Privacy Policy — PhotX

1. Who we are

PhotX ("we," "us," "the Platform") provides AI-assisted product photography for merchants. This policy explains what personal data we collect, why, and your rights over it, in line with the Kingdom of Saudi Arabia's Personal Data Protection Law (PDPL).

2. Data we collect

Account information: name, email address, phone number (if provided), and authentication data (including your Google account identifier if you sign in with Google — we never see or store your Google password).

Business/brand information: your brand name(s), categories, and color preferences.

Uploaded content: reference photos of your products, and any custom background images you upload. This is the core data needed to provide the service.

Payment-related data: payment itself is processed entirely by our third-party e-commerce partner, Salla — we do not collect or store your card details. We do receive confirmation that a payment was made and which package was purchased, in order to credit your account.

Usage data: pages visited, actions taken on the Platform (such as creating a shoot or reviewing a result), and basic technical data (IP address, browser type) for security and service improvement.

3. Why we collect it

• To create and manage your account
• To generate the photography results you request
• To apply purchased credits to your wallet
• To communicate with you about your account, orders, or support requests
• To improve the Platform's quality and reliability
• To detect and prevent fraud or abuse (including abuse of free credit bonuses)

4. Who we share data with

Our AI provider (OpenAI): your uploaded reference photos and chosen backgrounds are sent to OpenAI's API to generate your photography results. This is essential to how the Platform works and cannot be disabled while using the generation feature.

Important — cross-border data transfer: OpenAI's servers are located outside the Kingdom of Saudi Arabia. Under PDPL, transferring personal data outside the Kingdom requires an appropriate legal basis (such as your explicit consent, or another basis recognized under PDPL and its implementing regulations). [This section must be reviewed and finalized with legal counsel familiar with current PDPL cross-border transfer requirements before publishing — requirements and approved mechanisms can change.] By uploading content to generate a photo, you consent to this transfer for the purpose of providing the service.

Hosting and infrastructure providers: we use third-party hosting and cloud infrastructure providers to run the Platform and store data securely.

Our e-commerce payment partner: handles your payment; we receive only confirmation of successful payment and package details, not your card information.

Legal requirements: we may disclose data if required by law or to protect our rights, users, or the public.

We do not sell your personal data to third parties.

5. Data retention

We retain your account data and uploaded content for as long as your account is active, and for a reasonable period afterward as needed for legal, accounting, or dispute resolution purposes. [Specify exact retention periods with legal counsel before publishing.]

6. Your rights

Under PDPL, you have the right to:

• Know what personal data we hold about you
• Access a copy of your data
• Request correction of inaccurate data
• Request deletion of your data, subject to legal or legitimate business retention requirements
• Withdraw consent for processing where consent is the legal basis (this may limit or end your ability to use certain features, such as image generation)

To exercise these rights, contact support@photx.online.

7. Cookies and tracking

We use [cookies / local storage / analytics tools — specify which] to keep you logged in and understand how the Platform is used. [List specific tools if using third-party analytics.]

8. Security

We take reasonable technical and organizational measures to protect your data, including secure hosting and access controls. No system is completely secure, and we cannot guarantee absolute security.

9. Children's privacy

PhotX is a business tool intended for merchants and is not directed at children. We do not knowingly collect data from individuals under the age of majority.

10. Changes to this policy

We may update this policy from time to time. Material changes will be communicated via [email / in-app notice]. The "Last updated" date at the top reflects the most recent revision.

11. Contact

Questions about this policy or your data: support@photx.online