Privacy Policy

We collect information you provide directly, including your name, email, phone number, avatar, and bio when you create an account, and payment or transaction details when you make a booking (processed by our payment providers - Scripto does not receive or store your full card number). If you register as a professional, company, government entity, or training provider, we may collect additional business information, portfolio content, trade license details, and verification status. We automatically collect certain technical information, including your device type, IP address, browser type, pages visited, and interactions with the platform. If you enable push notifications on our mobile app, we store a device push token to deliver them; we do not collect your precise location. We also store content you choose to upload or send, such as listing photos, profile images, portfolio files, and messages sent through our chat feature. We also record the IP address your account was created from and the IP address of your most recent sign-in, together with the approximate country and city that address suggests, and the browser or app you used. This is kept so that we can investigate fraud, account takeover and coordinated abuse - for example, recognising that a group of accounts share a single origin. It is visible only to Scripto administrators; it is never shown to other users and never appears on your public profile. An IP address is an approximate signal, not an identity: it can belong to a VPN, an office, or a mobile network far from where you actually are. We do not and cannot collect your device's MAC address - it is a local network identifier that never reaches our servers.

We use your information to: - Provide and improve our services - Process bookings, tenders, and payments - Send transactional communications and push notifications - Personalize your experience - Verify user and business identities - Prevent fraud and abuse - Comply with legal obligations - Send marketing communications (with your consent)

We share information with: - Other users as necessary to facilitate a booking, tender, or conversation (for example, your contact details with a provider you book) - Our payment processors, Stripe and PayTabs, to process transactions - they receive the payment information needed to complete your transaction - Cloudinary, our media storage provider, which hosts images and files you upload - Google, for sign-in with Google, bot protection (reCAPTCHA), and website analytics (Google Analytics), where enabled - Expo, our push notification provider, to deliver mobile notifications - we share only your device's push token, not message content - Legal or regulatory authorities where required by law We never sell your personal information to third parties.

We implement technical and organizational security measures including: - HTTPS/TLS encryption for data in transit - Passwords stored as salted cryptographic hashes, never in plain text - Authentication tokens stored in HTTP-only cookies, inaccessible to client-side scripts - Role-based access controls and rate limiting on sensitive endpoints - Regular dependency and security review While we strive to protect your data, no method of transmission or storage over the internet is 100% secure.

We keep personal information only for as long as we have a reason to, and it is deleted automatically once that reason ends. Our retention periods are: - Account and profile information - for as long as your account is open. When you delete your account we anonymize it immediately: your name, email address, phone number, avatar, bio, and any IP address or approximate location we hold are erased, and your saved sessions and registered devices are deleted. - Incomplete signups - deleted 7 days after registration begins if the email address is never confirmed. No account exists until confirmation, so nothing is created for abandoned signups. - Sign-in sessions - deleted 7 days after they expire. - Financial and transaction records - at least 5 years, as required by UAE tax and accounting record-keeping rules. These are kept after account deletion, in a form that no longer identifies you wherever the law allows. - Security and audit logs - 90 days. - Notifications you have read - 12 months. - Content moderation records - 12 months after the report is resolved. - Messages and uploaded content - for as long as the conversation or listing exists, and removed when you delete your account. We may keep particular records for longer where the law requires it, or where they are needed for an unresolved dispute, safety investigation, or legal claim; they are deleted or anonymized once that ends. Backups are overwritten on their own rolling schedule.

Subject to applicable law, including the UAE PDPL, you have the right to: - Access the personal data we hold about you - Correct inaccurate or incomplete data - Request deletion of your account and data - Object to or restrict certain processing - Request a copy of your data in a portable format - Withdraw consent for marketing communications at any time To exercise these rights, contact us at privacy@scripto.ae. You may also have the right to lodge a complaint with the UAE Data Office or another competent regulator.

We use cookies and similar technologies, including essential cookies that keep you signed in and, where enabled, Google Analytics and Google reCAPTCHA. You can manage non-essential cookies through your browser settings; essential cookies cannot be disabled without affecting core functionality like sign-in. See our Cookie Policy for full details.

Our platform may contain links to third-party websites. We are not responsible for the privacy practices of these sites. We encourage you to read the privacy policies of any third-party sites you visit.

Scripto is not intended for users under 18 years of age. We do not knowingly collect personal information from children. If we learn that we have collected data from a child, we will delete it promptly.

Some of our service providers - including Stripe, PayTabs, Cloudinary, Google, and Expo - operate infrastructure outside the UAE, including in the United States and the European Union. Where your information is transferred internationally, we rely on the safeguards those providers offer, such as standard contractual clauses, to protect it in line with applicable data protection law.

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on our platform and updating the 'Last Updated' date. Your continued use after changes constitutes acceptance.

If you have questions about this Privacy Policy or your personal data, please contact us at: Scripto Data Protection Contact Abu Dhabi, United Arab Emirates Email: privacy@scripto.ae