Privacy policy
Draft — final wording under legal review before launch.
This policy explains what personal data Sawnly collects, why, where it is kept, and the choices you have. We follow the Egyptian Personal Data Protection Law (No. 151 of 2020) and the Saudi Personal Data Protection Law (PDPL). Person profiles are consent-first: individuals choose whether to appear publicly and can unlist at any time.
What we collect
Account: your email address and, if you sign in with Google, the name and profile picture Google shares with us. Your password is stored only as a one-way hash; nobody at Sawnly can read it.
Sign-in sessions: while you are signed in we keep a session record with the IP address and browser type it started from, so we can protect your account and end sessions you no longer recognise.
What you add to the platform: company profile details, services, requests and their replies, reviews, uploaded files, and verification documents. Request contents are visible only to the two parties involved. Verification documents are stored privately and seen only by the platform review team.
The weekly digest: your email address and preferred language, only after you confirm the subscription from the email we send.
We do not run advertising or third-party analytics, and we never sell or rent personal data or contact details.
Why we use it
To run your account and sign you in; to show company profiles and deliver requests between companies; to review verification applications; to send the emails you need (sign-in links, request updates) or asked for (the digest); and to keep the platform secure — for example, limiting repeated sign-in attempts.
Cookies
We use only the cookies the site needs to work: a session cookie that keeps you signed in, and a cookie that remembers your language. No advertising or tracking cookies.
Who processes data for us
Our servers and database are hosted by OVHcloud. Emails are delivered by Resend. If you choose "Continue with Google", Google handles that sign-in under its own privacy policy. These providers process data only to deliver their service to us.
How long we keep it
Sign-in sessions last at most 30 days and are removed when they expire or when you sign out. One-time email links expire within 24 hours. Your account and company data are kept while your account is active; when you ask us to delete your account, we delete it or, where records others rely on must remain (such as a completed request or a published review), we remove your personal details from them.
Your rights
You can ask to see the personal data we hold about you, correct it, or delete it, and you can withdraw consent at any time — every digest email has a one-click unsubscribe link, and person profiles can be unlisted from your dashboard. To make a request, contact us through the Contact page; we reply within 30 days.
How we protect it
All traffic is encrypted (HTTPS). Private files are reachable only through short-lived signed links issued after a permission check. Every administrative action is recorded in an audit log. Database backups are taken daily.
Changes to this policy
If we change how we handle personal data, we will update this page and, for significant changes, tell account holders by email.