Privacy Policy

01The two roles we play

For your account and how you use MySafha, we are the data controller — we decide how your information is handled, and this policy governs that.

For information a visitor submits to a website you publish with MySafha — for example, a message through your contact form — you, the business owner, are the controller, and we act as your processor, handling it on your behalf and on your instructions. You are responsible for telling your own visitors how you use their information.

02Information we collect

• Account: your email address, your name if you provide it, the sign-in identifier from Apple or Google if you use them, and your subscription status.
• Content you create: the text and images of the sites you build and publish.
• Waitlist: your email address and the language you signed up in, so we can tell you when we launch.
• App and diagnostics: basic device and usage information needed to keep the app working and secure.
• From visitors to sites you publish: cookieless, privacy-minimized analytics — a one-way hashed IP address, a coarse device type and browser family, and an approximate country — and anything a visitor chooses to submit through a form on your site.

03Fonts, cookies, and tracking

We self-host our fonts, so viewing a published MySafha site never sends the visitor’s IP address to Google or any font network.

Published sites carry no advertising or cross-site tracking cookies. Our analytics is a cookieless beacon that cannot follow a visitor from one site to another.

The app and dashboard use only strictly necessary cookies and local storage — for example, to keep you signed in.

04How we use information

• Provide, maintain, and secure the service, and authenticate you.
• Publish your sites and serve them to visitors.
• Send transactional email and owner notifications (for example, a new form submission).
• Measure aggregate performance and improve the product.
• Prevent spam, fraud, and abuse.
• Manage subscriptions and billing.
• Notify waitlist members when we launch.
• Comply with legal obligations.

05Legal bases (GDPR)

Where the GDPR applies, we rely on: performance of our contract with you (to provide the service); our legitimate interests (to secure the service, prevent abuse, and understand aggregate usage); your consent (for the waitlist and any optional messages, which you can withdraw at any time); and compliance with legal obligations.

06Sharing and sub-processors

We do not sell your personal information. We share it only with service providers who process it on our behalf, under contracts that require them to protect it and use it only to provide their service to us:

• Google Firebase / Google Cloud — authentication, database, and push notifications.
• Cloudflare R2 — storage and delivery of the images in your sites.
• Vercel — hosting for our website and service backend.
• Our email delivery provider — sending transactional and notification emails.
• RevenueCat — subscription management.
• Apple and Google — sign-in, if you choose it.

We may also disclose information if required by law or to protect the rights, safety, and security of our users and the service.

07International transfers

Some of our providers process data outside your country. Where information is transferred out of the EEA or UK, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses.

08How long we keep it

• Account and site content: kept while your account is active. When you delete a site or your account in the app, its content is removed.
• Visitor form submissions on your sites: enquiries are kept for up to 12 months and event or RSVP responses for up to 90 days, then deleted automatically.
• Analytics: kept only in minimized, aggregate form.
• Waitlist: kept until we launch and a reasonable period after, or until you ask us to remove you.

09Your rights

You have the right to access, correct, delete, and export your personal information, and to restrict or object to certain processing. You can delete your account and its data directly in the app. To exercise any other right, email us at privacy@mysafha.com.

If you are in the EEA or UK, you also have the right to complain to your local data protection authority.

10Security

We protect your information with least-privilege access — each part of our system holds only the credentials it needs — hashed visitor IP addresses, and encryption in transit. No system is perfectly secure, but we work continuously to keep your data safe.

11Children

MySafha is a tool for businesses and is not directed to children under 16. We do not knowingly collect their personal information.

12Changes to this policy

We may update this policy from time to time. We will post the new version here and update the date above, and we will let you know of material changes in the app or by email.

13Contact us

For any privacy question or request, email privacy@mysafha.com. MySafha is operated by [Company], [address].