby or Tamara) processes your application under its own terms.
• Delivery — when you choose delivery, the courier who carries the cat receives your name, mobile number and city so the cat can be handed to you; and once an order is paid the buyer and the breeder see each other's name and mobile number to arrange the handover.
• WhatsApp notifications — Meta (WhatsApp Business Platform) delivers notifications to your number, only if you opted in.
• Product analytics — a privacy-first, EU-hosted analytics provider receives only a pseudonymous account id, your role, language, and the page path. It never receives your name, messages, photos, or other content, and uses no advertising cookies. Active only when we enable it. Our own page-view records stay with our database provider.
• Error monitoring & diagnostics — a provider receives technical error reports (and a pseudonymous id/role/locale tag) so we can keep the service reliable. It does not receive your messages or content. Active only when we enable it.
• Push notifications — a mobile messaging provider, only if you enable notifications.
• We do not sell personal data, and we do not use your data for advertising. We disclose data where required by law or to protect rights, safety, and the platform.

5. AI features & international transfers

Some processors (notably the AI providers) operate outside the Kingdom (United States). Where you use AI features, your submitted content is transferred abroad only with your consent, limited to the stated purpose, and subject to appropriate safeguards. You can use manual entry instead of AI.

Other operational providers (hosting, e-mail, payments, WhatsApp delivery, diagnostics) may also process limited data outside the Kingdom under appropriate safeguards. Our product analytics provider is hosted in the European Union.

6. Retention

We keep account and profile data while your account is active and as needed for legal, security, and dispute purposes after closure. Order, invoice and payment records are kept for the period required by Saudi commercial and tax rules. Cattery-review documents are retained only as long as needed to maintain status. Moderated/removed content is retained in restricted form for audit and safety. Operational logs are kept for limited periods. A detailed retention schedule is available on request.

7. Your rights (PDPL)

Subject to law, you may access, correct, delete, and port your data, withdraw consent, and object to certain processing. Submit a request via admin@sanoriyat.com or the in-app data-request form; we verify your identity and respond within the legally required period. Deletion may be subject to retention for legal or safety reasons.

8. Security

Access controls (row-level security), private storage for sensitive documents, encryption in transit, and least-privilege admin access. No system is perfectly secure; we will notify you and the competent authority of qualifying breaches as required by law.

9. Children

The platform is for users 18 or older. We do not knowingly process children's data and will delete such data on discovery.

10. Changes & contact

We version this Policy; material changes are notified and may require renewed consent. Contact: admin@sanoriyat.com. Data controller: the SANORIYAT establishment, CR 7055361617.