Privacy Policy

1. Who is responsible

SAHIBAT is operated by SM Marketing Management LLC in the United Arab Emirates. The company is responsible for personal information processed for the SAHIBAT services described here.

Contact us about privacy, consent or personal information at support@sahibat.com.

Applicable UAE data protection requirements govern our processing. Additional privacy laws apply where their territorial and material scope covers the relevant activity.

2. Information we process

• Account information: registration details, contact information, authentication records, account preferences and membership status.
• Business profile information: business names, categories, descriptions, services, products, business locations, public contact details, links and media submitted for publication.
• Verification information: documents or explanations supplied to establish business eligibility, ownership, authority or compliance.
• Transaction information: orders, invoices, payment status, transaction references, refunds and relevant affiliate or commission records. Payment providers may separately process payment credentials under their own notices.
• Communications: enquiries, support correspondence, complaints, reviews and records of consent or withdrawal.
• Technical information: IP addresses, browser and device information, access logs, security events and cookie-related information, depending on the features used and applicable consent choices.

Do not submit passwords, payment credentials, customer lists, confidential documents or sensitive personal information in public profile fields.

3. Purposes and legal grounds

We process information for the following purposes:

• Creating accounts, administering memberships and providing requested directory, advertising and marketing services.
• Publishing and maintaining business listings and delivering promotion included in an agreed service.
• Handling payments, referrals, support requests, complaints and business verification.
• Protecting accounts, preventing misuse, investigating fraud, maintaining service reliability and enforcing lawful terms.
• Meeting applicable legal, accounting and regulatory duties and establishing or defending legal claims.
• Sending optional marketing communications and using optional tracking technologies where the required permission exists.
• Training and improving SAHIBAT’s marketing AI with eligible public business content under a separate recorded opt-in.

Depending on the activity and applicable law, processing relies on consent, necessity for a requested contract or service, a legal obligation, or another specifically available lawful ground. We do not treat acceptance of this policy as blanket consent to every form of processing.

Marketing consent is separate from essential account, payment, security and service communications. Where applicable law recognises legitimate interests, any reliance on that ground requires an appropriate assessment of those interests and individuals’ rights.

4. Public listings and third-party information

Information submitted to public listing fields is intended for visitors to view and may be indexed by search engines or shared through ordinary links. Public business contact details may allow visitors to contact the listed business directly.

Submit information about another person only where you have the necessary authority and have provided any required notice. Permission to publish content does not automatically establish permission to use it for AI training.

Removing information from SAHIBAT may not immediately remove independent search caches or copies held by others. This does not limit our responsibility for information under our control.

Listed businesses and external websites are responsible for their own processing when you contact or transact with them.

5. AI training and business assistance

SAHIBAT develops AI tools to help businesses with customer acquisition, marketing and advertising. With a separate opt-in, eligible public business content may be used to prepare training datasets and to train, fine-tune, test and improve these tools.

Eligible content includes authorised business descriptions, categories, service and product information, service areas and suitable business media. The model may learn across participating businesses and support other SAHIBAT members.

This programme excludes passwords, authentication secrets, payment credentials, private account information, private correspondence, verification documents and confidential customer information. Public personal identifiers and sensitive information are also excluded as explained in our AI Policy.

Declining optional training does not prevent ordinary directory membership. Consent may be withdrawn by contacting support@sahibat.com. Withdrawal and existing model handling are explained in the AI & Automated Access Policy .

This permission does not authorise a third-party AI provider to train its own independent general-purpose models on your content.

6. Providers and international transfers

Our website is hosted with Hostinger on infrastructure located in the United States. The company’s email server uses Hetzner infrastructure in Germany. Website data and email correspondence therefore involve different hosting arrangements.

Information may be accessed by authorised personnel and providers where needed for hosting, email, technical support, payment processing, security or delivery of a service you request. Access must be limited to the relevant purpose and subject to appropriate confidentiality and data protection arrangements.

A payment provider or other organisation may act independently for some activities; its own privacy notice applies to those activities. We may also disclose information when lawfully required by competent authorities or necessary for legal claims.

The website and email hosting locations do not establish the location of any separate AI processing. Before using an additional provider for AI training, we will provide relevant information about its role and processing destinations and establish the safeguards and permissions required by applicable law.

International transfers must have a lawful transfer basis and appropriate safeguards where required. A destination is not treated as automatically adequate merely because a provider operates there. Provider support, backups and subprocessors must also be considered when assessing transfers.

7. Retention and security

We retain information for as long as reasonably necessary for its stated purpose and applicable legal requirements. Relevant factors include account activity, service delivery, statutory recordkeeping, unresolved disputes, security needs and consent status.

Account and listing information is reviewed when a membership ends or deletion is requested. Transaction records may require longer retention for legal or accounting reasons. Support and security records are retained according to their continuing purpose. AI datasets are subject to consent and withdrawal rules.

Information no longer needed must be deleted or genuinely anonymised. Restricted backup copies may remain until their scheduled replacement; they are not a separate source for marketing or AI training.

We are responsible for maintaining proportionate technical and organisational safeguards, limiting access and responding to security incidents. No online service can guarantee absolute security. Where a breach triggers notification duties, we will notify the relevant authority and affected individuals as required.

8. Your choices and rights

Depending on applicable law, you may request access, correction, deletion, restriction, portability or information about processing, and may object to certain uses or withdraw consent.

You may also have rights concerning decisions based solely on automated processing that have legal or similarly significant effects. This policy does not provide blanket permission for such decisions.

Send requests to support@sahibat.com. We may request proportionate information to verify your identity or authority. We will respond within applicable statutory timeframes and explain any lawful limitation.

You can withdraw optional marketing or AI training consent without withdrawing a separate consent for another purpose. Withdrawal does not invalidate processing lawfully carried out before withdrawal.

You may complain to the competent data protection authority. Contacting us first is helpful but does not remove that right.

Membership registration is intended for adults authorised to act for the relevant business. Children’s personal information must not be submitted for AI training.

9. Updates and related policies

We may update this policy to reflect changes in our services or legal obligations. Material changes will be brought to users’ attention as required. A new purpose requiring consent will not be authorised merely by publishing an updated policy.

Read this policy alongside our Cookie Policy and AI & Automated Access Policy .