SHOF Privacy Policy
This policy explains how Shof Global F.Z.E ("SHOF", "we", "us") collects, uses, shares and protects personal data when you use the SHOF mobile app and the website shof.site (together, the "Service"). We apply the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the "PDPL") and its implementing rules as they apply to us.
1. Who we are
The controller of your personal data is Shof Global F.Z.E, a free zone establishment registered in the Ajman Free Zone, United Arab Emirates. Privacy contact: [email protected].
2. Data we collect
| Category | Examples | Source |
|---|---|---|
| Account data | Name, email address, password (stored only as a secure hash), profile photo, username, role (buyer or seller) | You, or your Google account if you sign in with Google |
| Content you post | Videos (reels), thumbnails, titles, descriptions, captions, product details, prices, comments, likes, follows | You |
| Transaction and contact data | Orders, delivery details, messages with sellers or support | You |
| Device and usage data | Device model, operating system, app version, IP address, crash logs, actions inside the app, timestamps | Automatically |
| Moderation data | Still frames taken from videos you upload, AI screening result, reason for any rejection, reports made by other users | Automatically and from other users |
A seller's WhatsApp number is always shown publicly on their profile and on every reel they post, so buyers can message them. There is no setting to hide it.
We do not intentionally collect payment card numbers in the app unless and until a payment feature is added. If we add one, a licensed payment provider will process card data and we will update this policy first. We do not collect biometric data, health data or precise location unless you choose to give a feature permission to do so, and we will tell you what it is used for at that moment.
3. How we use your data and our legal bases
- Provide the Service (create and secure your account, show your content, connect buyers and sellers). Basis: performing our contract with you.
- Keep the platform lawful and safe (review videos against UAE law and our content rules, prevent fraud, spam and abuse, handle reports). Basis: legal obligations and our legitimate interest in a safe platform.
- Communicate with you (verification emails, password resets, service notices, support replies). Basis: contract and legitimate interest.
- Improve the Service (fix bugs, measure performance). Basis: legitimate interest, using the minimum data needed.
- Comply with law (respond to lawful requests from UAE authorities, keep records). Basis: legal obligation.
- Marketing messages and push notifications. Only where you have agreed. You can withdraw consent at any time in your device settings or by contacting us.
Where we rely on your consent, you may withdraw it at any time. Withdrawal does not affect processing already done.
We do not sell your personal data. We do not use your data for advertising profiling by third parties.
4. AI video screening
When a seller uploads a video, the app captures several still frames from it. These frames, together with the title, description and caption, are sent to an automated screening service to check the video against UAE law and our content rules — Google Gemini by default, with Anthropic's Claude available as a configurable alternative provider. The result is one of: approved, rejected, or sent to a human administrator for review.
- A rejection can be reviewed. You may ask a human administrator to re-check it by contacting us.
- Where the AI is unsure, or where other checks flag the content, a human administrator decides.
- We use the free tier of the service. Under Google's free-tier terms, Google may use submitted content to improve its products. Do not upload frames showing people who have not agreed, identity documents or other sensitive material. We intend to move to a paid tier that does not use your content for training when our resources allow, and will update this policy when we do.
- Screening results are advisory tools for moderation. They do not create any legal finding about you.
5. Who we share data with
We share data only as needed to run the Service, with these categories of recipients:
| Recipient | Purpose |
|---|---|
| Supabase Inc. (hosting, database, authentication, file storage, server functions) | Stores account data and content; runs sign-in |
| Google LLC (Google Sign-In, Gemini API and Google Analytics) | Optional sign-in with Google; AI screening of video frames and text; website analytics |
| Anthropic, PBC (Claude API) | AI screening of video frames and text, when configured as the screening provider instead of Gemini |
| Expo / Expo Application Services (app build and updates) | Delivering the app and updates; crash and diagnostic data |
| Email delivery provider | Sending verification and service emails |
| Other users | Your public profile and the content you publish are visible to others |
| UAE authorities, courts, regulators | When we are legally required, or to protect rights, safety or property |
| Successors | In a merger, sale or restructuring, subject to this policy continuing to apply |
These providers act on our instructions and are bound by data protection terms. We do not allow them to use your data for their own marketing, except as stated in section 4 for the free AI tier.
6. International transfers
Our providers operate servers outside the UAE, including in the United States and Europe. When we transfer personal data outside the UAE we do so as the PDPL allows, for example to countries or providers offering an adequate level of protection, under contractual safeguards, or with your consent where required. By using the Service and agreeing to this policy, you acknowledge these transfers.
7. How long we keep data
- Account and profile data: while your account is active, then deleted or anonymised within 90 days of account deletion.
- Content you posted: until you delete it or your account is deleted, subject to the next bullet.
- Moderation records, reports and disputes: up to 24 months, or longer where needed for a legal claim or a legal duty.
- Transaction records: as long as UAE accounting and commercial law require.
- Screening frames: stored with your video while it is on SHOF, and deleted when you delete the video or your account, except where a video is in dispute.
- Backups: deleted in our normal backup cycle.
8. Your rights
Subject to the PDPL and its exceptions, you may:
- ask for access to the personal data we hold about you and information about how it is processed;
- ask us to correct inaccurate data or complete incomplete data;
- ask us to delete your data, or restrict or stop processing it;
- withdraw consent where we rely on it;
- ask for your data in a portable format, where applicable;
- object to processing based on automated means, and ask for human review of an automated moderation decision;
- complain to the UAE Data Office or the competent authority.
Deleting your account. You can request deletion of your account and data by emailing [email protected] from the address on your account, with the subject "Delete my account". We will confirm and complete deletion within 30 days, apart from data we must keep by law. We may ask you to verify your identity first.
We respond to requests within the time the law requires. We may refuse a request that is unfounded, excessive or protected by a legal exception, and will explain why.
9. Children
The Service is not for anyone under 18. We do not knowingly collect data from children. If you believe a child has given us personal data, contact us and we will delete it. You must not upload videos in which an identifiable child appears without the consent of a parent or guardian, and our screening may reject such videos.
10. Security
We use measures suited to the risk, including encrypted connections (HTTPS/TLS), hashed passwords, row-level access controls on our database, restricted staff access and secret keys held only on the server. No system is completely secure. If a personal data breach is likely to harm you, we will notify you and the authority as the PDPL requires.
11. Device permissions and storage
The app may ask for access to your camera, microphone, photos or files so you can record and upload videos, and for notifications. You can refuse or change these in your device settings. The app stores a sign-in session on your device so you stay signed in. Our website shof.site uses cookies and similar technology that are necessary for it to work, and analytics tools (Google Analytics and our hosting provider's visitor analytics) that count visits and show which pages are used. These collect your IP address, device and browser details and pages viewed. You can block or delete cookies in your browser settings, and you can opt out of Google Analytics with Google's browser add-on.
12. Changes to this policy
We may update this policy. For material changes we will notify you in the app or by email before they take effect. The "last updated" date above shows the current version. Continued use after the effective date means you accept the update, except where the law requires fresh consent.
13. Contact
Shof Global F.Z.E, Ajman Free Zone, United Arab Emirates
Email: [email protected]
Website: shof.site
See also our Terms of Service, published at the same address as this policy.