Privacy Policy

Effective May 22, 2026.

1. Who is the data controller

Salaaz Marketplace Inc. (registered office in Ontario, Canada) is the data controller for the personal information we collect when you use Salaaz. If you have a privacy question or you want to exercise a right under privacy law, the contact details are at the bottom of this page.

2. What we collect

• Account information. Name, email, password (handled by our authentication provider; we never see the plaintext password), language, and any profile photo you upload. If you sign in with a third-party identity (Google, Apple, Microsoft), the provider returns the standard profile fields you have authorized.
• Order and payment information. Shipping and billing addresses, items ordered, vendor(s) involved, totals, currency, taxes, and the last four digits and brand of the card used. Full card numbers are handled by our payment processor and never reach Salaaz servers.
• Activity on the platform. Items viewed, lists you build, vendors you follow, reviews you write, editorial articles you read, and search queries you submit. We use this to personalize your account dashboard and to improve the platform.
• Customer-service correspondence. Messages you send us through the contact form, the support email, or in-app channels, along with any attachments. Retained for the period needed to handle the case and to defend against subsequent claims.
• Technical information. IP address, browser and device characteristics, pages visited, referrer, and timestamps. Collected automatically through cookies and request logs; used for security, fraud prevention, and aggregated analytics.

We do not collect sensitive categories of data (health, biometric, religious belief, sexual orientation, precise geolocation beyond country/region) unless you explicitly provide them in a review or message.

3. Why we collect it, and our legal basis (GDPR)

• To run the marketplace: accounts, orders, payments, fulfilment, customer service, and dispute resolution. Legal basis: performance of the contract between you and Salaaz.
• To meet legal obligations: accounting and tax records, fraud prevention, responses to lawful requests. Legal basis: compliance with a legal obligation.
• To improve and secure the platform: aggregated analytics, A/B testing, security monitoring. Legal basis: our legitimate interest in operating a working, safe platform, balanced against your rights.
• To send the editorial newsletter and product updates: only where you have opted in, and only until you opt out. Legal basis: consent.

4. Who we share it with

We do not sell your personal information. We share what we need to share with the parties that help us run the platform, and only what they need to do their job. The categories below describe how data flows; the authoritative list of named subprocessors lives at salaaz.com/subprocessors and is the only file we update when a subprocessor changes.

• Vendors. When you place an order, the vendor of each item receives your name, shipping address, and the items they're fulfilling. Vendors do not see your payment details, your activity on other parts of the platform, or your activity with other vendors.
• Authentication provider. Handles sign-in, sessions, password reset, and MFA. Processes email, password hash, and session metadata.
• Payment processor. Processes card payments. Receives a card token, billing address, and order total. Full card numbers never reach Salaaz servers.
• Analytics providers (opt-in). Receive pseudonymous event data with IP anonymization where supported. The cookie-consent surface controls whether your visits feed analytics.
• Newsletter platform. Receives your email and subscription preferences if you have opted into the editorial digest.
• Address autocomplete. Receives the address text you type at checkout; the query is not associated with your Salaaz identity.
• Law enforcement. Where we are legally compelled. We require a valid lawful instrument and challenge over-broad requests.

Subprocessor notice. We notify account holders at least thirty days before adding a new subprocessor that processes account or order data, except where law requires immediate engagement (for example, a fraud response that requires onboarding a security vendor without delay). The subprocessors page carries an "as of" date that updates on every change.

5. International transfers

Salaaz is operated from Canada; some of our service providers process data in the United States and the European Economic Area. For transfers from the EEA/UK to a country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (SCCs) or the UK International Data Transfer Addendum, supplemented by encryption in transit and at rest, role-based access controls, and contractual commitments from our subprocessors.

6. How long we keep data

• Account data: for the life of your account, plus thirty days after closure to allow you to reopen.
• Order records: seven years from purchase, to meet Canadian tax-record obligations.
• Customer-service correspondence: three years from the last message in the thread.
• Reviews and editorial content you publish: kept for as long as the underlying product or article is live, unless you ask us to delete the content earlier.
• Technical logs: ninety days, then aggregated or deleted.
• Marketing-consent records: kept until consent is withdrawn, then retained for two years as evidence of the original consent decision.

7. Your rights

Subject to your jurisdiction's privacy law, you have the right to:

To exercise any of these rights, email general@salaaz.com from the email associated with your account. We respond within thirty days and typically much sooner. If we cannot verify identity we will ask for additional information before acting.

8. Cookies and similar storage

We use a small number of cookies and local-storage items for the platform to work, to remember your preferences, and (with your consent) to understand aggregate usage. The Cookie Policy covers the categories, specific names, retention, and how to change your consent at any time.

9. Security

We protect data with encryption in transit (TLS 1.2+) and at rest, role-based access controls, regular security review, and limited retention. Payment data is tokenized by our payment processor and never stored on our servers. No system is ever perfectly secure; if we discover a personal-data breach affecting your information, we notify the relevant regulator and, where required, you, within the timelines required by law.

10. Children

Salaaz is not directed at children under sixteen. We do not knowingly collect personal information from children. If you believe a child has registered, email general@salaaz.com and we will delete the account.

11. Changes to this Policy

We update this Policy when our practices, the law, or the platform meaningfully change. The effective date at the top reflects the current version. For changes that materially affect your rights we notify account holders by email.

12. Contact