Satrano Privacy Policy

Version: 1.0, Effective date: 21 October 2026

1. Who we are and what this policy covers

Satrano is an app on the Salla App Store. It gives merchants a cookie consent banner, generated policies, a consent log, a data-subject request inbox, and control of ad measurement tools until the shopper agrees. Satrano is based in Riyadh, Saudi Arabia, and can be reached at privacy@satrano.com ("Satrano", "we").

We handle personal data in two roles:

1. Controller: for the data of merchants who install the app and the people who act for them, and for visitors to the Satrano website.
2. Processor on the merchant's behalf: for shopper data collected through the consent banner and the data-subject request form. The merchant is the controller of that data. We process it only on the merchant's instructions and under our Terms of Use. If you are a shopper, please contact the store first; we will help it act on your request.

2. Data we collect

A. Merchant data (we are the controller):

1. Store data from Salla at install: store ID, store type, install status and dates, and the access tokens Salla grants us.
2. Subscription data from Salla: plan, price, start, end, cancellation and refund dates.
3. What you enter in the policy wizard and compliance helper: legal name, store name, registration type and number, national address, VAT number, licence details if any, contact email and mobile, privacy email, DPO name and email if any, and any processing record or legitimate-interest assessment you prepare.
4. Your banner and tool settings.
5. Technical data when you use the dashboard: IP address, browser details, request times and your login session.

B. Shopper data (we are a processor for the merchant):

1. Consent log: a random consent ID, the choice for each purpose, banner and consent version, language, page path, choice and receipt times, the browser identification string the shopper's browser sends, the country code where available, a truncated (not full) IP address, and a daily-salted hash of the IP address used only to detect abuse. We never store the full IP address.
2. Data-subject requests: email, name if given, request type and details, and the handling history. Email, name and details are stored encrypted; the verification code is stored only as a hash.
3. One cookie in the shopper's browser on the store's domain that remembers the choice for 180 days.

C. Satrano website visitors: technical data only, such as IP address, browser details and visit time. We use no analytics or advertising tools on our website.

3. How we collect data

1. From Salla at install and through the notifications Salla sends us, within the permissions you approve.
2. From you, when you fill in the wizard, the compliance helper or the settings.
3. From the shopper's browser, when the shopper uses the banner or the request form on your store.
4. Automatically, from technical requests that reach our servers.

Required wizard fields are needed to generate correct policies for your store; leaving them empty prevents generation. Optional fields may be left empty.

4. Purposes and legal bases

We do not sell data, we do not use shopper data for any purpose of our own, and we send no marketing without your separate consent.

5. Sharing and service providers

We share data only as far as needed with:

1. Oracle Cloud: hosts our servers and database in its Riyadh region, and sends our email from a Riyadh server, including shopper verification codes. Role: our processor.
2. Cloudflare and Google: Cloudflare manages our domain names; no connection content to our servers passes through it. Emails you send to our addresses are forwarded by Cloudflare to a Google mailbox. Role: our processors.
3. Salla: the platform your store runs on; it collects subscription payments and exchanges install and subscription data with us. Role: an independent party processing data under its own policies.
4. Uptime monitoring service: checks a technical endpoint on our server every few minutes and receives no personal data.
5. Competent government and judicial authorities: where the law requires it or on a lawful request.

Transfers outside Saudi Arabia: service data is stored and processed on our servers in Riyadh, and we do not transfer it outside Saudi Arabia. The exception is what you choose to email us, which may be stored by Google outside Saudi Arabia.

6. Storage, retention and deletion

Where: on Oracle servers in Riyadh, with a daily backup on the server and a copy on the Satrano owner's computer inside Saudi Arabia.

How long:

1. Store data, settings, answers and records: while the app is installed.
2. Access tokens and banner settings: erased as soon as the app is uninstalled.
3. Consent log: 24 months from each record, then deleted automatically.
4. Data-subject requests: unverified requests are deleted after 24 hours; closed requests 24 months after closing.
5. Error records, with personal data redacted: 90 days after the error was last seen.
6. Technical server logs: 30 days.
7. After uninstall: we keep the rest of your store data for 30 days so you can restore it by reinstalling, including your wizard answers, policies, consent log and requests, then delete all of it permanently, including the consent log and requests. It leaves our backups within a further 30 days at most, as the backup cycle rolls over.

How: deletion from the database, then the backup cycle, which removes older copies automatically.

7. Security

1. Connections to our services are encrypted.
2. Access tokens and data-subject request data are encrypted in the database.
3. We never store shoppers' full IP addresses.
4. Personal data is redacted from internal error alerts.
5. Server access is limited to the Satrano owner, with private-key login only; password login is disabled.

No method of transmission or storage is risk-free. If a leak, loss or unlawful access affects data we handle, we notify the competent authorities and the people concerned within the legal deadlines where we are the controller, and we notify the merchant without delay where we process for the merchant, as set out in the Terms of Use.

8. Your rights and how to use them

For data we control, you have these rights, free of charge:

1. To be informed of how and why we collect your data and on what legal basis, as this policy explains.
2. To access your data, within the limits the law allows.
3. To obtain a copy in a clear, commonly used electronic format.
4. To correct your data, or have it completed or updated.
5. To have it destroyed once we no longer need it, unless a law requires us to keep it.
6. To withdraw consent to any processing based on consent, without affecting earlier processing.
7. To complain, as set out in section 10.

How: email privacy@satrano.com from your store's registered email; we may ask for proof of your link to the store. We act within 30 days of receipt, and may extend once by 30 more days for unexpected effort or multiple requests, telling you in advance of the extension and its reason.

If you are a shopper: the store is responsible for your data. Send your request through the store's channels or its request form if it offers one, and we will help it. If you contact us directly, we will pass your request to the store and tell you so.

9. Cookies

1. On the merchant's store: one cookie that remembers your banner choice for 180 days. The banner sets it for the store; it is not used for tracking. The banner also keeps a temporary copy of its settings in browser storage, with no personal data.
2. In the dashboard: two necessary cookies for your login and its protection, which expire two hours after your last activity.
3. On the Satrano website and hosted policy pages: no analytics or advertising cookies.

10. Complaints

Email privacy@satrano.com with a short description. We will confirm receipt and reply within 15 days. If our reply does not satisfy you, you may complain to the Saudi Data and AI Authority (SDAIA), the authority that supervises the Personal Data Protection Law, through the National Data Governance Platform.

11. Updates and contact

We update this policy when our practices or the law change, and publish each update with its date and version. We notify you of material changes in the dashboard or by email before they apply. Privacy contact: privacy@satrano.com.