Privacy policy

What we collect from company owners

The company data you enter: name, description, services, contact details, location, photos. This is shown publicly on your company page once published.

Your mobile number for login, and your name if you enter it. No passwords.

The commercial registration image, its number and your note when you request verification. They are not published; only the review team sees them.

IP address and browser user-agent for each login session, and the latest value per account, stored raw for security and investigation. Platform admins can see them.

What we collect from visitors

When you send an enquiry: your name, mobile number and message, plus a keyed hash of your IP address (not the address itself) to prevent abuse. The enquiry goes to that company: in its dashboard and, if notifications are on, to its email.

Aggregated statistics per company, daily and with no visitor identifier: view counts, contact clicks (WhatsApp, phone, email, map), clicks on the company's social accounts, which service started a chat, the page language, and a coarse traffic-source label (search engine, social account, our directory, direct, other) derived from the browser referrer — the referring address itself is never stored.

We do not log who browses pages, and we build no visitor profiles.

What we do not collect

No tracking cookies and no ads. Our only cookie is the session cookie for logged-in users.

The platform takes no payments, so we hold no card details at all.

We do not sell any data or share it for any marketing purpose.

How we use it

To run company pages and search, send your login code, deliver enquiries, review verification and tell you its outcome and any decision affecting your account, and protect the service from abuse.

Who processes data with us

Hosting and database: DigitalOcean, in a Frankfurt (Germany) data centre — your data is stored outside Qatar.

Network and protection: every request to the site passes through Cloudflare before our servers, which protects against attacks and speeds up loading, and sees your IP address and the request content in transit under its own policy. We read your real address from its header for account protection and rate limits, and store nothing with it.

Text messages: a provider that delivers to your number the login code and account notices (the verification decision or its withdrawal, a page suspended or reactivated, a change of sign-in number) — without the reason or any other detail, in the language of the dashboard you last opened. Email: Resend sends to the company inbox enquiry notifications (with the customer's name, mobile and message), the weekly summary, and account notices with their reason, processing them outside Qatar under its own policy. The platform team receives email alerts for a new verification request (company name and CR number) and a new report (company name and report reason, without the reporter's identity).

Writing assistant: when you use it, the company name, sector and the page text you ask it to write, improve, translate or review are sent to the AI provider DeepSeek, which processes them outside Qatar under its own policy. If you ask for a suggested reply, the message text is sent with your company profile and never the customer's name or number. If you ask for a message translation, the text and the customer's name are sent so the name can be written in the other script — their phone number is never sent in either case. Your mobile number is never sent, and none of this happens unless you press an assistant button.

Maps: a company page with a set location embeds a Google map, so the visitor's browser connects to Google directly and Google's policy applies. The location picker in the dashboard loads its tiles from OpenStreetMap, and address search goes through our server to OpenStreetMap (Nominatim) with the search text only.

Geographic blocking (if enabled by the admins): at signup or login the IP address is sent to ip-api.com to determine the connection country and network type; it stays in server memory for at most an hour and is not saved to the database.

Limits of what the AI writes

Everything the assistant produces — a description, tagline, services, a reply draft, a message translation — is machine-written text shown to you before anything is saved or sent. It never publishes or sends by itself.

Machine translation can be wrong: the original text stays displayed above the translation and is the reference, and the translation is shown with a visible warning beside it. Check it before committing to a price, a date or a condition.

The platform is not responsible for a decision based on machine-written text you did not review, nor for the accuracy of a translated message or page text.

Security

The login code is single-use and stored hashed, sessions are stored in a form that is useless if leaked, IP addresses in security logs are hashed with a secret, and uploaded images are re-processed to strip any hidden content.

Retention

IP address and user-agent in sessions: cleared after 90 days.

Login codes are deleted a day after they expire, and rate-limit records when their window ends: an hour or less, or a day for the per-number code ceiling.

Company data, enquiries and verification requests: while the account exists, or until you ask us to delete them — deletion is permanent, erasing the account, page, photos, enquiries and verification documents, while the page link stays reserved so no one can impersonate it.

Sent notifications (email or text): deleted after 90 days. Reports: deleted a year after they are resolved.

The security event log (logins, edits, admin decisions): kept for security and investigation, and it refers to mobile numbers by a keyed hash, not the number.

Your rights

From your dashboard you can edit your company data, delete its photos and unpublish it yourself.

To request a copy of your data, a correction, or deletion of your account and its data, email us at the address below with your registered mobile number and company link, and we will respond within a reasonable time.

Changes

Any material change is posted here with the Last updated date.