Privacy Notice

1. Who is responsible for your information

Sbsial Portal L.L.C., Dubai, United Arab Emirates, is responsible for the personal information described in this Privacy Notice. We refer to the company as “Sbsial”, “we”, “us” or “our”. You can contact our team about privacy, your information or this notice at privacy@sbsial.com. General service enquiries can be sent to support@sbsial.com.

This notice covers personal information processed through our app, related websites and Help Center, social features, subscriptions, paid interactions, auctions and creator services. It also applies when you contact us or exercise your privacy rights. It explains our practices alongside the General Terms; it is not a request for blanket consent. Where a feature requires separate consent or additional information, we provide the relevant notice at that point.

2. Information we collect and where it comes from

We receive information directly from you, through your use of the service, from people who interact with you, and from providers involved in delivering or verifying a service or transaction. The information depends on the features you use:

• Account and profile information: email address or phone number, sign-in and recovery information, profile details, account preferences, and age or eligibility information. Sign-in is by email and password or by phone number and a one-time verification code.
• Content and communications: posts, stories, moments, images, video, audio, Podcast posts, chat messages, shared contacts and locations, livestream contributions, and related audience settings, timestamps and delivery information.
• Activity and technical information: views, likes, follows and other interactions; IP addresses, device and application information, session identifiers, messaging tokens, usage records, error information and security logs.
• Transaction and creator information: purchase and subscription records, balances and entitlements, provider references, refunds, disputes, payout information, and identity or tax information needed for the creator service or applicable compliance requirements.
• Support, safety and legal records: enquiries, reports, supporting evidence, review outcomes and records of consent or agreement acceptance, including the relevant version, language and time.

Uploaded files may contain embedded information such as creation dates, authorship, camera details and location coordinates. Our media processing can extract and retain this information with the media record. Removing metadata from a displayed or delivered file does not necessarily remove it from the stored record. Check the files you upload if they may contain information you do not wish to share.

Content or evidence you submit may include sensitive information about you or another person. Share only what is needed for the feature or request. Where the law gives particular categories of information additional protection, the applicable conditions must be satisfied before that information is processed. Making information public does not waive all privacy rights.

Some information is necessary to open and secure an account, deliver the feature you request or meet a legal requirement. If you do not provide it, we may be unable to provide that account, feature or transaction. Optional profile details, optional permissions and marketing choices are handled separately; declining them does not by itself prevent use of unrelated features.

3. Device permissions and information you choose to share

We request access needed for the feature you choose to use. You can manage permissions in your device settings. Withdrawing a permission limits the associated feature but does not automatically remove information you previously submitted.

• Camera and photo library: access is used when you choose to capture or select media for a post, story, chat, profile or another supported sharing feature. We process the media you submit and its associated information.
• Microphone: access is used when you choose to record audio or speak in an audio livestream. The audio is made available to the relevant recipients or livestream audience.
• Location: you can share a location in chat or attach it to content. We request device-location permission when that feature needs it. We do not use that permission for background tracking of your movements. Location you share is available to the recipient or content audience. Embedded location information in uploaded files is covered in Section 2.
• Contacts: when you choose to send a contact in chat, we request the relevant device permission. Sbsial receives only the contact details you select to send and shares them with the recipient; this feature does not upload your full address book.
• Clipboard: we read clipboard content only when you choose to paste it into the app. We do not read it automatically.
• Notifications: your device permission controls whether push notifications can be displayed. Promotional notifications also require the separate marketing choice described in Section 7.

Google Maps and Apple Maps support our location features. Information needed to provide their mapping services is processed under their applicable terms and privacy notices. A device permission allows access for the selected feature; it does not authorize unrelated use of your information.

4. Visibility, messages and audio livestreams

Content is made available through the audience and access controls supported by the feature. Public posts and profile information can be viewed, copied and shared by other people, including outside Sbsial. Messages and other directed communications are available to their recipients. Recipients may keep copies or share what they receive; changing an audience setting or deleting content cannot recall every copy already made by someone else.

A private or paid feature limits who may access it through the service. It does not guarantee secrecy, prevent screenshots or establish end-to-end encryption. We process communications and related records as needed to deliver them and, where justified, investigate reports, resolve service disputes, protect users or comply with law. Staff access must be limited to an authorized purpose; this notice does not authorize unrestricted inspection of private communications.

Audio livestreams run on infrastructure we operate. The creator chooses whether to record the stream using a setting that is off by default. If enabled, the recording is saved after the stream ends, and the creator may publish it as a Podcast post. The recording may include other speakers’ voices. Before recording, the host must explain the recording and possible Podcast publication and obtain each speaker’s express confirmation of agreement. A speaker who joins later must confirm before speaking. Device microphone permission alone does not provide that agreement. We do not currently record livestreams for moderation purposes.

When you submit information about another person, including a contact, image, voice or message, you must have the authority required to share it and respect that person’s privacy. This obligation does not reduce Sbsial’s responsibilities for information it processes. Someone who appears in content or is named in a report may contact us even if they do not have an account.

5. Why we use information and our lawful grounds

We use information to operate accounts, deliver content and communications, provide purchased services, verify transactions and creator eligibility, administer subscriptions and payouts, answer support requests, protect the service, resolve disputes and meet applicable legal obligations. We also use activity to recommend content and measure service performance.

The legal basis must match the purpose and the law that applies. Where these grounds are recognized by applicable law:

• Performance of our agreement: we process information necessary to provide the account, communications, purchased access and other services you request, or to take steps you request before entering an agreement.
• Consent: we rely on your separate opt-in for promotional emails and push notifications, and obtain consent for other processing when required. You can withdraw consent through the relevant controls or by contacting us.
• Legal obligations: we process information necessary to comply with applicable accounting, regulatory and other legal duties, binding lawful requests and legally required preservation of records.
• Legitimate interests, where permitted: our interests include securing the service, preventing fraud and abuse, enforcing service rules, resolving claims, measuring performance and recommending relevant content. Reliance on this ground requires the processing to be necessary and a balance against your rights, with particular care for younger users. It cannot replace consent where the law requires consent.

Where a law requires consent or a particular statutory exception instead, that requirement governs the processing. We do not treat acceptance of the General Terms as consent to every use of information. A new purpose requires an appropriate legal basis and any further notice or consent required by law.

6. Recommendations and service restrictions

We use activity such as views, likes and follows to assess relevance and rank content in your feed. The content you see may therefore differ from another person’s feed and may change as your activity changes. We do not currently offer a following-only or chronological feed setting. You can contact our privacy team to exercise any applicable right to object to this processing; the absence of an in-app switch does not remove that right.

Our team reviews decisions to remove published content or suspend accounts before taking those actions. Service restrictions follow their own rules. Interaction bans require administrator review and approval, after which the system enforces the restrictions. Repeated failure to meet winner-payment deadlines in auctions can automatically restrict further bidding under the auction terms. These actions use relevant service, report and transaction records and are separate from suspension of the platform account.

If you believe a restriction is based on incorrect information or should be reconsidered, contact support and explain the issue. Where applicable law gives you rights concerning a decision made solely by automated processing with legal or similarly significant effects, you may request the relevant explanation, human review and opportunity to contest it. These rights apply when the legal conditions for them are met.

7. Advertising, marketing and service messages

Advertisements are managed through our Ads Manager and are currently displayed without personalized targeting. Advertisers receive aggregate campaign results, such as impressions and clicks, rather than individual user information. Personalized content recommendations are separate from advertising. We do not currently use third-party analytics or crash-reporting services, or external AI services to process users’ content, messages or personal information.

Promotional emails and push notifications to app users require opt-in for the relevant channel. You can change email and push choices separately under “News & offers” in the app’s notification preferences. Promotional emails include an unsubscribe link. We retain records of choices and changes and check the relevant preference before sending. Allowing notifications on your device does not by itself subscribe you to marketing.

You may stop direct marketing at any time, free of charge. Use the preferences or unsubscribe link, or contact privacy@sbsial.com. We may keep the limited record needed to respect your choice and avoid sending further marketing. Turning off marketing does not turn off necessary account, verification, security or transaction messages. Other service-notification controls apply separately.

8. Creator verification, purchases and payouts

Our own team reviews creator identity documents. Working copies are deleted once the review is complete, whether the request is approved or rejected. We may retain the outcome and limited evidence needed to document the verification or meet a separate lawful requirement. Pending documents may be included in a weekly backup and remain there until that backup’s 28-day retention period ends. Documents deleted before a backup is made are not included in it.

Apple and Google handle payment credentials for purchases billed through their stores. We receive the transaction, receipt and entitlement information needed to deliver the service, reconcile purchases and handle supported refunds or disputes. A store purchase does not give us your full payment-card number.

For Stripe payments, Stripe handles card details through its payment interface. We retain transaction records and limited payment-method information, such as provider references, card brand and the last four digits. Stripe’s own processing is described in its Privacy Policy. Deleting a Sbsial account does not automatically delete information held by a store or Stripe under its own responsibilities.

Creator payout information is processed for the applicable payout and verification process. Financial terms are provided in the relevant service agreements. Do not send passwords, verification codes or complete card details in support messages. We may need to preserve transaction or verification evidence when a payment, legal obligation or dispute remains unresolved.

9. Who receives information

We disclose information needed for the purposes described in this notice to the following recipients:

• Other users and creators: the people who receive your content or communications, and creators who receive subscriber or interaction information needed to provide the relevant service. This does not give creators access to unrelated account information or your payment credentials.
• Infrastructure and communications providers: AWS for hosting and storage, Amazon Simple Email Service (SES) in eu-west-1 for account-verification and security emails, Twilio for SMS verification codes, and Google’s Firebase Cloud Messaging for push notifications. These services process the relevant addresses, phone numbers, messaging tokens, message content and delivery information needed for their functions.
• Mapping and transaction providers: Google Maps, Apple Maps, Stripe and the relevant app store, as described above. Independent providers may be responsible for their own processing under their privacy notices.
• Our authorized team: staff who need information for support, creator verification, moderation, security, administration or a lawful request.

We may also disclose relevant information where required by a binding lawful request or court order, or where a lawful and necessary disclosure protects people’s safety, addresses fraud or abuse, or establishes, exercises or defends legal claims. We assess the request and limit disclosure to its lawful scope. Where law permits and requires it, we provide the appropriate notice.

If ownership or operation of Sbsial changes through a merger, acquisition, reorganization or transfer of assets, relevant information may be disclosed for the transaction or transferred to the successor subject to confidentiality, an appropriate legal basis and applicable privacy requirements. A business transfer does not remove existing rights or permit an incompatible new use without the legal steps that use requires.

Aggregated reports are treated as anonymous only when individuals cannot reasonably be identified under the applicable legal standard. Information that still allows identification remains subject to the relevant privacy protections.

10. International processing

Production services and user content are hosted on AWS in Europe (Ireland), eu-west-1. Our team accesses user information from the UAE for support, moderation and creator verification. External providers may process information necessary for their services in other countries. Hosting in Ireland therefore does not mean all processing takes place there.

A transfer subject to legal restrictions requires the applicable transfer mechanism and safeguards. Depending on the transfer and law, these can include an adequacy decision, approved contractual clauses and any additional protections required. The relevant provider agreement determines which contractual safeguards apply to its processing. Sbsial remains responsible for the transfer requirements that apply to its own activities.

Relevant provider provisions are published in the AWS Service Terms, Firebase Data Processing and Security Terms, Stripe Data Processing Agreement and Twilio Data Protection Addendum. Their application depends on the service and agreement in use. Contact our privacy team for information about processing locations and applicable safeguards, including a copy where available, subject to lawful confidentiality limits. Acceptance of the General Terms alone is not consent to a restricted transfer.

11. How long we keep information and what deletion means

We retain information for the period necessary for the stated purpose or required by law. We consider the type of record, the service or transaction involved, accounting and other legal requirements, relevant claim periods, unresolved refunds or disputes, safety needs and any legal hold. Once no lawful retention basis remains, we delete the information or remove identifying details as appropriate.

Account deletion: the account and content are removed from normal visibility while the request is processed. You have 30 days to explicitly cancel the request; signing in alone does not cancel it. A further 30-day retention period follows. At the end of that period, 60 days after the deletion request, we automatically permanently delete the account unless a legal hold or other applicable legal requirement prevents deletion. Any delay must be limited to the information and period needed for the lawful reason. Deletion proceeds when that reason ends unless another lawful retention basis applies. This timetable does not extend a deadline that applies to a valid privacy-rights request.

Records that may remain: necessary transaction, payment, verification-outcome, agreement-acceptance, consent, dispute and safety records can remain under their separate lawful retention rules. We restrict them to the purpose justifying retention. Deleting an account does not require destruction of every record of a completed transaction or legal obligation, and does not delete copies held independently by recipients or transaction providers.

Backups: backups are created weekly and each is retained for 28 days. Information removed from live systems may remain in an existing backup until it expires. If a backup is restored, earlier deletions are reapplied so deleted accounts or documents do not become available again. Backup retention is separate from the account’s recovery and retention periods.

Content availability: a story’s display period, removal from a feed or withdrawal of access is not the same as deletion from every system. Copies in backups or records lawfully needed for a report, dispute or legal duty may remain for their applicable period. Creator verification documents follow the working-copy and backup rules in Section 8.

12. Security, cookies and local storage

We use technical and organizational safeguards appropriate to the information and its risks, and limit access according to purpose. Our safeguards and response measures must remain proportionate to the service and applicable legal duties. No transmission or storage method is completely secure. Report suspected unauthorized access or disclosure promptly to support or our privacy team. We investigate incidents and provide notifications required by law.

Sessions and related local storage support functions such as authentication and preferences. The Help Center also uses preference cookies for functions such as language and navigation. You can manage browser storage and cookies in your browser settings, although blocking or clearing necessary storage may affect those functions. Any non-essential tracking that legally requires consent needs separate consent; this notice is not that consent.

Protect your credentials and device, and consider what may appear in notification previews or on a shared screen. External websites opened through advertisements, links or shared content have their own practices. Their processing is governed by their own notices, and their access is not authorized merely because the link appears on Sbsial.

13. Your rights and how to make a request

The rights available depend on the law, information and processing involved. They may include:

• Access to your personal information and information about its use, and a copy in the form required by law.
• Correction of inaccurate information and completion of incomplete information.
• Deletion, restriction of processing, or portability of eligible information.
• Withdrawal of consent and objection to processing based on legitimate interests, including applicable profiling.
• Objection to direct marketing, and any applicable opt-out rights for particular uses or disclosures.
• Safeguards for qualifying automated decisions, including human review and the opportunity to contest a decision.
• A complaint to the competent data-protection authority and any other remedy available under applicable law.

Contact privacy@sbsial.com or use the relevant account controls. Identify the account and explain your request. Our own team handles these requests. You do not need to use legal terminology. We may ask for proportionate information to confirm your identity or authority, particularly before releasing information or acting for another person; do not send unnecessary identity documents.

We respond within the applicable legal deadline. Requests are generally handled free of charge; a fee or refusal is permitted only where the applicable law allows it. If we cannot fulfil all or part of a request, we explain the applicable reason and available review or complaint route, unless law prevents that explanation. Any lawful extension is communicated as required.

Rights can be limited by a legal duty to retain information, protection of another person’s rights, or another applicable statutory exception. Such limits must be relevant and proportionate. Withdrawal of consent does not invalidate earlier lawful processing, and it does not require us to erase information retained on a separate lawful basis. We do not impose an arbitrary refusal or require you to abandon an unrelated service to make a request.

Objecting to recommendations: where the law gives you a right to object to legitimate-interest processing, tell us about your particular situation. We assess the objection and stop the affected processing unless the law permits continued processing on the required grounds. Direct-marketing objections do not require that balancing exercise: we stop the marketing concerned.

If an authorized agent, guardian or other representative acts for you, we may request evidence of authority and any verification permitted by law. A guardian’s request must also respect the child’s own rights. You retain the right to contact a competent authority without first completing our support process. Where relevant, you can find UK complaint information through the Information Commissioner’s Office and EU/EEA authorities through the European Data Protection Board’s authority directory.

14. Younger users

Account access, purchases and creator services are subject to the eligibility requirements in the General Terms, applicable law and the relevant service or provider conditions. Where law requires permission for a younger user’s participation or consent for processing their information, that requirement continues to apply. Authority to make a purchase is separate from a lawful basis or consent for personal-information processing.

Younger users should avoid sharing addresses, identity documents, private contact details or other sensitive information in public content. A parent or guardian who believes a child has an ineligible account or that information has been collected unlawfully should contact our privacy team. Where we learn of ineligibility or unlawful collection, we take the action required by applicable law, including restriction or deletion where appropriate. We do not treat a guardian’s involvement as a waiver of the child’s privacy rights.

15. Changes, questions and complaints

The version and effective date shown with the published notice identify the applicable notice. We may update it to reflect changes in the service, processing or legal requirements. We give appropriate notice of material changes and obtain further consent where required before carrying out the changed processing. Continued use does not replace a consent that law requires, and an update cannot retrospectively expand an existing consent.

For questions, privacy requests or complaints, contact privacy@sbsial.com. This notice does not exclude mandatory privacy rights, available remedies or the responsibilities of Sbsial under applicable law.