Privacy Policy · Soogram

This is an English translation of the Arabic privacy policy, provided for convenience. The Arabic text is the authoritative version and prevails in case of any difference.

1. Who we are and why we collect your data

1.1 This policy explains how we collect, use and protect your personal data when you use the Soogram platform, including the soogram.com website and the mobile apps.

1.2 The person responsible for processing your data is Soumar Alhussein, a natural person resident in the Hashemite Kingdom of Jordan, who can be reached at privacy@soogram.com.

1.3 We comply with the Jordanian Personal Data Protection Law No. (24) of 2023 and the regulations and instructions issued under it.

1.4 This policy is an integral part of the Terms of Use and is read together with them. Both are published on soogram.com and can be opened from inside the app: Settings → Legal documents.

1.5 Our simple rule: we collect as little data as possible, and we do not sell your data to anyone.

2. What we collect

2.1 Data you give us

Data	Required?	Why
Name and username	Yes	Shown on your ads and used for contact between users. The username is generated automatically at registration and you can change it
Phone number	Yes	To verify your account with a code sent over WhatsApp, and for contact between seller and buyer
Date of birth	Yes	To check that you are at least eighteen — the only thing it is used for
Gender	Yes	To improve the relevance of search results and suggestions
Email address	No	For account recovery and important notices
City or area	Yes, when posting	To show your ad to people near you
Ad location on the map	No	Only if you choose to set it yourself — see 2.3
Profile photo	No	To personalise your profile
The content of your ads, photos and videos	Yes, when posting	To publish the ad
Stories and video clips	No	To show on your profile and in discovery screens
Your in-app messages	—	To deliver them to the other party and to handle reports
Your reviews of sellers and their replies	No	To build a readable reputation on the platform
Favourites, saved searches and follows	No	To run these features and send their alerts
Invite code and the people you invited	No	To count invitation rewards
Your reports and correspondence with support	—	To handle the report and keep a record of it

2.2 Data collected automatically

Device type, operating system, app version and device identifier.
IP address.
Usage logs: the ads you viewed, your searches, sign-in times, and errors returned by our servers.
Your approximate location at city level, derived from the area you chose.

What does not exist: we currently use no third-party analytics tool and no crash-reporting service. The technical logs above are written on our own servers and never leave them. If we add such tools in the future, we will amend this clause and clause 6 before enabling them and notify you as described in clause 14.

2.3 Ad location on the map

The app does not request permission to access your device location, and does not read it.

What actually happens: when posting an ad you can — optionally — drag a marker on a map to indicate where the item is. The coordinates you choose yourself are stored and shown publicly on the ad page and on the search map, at the precision you set.

So: do not put the marker on your front door. Put it on a nearby junction or a public landmark. The marker is entirely optional; you can post with the city alone.

2.4 Your points

We keep your points balance and the record of how points were granted and used. Points are free and are not money, as set out in clause 9 of the Terms of Use.

2.5 Personalising what you see

For each user we build an internal interest profile from their behaviour on the platform: the ads that passed in front of you, the ones you opened, your searches, who you messaged, and what you added to favourites. Each signal has a different weight, and they are summarised into preferences such as the categories, cities and keywords that interest you most.

Why: to order the home page and recommendations by what you are actually looking for, instead of showing everyone the same list.

How long it lasts: the profile expires automatically after 60 days from your last activity, and is rebuilt from scratch if you return.

Before signing in, too: the same applies to a visitor who is not registered, tied to a random session identifier stored on their device that does not identify them and is not linked to a name or number.

What does not happen: we make no automated decision about you with legal effect, we do not use this profile for paid advertising, and we do not share it with anyone.

2.6 Account verification and the “verified” badge

Account verification is entirely optional. You can register, post ads and message users without it; all you forgo is the badge on your profile.

Two levels:

Personal verification: a photo of your ID card or passport (both sides), and a live selfie taken inside the app to match against the document. It grants a neutral badge.
Business verification: the above, plus a trade licence or commercial registration, and the business name, licence number and expiry date. It grants a blue badge indicating a registered business.

The sole purpose of this data is to confirm that you are the person or business you claim to be, and to reduce fake accounts and fraud. We do not use it for marketing or any other purpose, we do not sell it, and we do not share it with other users.

Separate, explicit consent: before any document is uploaded, a dedicated screen shows the purpose, the retention period, who can see it and how to withdraw consent, and the upload does not start until you agree. We record the date of this consent.

What remains after the decision: the document photo and the selfie are deleted within 30 days of the decision date — whether approved or rejected. Deleted immediately at the decision: the document number, the name as printed on it, the date of birth printed on it, and the trade licence number.

All that remains afterwards is:

Verification status: verified or not, and at which level.
The verification date and document type (ID card, passport or licence) without its number.
A one-way digital fingerprint of the ID number, from which the number cannot be recovered, whose only purpose is to detect the same identity being submitted from two different accounts.
A brief internal record that the check took place and who performed it.

What other users see: the badge only. Your document, your selfie, the name printed on the document and any number on it are never shown to any user.

Who sees it on our side: the verification team only, and every view of any document is written to an internal audit log: who opened it, whose document, and when. You yourself cannot download it from your account after uploading it — because a stolen account must not be a route to its owner’s documents.

We do not build a permanent face template. Matching the selfie against the document photo happens once, by a verification staff member’s own eyes, for verification only. We do not use your photo to search for you in any database and we do not share it with anyone for that purpose.

Withdrawing consent: you may withdraw it at any time by requesting that verification be cancelled, whereupon the badge and whatever verification data remains are deleted.

2.7 What we do not collect

We collect no payment data. No card numbers, bank accounts or wallets. There is no way to buy anything inside the platform at all.
We collect identity documents only from those who voluntarily choose verification, as set out in 2.6 above.
We do not collect sensitive data such as religious belief, political opinion or health status. Do not include these in your ads or messages.
We do not access your contacts, text messages, call log or photo library, other than the photos you yourself choose to upload.
We do not request location permission from your device.

If you register your business through soogram.com/merchants before launch, we collect what you type into the form: business name, contact name, mobile number, email address (optional), sector, city, approximate number of listings, the channels you currently advertise on (optional), and your notes (optional). Alongside it we record the submission time, the country inferred from your internet address (without storing the address itself), and your browser type.

Why: to contact you before launch and help you move your listings over and activate your business account. We use this data for no other purpose and share it with no one.

Where it is stored: in a database on Cloudflare infrastructure, and a copy of the request is emailed to us.

How long it is kept: until we have contacted you and completed your registration in the app, and for at most 12 months from submission, after which it is deleted. You may ask for it to be deleted earlier by writing to privacy@soogram.com.

Protection against automated submissions: the form uses Cloudflare Turnstile to tell humans from bots. This service runs inside a frame from a Cloudflare domain and may process technical signals about your browser for that purpose only, under Cloudflare’s privacy policy.

3. Legal basis for processing

We rely on one or more of the following:

Your consent: at registration, when granting notification permission, and when you opt in to promotional messages. You may withdraw consent at any time, without retroactive effect on processing already carried out.
Your separate, explicit consent: for account verification data (identity document and selfie) as set out in 2.6. This consent is requested separately, with a specified purpose and duration, and we process this data on no other basis.
Performance of our agreement with you: we cannot operate your account or publish your ad without processing your data.
Legal obligation: responding to an official request from a competent authority in accordance with the law, and verifying that you are of legal age.
Legitimate interest: preventing fraud, fake accounts and spam; protecting user safety and platform security; personalising what you see as described in 2.5; and improving the service.

4. How we use your data

Creating and verifying your account and preventing duplicate accounts.
Displaying your ads and ranking them in search results and on the home page, by area, category and your interest profile as described in 2.5.
Enabling communication between you and other users.
Automatic content filtering: the text of every ad is checked automatically before publication against the list of prohibited content in the Terms of Use. Clear matches are rejected immediately; ambiguous cases are published and placed in the human review queue. Messages are checked the same way for review purposes only, without blocking their delivery.
Reviewing content, handling reports and enforcing the Terms of Use.
Detecting and preventing fraud, abuse and manipulation of the points system.
Sending operational notifications: account activation, new message, the status of your ad. These are necessary to run the service.
Sending promotional messages if you have agreed to them; you can stop them at any time from Settings → Notifications → Offers and marketing.
Analysing usage in aggregate to improve the platform.

5. What other users see — read this section carefully

5.1 Soogram is a public advertising platform. When you post an ad it becomes visible to every visitor, registered or not.

5.2 Shown with your ad: your account name and username, your profile photo if you set one, the city or area, the map location if you set one, the ad text, photos and videos, the posting date, your verification badge if you have one, and reviews from previous buyers.

5.3 Your phone number is shown to other users by default so they can call you. To hide it: Settings → Privacy and security → Hide my number on ads; contact then continues through the in-app chat. Check this setting before posting.

5.4 Everything you write in an ad or upload in its photos is public. Do not include your home address, your national ID number, photos of your documents, or information about another person, and do not put the map marker on your residence.

5.5 Public ads may be indexed by search engines and may be copied or screenshotted by others. Deleting an ad from Soogram does not mean it disappears immediately from search engines or from copies saved outside our control.

5.6 Your in-app messages are not end-to-end encrypted. We can read them when there is a report, a suspected violation, or an official request.

We do not sell, rent or trade your data. We share it only in the following cases:

Infrastructure providers: hosting, storage, databases and backups. Our current providers are Cloudflare for content delivery and the storage of photos and files, and Railway for running the servers and databases. Data is stored in these providers’ data centres outside Jordan (in the European Union and the United States).
Verification message provider: to deliver the sign-in code over WhatsApp. It receives your phone number and the verification code only.
Notification services: to deliver push notifications through Apple’s and Google’s services.
The app stores: they receive download and crash data under their own policies, not ours.
Law enforcement and judicial authorities: upon an official request based on law, and only to the extent it requires.
Our legal advisers: in a dispute or claim, to the extent necessary to defend a right.

6.2 Your data may be transferred to and stored outside Jordan with the service providers above. We work with providers that adhere to recognised protection standards, and by using the platform you consent to this transfer.

6.3 If operation of the platform moves in the future to a company founded or co-owned by the operator, your data will pass to that entity under the same obligations set out here, and we will notify you.

7. How long we keep your data

Data	Retention
Account data	For as long as the account is active
Identity document photo and selfie	Up to 30 days from the verification decision, then deleted automatically
Document number and the name printed on it	Deleted as soon as the decision is made
Verification status, date and type	For as long as the account is active
Deleted or expired ads and their photos	90 days, then destroyed automatically together with their photos
Conversations and their messages	12 months from the last message in the conversation, then the whole conversation is deleted for both parties
Stories	24 hours from posting, then destroyed together with their files
Technical logs and IP addresses	30 days
Your interest profile (clause 2.5)	60 days from your last activity
Report records and account-suspension decisions	24 months, to prevent an offender returning with a new account
Automated violation entries (clause 7.2 of the Terms)	90 days from the entry, then dropped automatically
Merchant signup form data (clause 2.8)	Until your registration in the app is complete, and at most 12 months from submission
Whatever the law requires us to keep	For the period the law specifies

These periods are enforced automatically in our systems: scheduled jobs delete what has expired without human intervention. When a period ends we delete the data or anonymise it so that it no longer identifies you.

8. Deleting your account

8.1 You can delete your account at any time from inside the app: Settings → Your data → Delete account.

8.2 From outside the app, use the dedicated page soogram.com/delete-account, or write to us at privacy@soogram.com from the email address or phone number registered on your account.

8.3 Deletion is immediate, final and cannot be undone. There is no grace period and we cannot restore the account afterwards. When it runs:

Your ads and stories are removed from view immediately.
Your personal data is wiped from your profile immediately: name, email, photo, bio, store, date of birth and gender.
Your phone number is replaced with a value that does not identify it, so the same number can be used to create a new account later.
Your verification documents, requests, status and badge are deleted.
Your favourites, saved searches, follows, notifications and block list are deleted.
Your points balance is zeroed and any active promotions are cancelled.
Your ads and their photos are destroyed within the period set out in clause 7.

8.4 What remains, and only to the extent necessary:

Messages you sent remain visible in the conversations of the people you messaged, because they are part of their record and not only yours, and are deleted with their conversations under the period in clause 7. Your name appears in them as “Deleted account”.
Report records and suspension decisions, for the period in clause 7. An account suspended for a violation must not be able to erase that trace by deleting itself.
Anonymised ledger entries for points movements, for accounting review, tied to an account that no longer identifies a person.
Whatever the law requires us to keep.

8.5 Your points are forfeited entirely on deletion, without compensation.

8.6 Take a copy before deleting. After deletion we cannot prepare a copy of your data, because it no longer exists. Use Settings → Your data → Download a copy of my data first.

8.7 There are alternatives to deletion: hiding your number, archiving your ads, or turning off notifications. All are in Settings.

9. Your rights

Under the Jordanian Personal Data Protection Law, you may request:

To be informed of how your data is collected and processed and the legal basis for it — which is what this policy explains.
Access to the personal data we hold about you.
A copy of it in a machine-readable format. This right is available directly inside the app: Settings → Your data → Download a copy of my data, which gives you a JSON file containing your account, ads, sent messages, favourites, reports, reviews and verification data (without document images).
Correction, amendment or completion if it is inaccurate or incomplete — from Settings → Profile.
Deletion or destruction — from Settings → Your data → Delete account, as set out in clause 8, unless the law requires us to keep it or it is needed to prevent a crime or protect a right.
Withdrawal of consent at any time: stop promotional messages from Settings, and withdraw verification consent by requesting its cancellation.
Objection to particular processing, including the use of your data for marketing or for personalising what you see.

To exercise any right not available inside the app, write to privacy@soogram.com from the email address or phone number registered on your account. We respond within 30 days. We may ask for proof of identity before acting, to protect your account from a request impersonating you.

10. Security of your data

10.1 We store no passwords, because we do not use them. Sign-in is by a one-time code sent to your number over WhatsApp, after which your session carries a temporary token that expires automatically.

10.2 Our technical and organisational measures: encrypting the connection between your app and our servers; storing verification documents in a private space outside any public path, with access restricted to the verification team and every access logged; restricting access to databases; limits on the number of sign-in attempts per number and per address; and regular backups.

10.3 No system is absolutely secure. Transmitting data over the internet carries an inherent risk, and we cannot guarantee absolute security.

10.4 You are responsible for keeping the verification code you receive confidential. We will never ask you for your verification code — not by call, not by message, not through a support agent. Anyone who asks you for it is a fraudster.

10.5 In the event of a breach that materially affects your personal data, we will notify you and the competent authority as the law requires.

11. Storage on your device and cookies

11.1 The soogram.com website uses no cookies, and contains no advertising tracking and no third-party analytics tools. The only exception is the Cloudflare Turnstile widget on the merchant signup form (clause 2.8), which runs inside a frame from a Cloudflare domain and may use storage of its own to check that you are not a bot, not to track you.

11.2 What the website may use is local storage in your browser (localStorage) for two things only: keeping you signed in once sign-in is offered on the website, and remembering your chosen language. This data stays on your device and is not sent to us as cookies. The informational and legal pages on soogram.com store nothing on your device.

11.3 You can delete it at any time from your browser settings (clear site data); doing so will sign you out.

11.4 The mobile app keeps your session in the system’s secure store (Keychain on iOS and its equivalent on Android), and stores your language preference locally.

11.5 If we ever add an analytics tool or non-essential cookies, we will not enable them before amending this clause and providing a way to refuse them.

12. Children

The platform is intended for people aged eighteen or over. Date of birth is requested at registration and account creation is refused below that age. We do not knowingly collect children’s data. If we learn that an account belongs to a child, we delete it and its data. If you are a parent or guardian and believe your child has created an account, write to us and we will delete it immediately.

13. Links and external services

The platform may contain links to websites or services we do not operate. This policy does not apply to them and we are not responsible for their practices. Review the privacy policy of each.

14. Changes to this policy

14.1 We may amend this policy and will publish the updated version on soogram.com with its effective date.

14.2 For material changes, we will notify you through the app or by email a reasonable time before they take effect.

14.3 Continuing to use the platform after the effective date means you accept the updated version.

15. Complaints

15.1 If you object to how we process your data, write to us first at privacy@soogram.com. We respond within 10 days.

15.2 If you are not satisfied with our response or receive none, you have the right to lodge a complaint with the Personal Data Protection Unit at the Ministry of Digital Economy and Entrepreneurship of the Hashemite Kingdom of Jordan.

16. Contact

Privacy and data rights: privacy@soogram.com
General support: support@soogram.com
Website: soogram.com