Your data
Privacy Policy
This explains what zahabi.sa collects, why, who we share it with, and the rights you have over it under the Saudi Personal Data Protection Law (PDPL).
Last updated: August 2026
Who we are
zahabi.sa is a gold marketplace operated from Al Khobar, Kingdom of Saudi Arabia. We are the data controller for the personal data described here. To reach us about privacy, use the contact page.
What we collect from shoppers
When you reserve a piece we collect your name and mobile number, and we record the IP address and browser used, plus the result of the anti-bot check. Nothing else is required — you do not create an account and we never ask for card details. If you set a price alert we also store the WhatsApp number and the target price you chose.
What we collect from gold stores
When a store applies we collect the owner's name, email, phone and WhatsApp number, the business details (commercial registration and VAT numbers, address, city, opening hours) and the shop's location. Store accounts have an email and a password, which is stored only as a cryptographic hash — we cannot read it. Listings, reservations handled and subscription payments are recorded against the store.
Why we use it
To identify and confirm a reservation at the counter; to let a store contact a buyer about their own reservation; to review a store application and run the store's account; to take subscription payments; to prevent fraud and abuse; and to keep the audit record a marketplace needs. We do not sell personal data, and we do not use it for unrelated marketing.
Who we share it with
A reservation's name and number are shared with the store holding that piece — that is the point of reserving. Beyond that, we use service providers who process data on our behalf: Vercel (hosting), Supabase (database), Upstash (cache), Moyasar (payments), Cloudinary (image uploads), Cloudflare (anti-bot), Resend (email), Google (only if a store chooses Google sign-in), and CARTO/OpenStreetMap (map tiles). We share data with authorities only where the law requires it.
Card details
We never see or store card numbers. Payments are taken on Moyasar's own hosted page, and we receive only the payment's status and reference.
Cookies
We use a session cookie to keep a signed-in store account logged in, and a small cookie that remembers your language choice. We do not use advertising or cross-site tracking cookies.
How long we keep it
Reservations and their contact details are kept while the reservation is live and afterwards as a transaction record. Store account and payment records are kept while the account exists and then for as long as tax and commercial rules require. Blocked numbers are kept while the block is in force.
Where it is stored
Our database and hosting run on servers in the European Union, and some providers process data outside the Kingdom. Where personal data leaves Saudi Arabia we rely on the safeguards the PDPL allows for transfers.
Your rights
Under the PDPL you may ask what personal data we hold about you, ask us to correct it, ask us to delete it where we are not required to keep it, and withdraw consent. Contact us and we will respond within 30 days. If you are not satisfied, you may complain to the Saudi Data and Artificial Intelligence Authority (SDAIA).
Children
The service is intended for adults. We do not knowingly collect personal data from children; if you believe a child has given us data, contact us and we will delete it.
Changes
We may update this policy; the date above shows when it last changed. Material changes will be highlighted on the site.
Questions about your data, or want to exercise a right? Get in touch.
Contact Us