سياسة الخصوصية

Privacy Policy (English)

Last updated: October 27, 2026

This policy explains what personal data Sanam Agency (“Sanam”, “we”, “us”) collects, how and why we collect it, how we use, share, keep and protect it, and your rights. It applies to:

• Our website sanamagency.com and all its pages, including services, works, articles, careers, the academy and link pages, in Arabic and English (/en/).
• The agency’s client work system app.sanamagency.com, used for quotes, invoices, projects and electronic contracts.
• The Google OAuth app named “وكالة سنام” (Sanam Agency), which connects these two systems to the agency’s own Google Drive account (see Google user data).

Data controller: Sanam Agency, Kingdom of Saudi Arabia. Contact: info@sanamagency.com.

Data we collect and how

We collect the data you enter in our forms, and some technical data created automatically when you use the site:

Data you provide

• Service request form: name or organization, mobile number, email (optional), requested service and request details. We also store the page it was sent from and the sender’s IP address, to prevent spam.
• Job applications and CVs: full name, nationality, address, mobile number, email, desired role, CV, and a portfolio file or link.
• Newsletter: email address, language, the lists you choose (articles and/or courses), subscription date and IP address.
• Academy account: full name, email, mobile number and password, then your enrolled courses, lesson progress, quiz results and certificate number.
• Agency team accounts: name, email and password; for team members with a public link page (/links/…), the photo, name, bio and links they add themselves.
• Clients and collaborators of the work system: name or business name, contact person, mobile, email, address, national ID or registration number when needed for invoices and contracts, and the related quotes, invoices, payments and projects. They may receive a sign-in account by invitation from the agency.
• Signing a contract electronically: full name, mobile number, email (optional), ID number and expiry date, a photo or PDF of the national ID, and the signature.
• Online payments: card, Apple Pay or STC Pay details are entered in the payment form of Moyasar and sent directly to Moyasar; they never reach our servers. We receive only the payment ID, status and amount from Moyasar.
• Correspondence: what you send us by email or WhatsApp.

Technical data collected automatically

• Visit statistics (our own): we do not store IP addresses in statistics. The IP address, browser type and date are turned into a one-way daily code to count unique visitors, deleted after two days; we keep daily totals only: pages, referral source, device type and language. Agency staff are not counted.
• Cloudflare Web Analytics: aggregated performance and visit statistics from Cloudflare, without cookies.
• Security logs: after repeated failed sign-ins we keep the IP address and the username entered, to block break-in attempts (the last 50 cases only). IP addresses are also used temporarily to limit form submissions and sign-in attempts.
• Work system activity log: actions by signed-in users (who, what, when, and IP address) are logged for auditing and security.
• Message log: we log the messages the site and the work system send (recipient, subject or message type, delivery result) to follow up on delivery.

Cookies

We use no advertising or cross-site tracking cookies. We only use:

• sanam_lang: remembers the site language you chose (one year).
• Sign-in cookies for signed-in users of the website (WordPress) and the work system (sid), and a “trust this device” cookie for two-step verification (30 days).
• Strictly necessary security cookies that Cloudflare may set to protect the site.
• When you turn on browser notifications in the work system, OneSignal stores a notification subscription ID in your browser.
• Course videos hosted on YouTube or Vimeo may set their own cookies when played, under those platforms’ policies.

Why we use data

• To answer service requests, provide our services, contact you about them, and confirm we received your request.
• To review job applications and contact applicants.
• To run academy accounts and courses, track progress, and issue and verify certificates.
• To send new articles and courses to subscribers only, with an unsubscribe link in every email.
• To issue quotes, invoices and contracts, collect payments, and verify the identity of contract signers before approval.
• To send notifications about your services (email, WhatsApp, and browser notifications for users who enable them).
• To protect the site and the work system from spam and unauthorized access, keep backups, and comply with the law.
• To understand how the site is used, through aggregated statistics, and improve it.

We do not sell your data, use it for targeted advertising, or make automated decisions about you with it.

Google user data (Google Drive connection)

This section applies to the Google OAuth app named “وكالة سنام” (Sanam Agency), developed and operated by Sanam Agency and used by sanamagency.com and the work system app.sanamagency.com.

Who uses it: only the agency’s technical administrator, to connect the agency’s own Google Drive account from the dashboard. Visitors, clients, job applicants and students are never asked to sign in with Google, and we never access their Google accounts in any way.

Google data we access

• One scope only: https://www.googleapis.com/auth/drive.file. It gives access only to files and folders our app creates in Drive; it cannot read or change any other file in the account.
• The email address and display name of the connected Google account, read from the Google Drive API to show the administrator which account is connected.
• The OAuth refresh token and short-lived access tokens issued by Google.

We do not request access to Gmail, Contacts, Calendar or any other Google data.

Why we need it and how we use it

• Creating folders in the agency’s Drive (“سنام – طلبات التوظيف” and “Sanam Backups”).
• Uploading a copy of each job application there: the CV, the portfolio and a text file with the applicant’s details. Once uploaded, the files are deleted from the website server.
• Uploading backups of the website and the work system, restoring a backup when needed (for example, when moving the system to a new computer), and moving older backups the app created to the Drive trash, according to the number of copies the administrator chooses.
• Showing the connected account and upload status to the administrator.

Google user data is used only to provide these features and for no other purpose.

Sharing and transfer

We do not share, transfer or sell Google user data to any third party. We do not use or transfer it for targeted, personalized, retargeted or interest-based advertising; to data brokers or information resellers; for credit-worthiness or lending purposes; or to create databases. No person reads this data except the agency’s administrator when managing the connection, or when needed for security or to comply with the law.

AI and machine learning

We do not use data obtained through Google Workspace APIs, including the Google Drive API, to develop, improve or train generalized or non-personalized AI or machine-learning models, and we do not transfer it to anyone for that purpose.

Storage and protection

• Data travels between our servers and Google only over encrypted connections (HTTPS).
• The refresh token is stored in the website database and the work system database on servers operated by the agency; in the work system it is stored encrypted. The token is never shown on any page or sent to the browser.
• The connection screen is available to technical administrators only, and signing in to the website dashboard requires a verification code sent by email.
• The files themselves are stored in the agency’s own Google Drive.

Retention, deletion and revoking access

• The refresh token, email and name are kept only while the account is connected. Access tokens expire within one hour.
• When the account is disconnected from the dashboard, we ask Google to revoke the token and immediately delete it, together with the email and name, from our servers.
• The account owner can also revoke access at any time from Google Account permissions.
• Uploaded files stay in the agency’s Drive until the agency deletes them. Job applicants can ask us to delete their files from Drive and from the website by emailing info@sanamagency.com.

Limited Use

Sanam Agency’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Who we share data with

We do not sell data. We use the following service providers to run the website and the work system; each receives only what it needs to provide its service:

• Cloudflare: delivers and protects the website and the work system, and provides aggregated Web Analytics. All visits pass through it.
• Spacemail (Spaceship): sending and receiving email.
• Google Drive: storing copies of job applications and backups in the agency’s account, as described above.
• Moyasar: processing online payments.
• OneSignal: browser notifications for work-system users who turn them on (it receives the user ID and the notification text).
• WasenderAPI: sending service-related WhatsApp messages (mobile number and message text, and sometimes the signed contract file or a payment link).
• YouTube and Vimeo: when a course video hosted on them is played.

We may disclose data when required by a competent authority under the laws of the Kingdom of Saudi Arabia, or to protect our rights and the safety of users.

What is public: team link pages show what their owner adds, and the academy certificate check page shows the student’s name and course to anyone who enters the certificate number. No other data is shown publicly.

Retention

• We keep data for as long as needed for the purpose it was collected for, then delete it or make it no longer linked to you.
• Invoices, credit notes and signed contracts are kept for the period required by law (such as ZATCA requirements) and cannot be deleted before then.
• Job application files are deleted from the website server once copied to the agency’s Drive.
• Visit-statistics codes are deleted after two days; only daily totals remain.
• Newsletter data is kept until you unsubscribe or ask us to delete it.
• Backups contain a copy of the database and are replaced regularly, according to the number of copies the agency keeps.

Security

• Encrypted connections (HTTPS) on every page of the website and the work system.
• Passwords are stored hashed (Argon2id in the work system) and cannot be read by anyone.
• Signing in to the website dashboard requires a verification code sent by email, and repeated failed sign-ins are temporarily blocked.
• Access to data is limited to agency staff by role and permission.
• Private files such as CVs and ID images are kept out of public reach, and keys for external services are stored encrypted in the work system.

No transmission or storage method is completely secure, but we use reasonable measures to protect your data.

Your rights and how to delete your data

You can ask to access your data, get a copy of it, correct it, delete it, or withdraw your consent to its processing.

• Unsubscribe from the newsletter: use the link in any email.
• Update your account details: from your account page in the academy or the work system.
• Any other request, including deletion: email info@sanamagency.com from the address linked to your data; we will verify and complete the request within 30 days, except for data the law requires us to keep.

Changes to this policy

We may update this policy when our services or data practices change, and publish any change on this page with the last-updated date. If the way we use Google user data changes, we will update the Google section before the change takes effect.

Contact

Sanam Agency — Email: info@sanamagency.com — Website: sanamagency.com