Privacy Policy · Soogram

This is an English translation of the Arabic privacy policy, provided for convenience. The Arabic text is the authoritative version and prevails in case of any difference.

1. Who we are and why we collect your data

1.1 This policy explains how we collect, use and protect your personal data when you use the Soogram platform, including the soogram.com website and the mobile apps.

1.2 The person responsible for processing your data is Soumar Ahmad Alhussein, a natural person resident in the Hashemite Kingdom of Jordan, who can be reached at privacy@soogram.com.

1.3 We comply with the Jordanian Personal Data Protection Law No. (24) of 2023 and the regulations and instructions issued under it.

1.4 This policy is an integral part of the Terms of Use and is read together with them. Both are published on soogram.com — this policy at soogram.com/privacy and the terms at soogram.com/terms — and the app opens them from Settings → Legal documents.

1.5 Our simple rule: we collect as little data as possible, and we do not sell your data to anyone.

2. What we collect

2.1 Data you give us

Data	Required?	Why
Name and username	Yes	Shown on your ads and used for contact between users. The username is generated automatically at registration and you can change it
Phone number	Yes	To verify your account with a code sent by text message (SMS), and for contact between seller and buyer — see 5.3
Date of birth	Yes	To check that you are at least eighteen — the only thing it is used for
Gender	No	To complete your profile if you wish. It is shown to no user, we do not use it to rank what you see or in any decision about you, and you can withdraw it at any time by choosing “I prefer not to say” in Account information
Email address	No	To contact you about your account or your requests when needed
City or area	Yes, when posting	To show your ad to people near you
Ad location on the map	No	Only if you choose to set it yourself — see 2.3
Profile photo	No	To personalise your profile
The content of your ads, photos and videos	Yes, when posting	To publish the ad
Stories and video clips	No	To show on your profile and in discovery screens
Your storefront details, if you activate one: store name, description, cover photo, address, map location, contact number and opening hours	No	To show your store publicly on its page
Your in-app messages, including price offers	—	To deliver them to the other party and to handle reports
Your reviews of sellers and their replies	No	To build a readable reputation on the platform
Favourites, saved searches and follows	No	To run these features and send their alerts
Invite code and the people you invited	No	To count invitation rewards
Your reports and correspondence with support	—	To handle the report and keep a record of it

2.2 Data collected automatically

Device type, operating system and app version, and your device’s notification token if you allow notifications.
IP address.
Usage logs: the ads that passed in front of you or that you opened, your searches, sign-in times, and errors returned by our servers.
The governorate you browse from: the one you chose yourself, or the one your device works out from its location if you allow it — see 2.3. Your device’s coordinates never reach us.

What does not exist: we currently use no third-party analytics tool and no crash-reporting service. The technical logs above are written on our own servers and never leave them. If we add such tools in the future, we will amend this clause and clause 6 before enabling them and notify you as described in clause 14.

2.3 Location: your governorate, and an ad’s location on the map

Your governorate, to order the ads. On first launch, the mobile app asks for permission to access your device’s location while the app is in use only; it never reads your location in the background. Your device takes an approximate reading — the lowest accuracy the system offers — and works out the nearest governorate on the device itself, without calling any outside service. Ads from your governorate are then shown first, followed by neighbouring governorates; no ad is hidden from you.

The coordinates never leave your device. All that reaches us is the name of the governorate — exactly what would reach us if you picked it yourself. Your device stores the result for later sessions, so your location is not read again unless you ask for it from the governorate list.

The permission is optional. If you decline, ads are ordered around Amman until you choose your governorate yourself from the home page, and we will not ask for the permission again. You can withdraw it at any time from your device settings. A governorate you choose by hand always takes precedence over one the device works out.

An ad’s location on the map. When posting an ad you can — optionally — drag a marker on a map to indicate where the item is. You place this marker by hand; it is not taken from your device’s location. The coordinates you choose are stored and shown publicly on the ad page and on the search map, at the precision you set. The same applies to your store’s location on the map, if you set one.

So: do not put the marker on your front door. Put it on a nearby junction or a public landmark. The marker is entirely optional; you can post with the city alone.

The maps themselves. Maps inside the app are drawn from OpenStreetMap map tiles, and the map software (Leaflet) is loaded from the unpkg service. When you open a map, your device connects to these two services directly — see clause 6.

2.4 Your points

We keep your points balance and the record of how points were granted and used. Points are free and are not money, as set out in clause 9 of the Terms of Use.

2.5 Personalising what you see

For each user we build an internal interest profile from their behaviour on the platform: the ads that passed in front of you, the ones you opened, your searches, who you messaged, and what you added to favourites. Each signal has a different weight, and they are summarised into preferences such as the categories, cities and keywords that interest you most.

Why: to order the home page and recommendations by what you are actually looking for, instead of showing everyone the same list.

How long it lasts: the profile expires automatically after 60 days from your last activity, and is rebuilt from scratch if you return.

Before signing in, too: the same applies to a visitor who is not registered, tied to a random session identifier stored on their device that does not identify them and is not linked to a name or number.

What does not happen: we make no automated decision about you with legal effect, we do not use this profile for paid advertising, and we do not share it with anyone.

2.6 Account verification and the “verified” badge

Account verification is entirely optional. You can register, post ads and message users without it; all you forgo is the badge on your profile.

Two levels:

Personal verification: a photo of your ID card or passport (both sides), and a live selfie taken inside the app to match against the document. It grants a neutral badge.
Business verification: the above, plus a trade licence or commercial registration, and the business name, licence number and expiry date. It grants a blue badge indicating a registered business.

The sole purpose of this data is to confirm that you are the person or business you claim to be, and to reduce fake accounts and fraud. We do not use it for marketing or any other purpose, we do not sell it, and we do not share it with other users.

Separate, explicit consent: before any document is uploaded, a dedicated screen shows the purpose, the retention period, who can see it and how to withdraw consent, and the upload does not start until you agree. We record the date of this consent.

What remains after the decision: the document photo and the selfie are deleted within 30 days of the decision date — whether approved or rejected. Deleted immediately at the decision: the document number, the name as printed on it, the date of birth printed on it, and the trade licence number.

All that remains afterwards is:

Verification status: verified or not, and at which level.
The verification date and document type (ID card, passport or licence) without its number.
A one-way digital fingerprint of the ID number, from which the number cannot be recovered, whose only purpose is to detect the same identity being submitted from two different accounts.
A brief internal record that the check took place and who performed it.

What other users see: the badge only. Your document, your selfie, the name printed on the document and any number on it are never shown to any user.

Who sees it on our side: the verification team only, and every view of any document is written to an internal audit log: who opened it, whose document, and when. You yourself cannot download it from your account after uploading it — because a stolen account must not be a route to its owner’s documents.

We do not build a permanent face template. Matching the selfie against the document photo happens once, by a verification staff member’s own eyes, for verification only. We do not use your photo to search for you in any database and we do not share it with anyone for that purpose.

Withdrawing consent: you may withdraw it at any time by requesting that verification be cancelled, whereupon the badge and whatever verification data remains are deleted.

2.7 What we do not collect

We collect no payment data. No card numbers, bank accounts or wallets. There is no way to buy anything inside the platform at all.
We collect identity documents only from those who voluntarily choose verification, as set out in 2.6 above.
We do not collect sensitive data such as religious belief, political opinion or health status. Do not include these in your ads or messages.
We do not access your contacts, text messages, call log or photo library, other than the photos and videos you yourself choose to upload. (On Android, Google Play services may pick up the sign-in code message alone to complete verification automatically, without the app seeing your other messages.)
We use the camera and microphone only when you open them yourself to film a story or a video or to photograph a verification document.
We read your device’s location only with your permission and for the single purpose set out in 2.3, and its coordinates never reach us.

If you register your business through soogram.com/merchants before launch, we collect what you type into the form: business name, contact name, mobile number, email address (optional), sector, city, approximate number of listings, the channels you currently advertise on (optional), and your notes (optional). Alongside it we record the submission time, the country inferred from your internet address (without storing the address itself), and your browser type.

Why: to contact you before launch and help you move your listings over and activate your business account. We use this data for no other purpose and share it with no one.

Where it is stored: in a database on Cloudflare infrastructure, and a copy of the request is emailed to us through the Resend email service.

How long it is kept: until we have contacted you and completed your registration in the app, and for at most 12 months from submission, after which it is deleted. You may ask for it to be deleted earlier by writing to privacy@soogram.com.

Protection against automated submissions: the form uses Cloudflare Turnstile to tell humans from bots. This service runs inside a frame from a Cloudflare domain and may process technical signals about your browser for that purpose only, under Cloudflare’s privacy policy.

3. Legal basis for processing

We rely on one or more of the following:

Your consent: at registration; when granting location or notification permission; when you opt in to promotional messages; and when you add optional data such as your gender. You may withdraw consent at any time, without retroactive effect on processing already carried out.
Your separate, explicit consent: for account verification data (identity document and selfie) as set out in 2.6. This consent is requested separately, with a specified purpose and duration, and we process this data on no other basis.
Performance of our agreement with you: we cannot operate your account or publish your ad without processing your data.
Legal obligation: responding to an official request from a competent authority in accordance with the law, and verifying that you are of legal age.
Legitimate interest: preventing fraud, fake accounts and spam; protecting user safety and platform security; personalising what you see as described in 2.5; and improving the service.

4. How we use your data

Creating and verifying your account and preventing duplicate accounts.
Displaying your ads and ranking them in search results and on the home page, by governorate, category and your interest profile as described in 2.5.
Enabling communication between you and other users.
Automatic content filtering: the text of every ad is checked automatically before publication against the list of prohibited content in the Terms of Use. Clear matches are rejected immediately; ambiguous cases are published and placed in the human review queue. Messages are checked the same way for review purposes only, without blocking their delivery.
Reviewing content, handling reports and enforcing the Terms of Use.
Detecting and preventing fraud, abuse and manipulation of the points system.
Sending operational notifications: account activation, new message, the status of your ad. These are necessary to run the service.
Sending promotional messages if you have agreed to them; you can stop them at any time from Settings → Notifications → Offers and marketing.
Analysing usage in aggregate to improve the platform.

5. What other users see — read this section carefully

5.1 Soogram is a public advertising platform. When you post an ad it becomes visible to every visitor, registered or not.

5.2 Shown with your ad: your account name and username, your profile photo if you set one, the city or area, the map location if you set one, the ad text, photos and videos, the posting date, your verification badge if you have one, reviews from previous buyers, and your phone number unless you hide it as described in 5.3. If you have a store, the details listed for it in 2.1 are shown on its page.

5.3 Your phone number is shown by default on your ads and on your store page to anyone who opens them, signed in or not, so that buyers can call you — and message you on WhatsApp if you have a store and have not turned the WhatsApp button off in Settings. To hide it: Settings → Privacy and security → Hide my number on ads; contact then continues through the in-app chat. Check this setting before posting.

5.4 Everything you write in an ad or upload in its photos is public. Do not include your home address, your national ID number, photos of your documents, or information about another person, and do not put the map marker on your residence.

5.5 Public ads may be indexed by search engines and may be copied or screenshotted by others. Deleting an ad from Soogram does not mean it disappears immediately from search engines or from copies saved outside our control.

5.6 Your in-app messages are not end-to-end encrypted. We can read them when there is a report, a suspected violation, or an official request.

We do not sell, rent or trade your data. We share it only in the following cases:

Infrastructure providers: hosting, storage, databases and backups. Our two current providers are Railway, which runs our servers and databases in data centres in the United States, and Cloudflare, which stores photos, videos and verification documents in data centres in Europe, and handles content delivery and runs the soogram.com website and the soogr.am short links.
Phone number verification provider: Google’s Firebase Authentication, to send the sign-in code by text message (SMS) and check it. It receives your phone number, and may confirm that the request comes from our app through a silent notification from Apple or through Google Play services, or show you a reCAPTCHA page. Firebase keeps a sign-in record in our project with your number and the dates of your first and last sign-in, and this record is not deleted automatically when you delete your account; you can ask us to delete it by writing to privacy@soogram.com, and we will. Google may also retain the number under its own privacy policy to prevent fraud and abuse across its services.
Notification services: to deliver push notifications through Apple’s and Google’s services, which receive your device’s notification token and the text of the notification.
Map services: the OpenStreetMap Foundation, from which the map tiles are loaded, receives your IP address and the parts of the map you view; the unpkg service, from which the map software is loaded, receives your IP address only.
The app stores: they receive download and crash data under their own policies, not ours.
Law enforcement and judicial authorities: upon an official request based on law, and only to the extent it requires.
Our legal advisers: in a dispute or claim, to the extent necessary to defend a right.

6.2 Your data is stored outside Jordan with the providers above: our databases in the United States, and files in Europe. We work with providers that adhere to recognised protection standards, and by using the platform you consent to this transfer.

6.3 If operation of the platform moves in the future to a company founded or co-owned by the operator, your data will pass to that entity under the same obligations set out here, and we will notify you.

7. How long we keep your data

Data	Retention
Account data	For as long as the account is active
Identity document photo and selfie	Up to 30 days from the verification decision, then deleted automatically
Document number and the name printed on it	Deleted as soon as the decision is made
Verification status, date and type	For as long as the account is active
Deleted or expired ads and their photos	90 days, then destroyed automatically together with their photos
Conversations and their messages	12 months from the last message in the conversation, then the whole conversation is deleted for both parties
Stories	7 days from posting, then destroyed together with their files
Technical logs and IP addresses	30 days
Your interest profile (clause 2.5)	60 days from your last activity
Report records and account-suspension decisions	24 months, to prevent an offender returning with a new account
Automated violation entries (clause 7.2 of the Terms)	90 days from the entry, then dropped automatically
The Firebase sign-in record (your number and first and last sign-in dates)	Not deleted automatically, even if you delete your account; we delete it when you ask — see clause 6
Merchant signup form data (clause 2.8)	Until your registration in the app is complete, and at most 12 months from submission
Whatever the law requires us to keep	For the period the law specifies

The retention periods for app data are enforced automatically in our systems: scheduled jobs delete what has expired without human intervention. The Firebase sign-in record and the merchant signup form data are deleted by us, as set out above. When a period ends we delete the data or anonymise it so that it no longer identifies you.

8. Deleting your account

8.1 You can delete your account at any time from inside the app: Settings → Your data → Delete account.

8.2 From outside the app, use the dedicated page soogram.com/delete-account, or write to us at privacy@soogram.com from the email address or phone number registered on your account.

8.3 Deletion is immediate, final and cannot be undone. There is no grace period and we cannot restore the account afterwards. When it runs:

Your ads and stories are removed from view immediately.
Your personal data is wiped from your profile immediately: name, email, photo, bio, store, date of birth and gender.
Your phone number is replaced with a value that does not identify it, so the same number can be used to create a new account later.
Your verification documents, requests, status and badge are deleted.
Your favourites, saved searches, follows, notifications, your devices’ notification tokens and your block list are deleted.
Your points balance is zeroed and any active promotions are cancelled.
Your ads and their photos are destroyed within the period set out in clause 7.

8.4 What remains, and only to the extent necessary:

Messages you sent remain visible in the conversations of the people you messaged, because they are part of their record and not only yours, and are deleted with their conversations under the period in clause 7. Your name appears in them as “Deleted account”.
Report records and suspension decisions, for the period in clause 7. An account suspended for a violation must not be able to erase that trace by deleting itself.
Anonymised ledger entries for points movements, for accounting review, tied to an account that no longer identifies a person.
The Firebase sign-in record described in clause 6, until you ask us to delete it.
Whatever the law requires us to keep.

8.5 Your points are forfeited entirely on deletion, without compensation.

8.6 Take a copy before deleting. After deletion we cannot prepare a copy of your data, because it no longer exists. Use Settings → Your data → Download a copy of my data first.

8.7 There are alternatives to deletion: hiding your number, archiving your ads, or turning off notifications. All are in Settings.

9. Your rights

Under the Jordanian Personal Data Protection Law, you may request:

To be informed of how your data is collected and processed and the legal basis for it — which is what this policy explains.
Access to the personal data we hold about you.
A copy of it in a machine-readable format. This right is available directly inside the app: Settings → Your data → Download a copy of my data, which gives you a JSON file containing your account, ads, sent messages, favourites, reports, reviews and verification data (without document images).
Correction, amendment or completion if it is inaccurate or incomplete — from Settings → Account information (tap your name at the top of Settings).
Deletion or destruction — from Settings → Your data → Delete account, as set out in clause 8, unless the law requires us to keep it or it is needed to prevent a crime or protect a right.
Withdrawal of consent at any time: stop promotional messages from Settings, withdraw location permission from your device settings, choose “I prefer not to say” instead of your gender in Account information, and withdraw verification consent by requesting its cancellation.
Objection to particular processing, including the use of your data for marketing or for personalising what you see.

To exercise any right not available inside the app, write to privacy@soogram.com from the email address or phone number registered on your account. We respond within 30 days. We may ask for proof of identity before acting, to protect your account from a request impersonating you.

10. Security of your data

10.1 We store no passwords, because we do not use them. Sign-in is by a one-time code sent to your number by text message (SMS), after which your session carries a temporary token that expires automatically.

10.2 Our technical and organisational measures: encrypting the connection between your app and our servers; storing verification documents in a private space outside any public path, with access restricted to the verification team and every access logged; restricting access to databases; limits on the number of sign-in attempts per number and per address; and regular backups.

10.3 No system is absolutely secure. Transmitting data over the internet carries an inherent risk, and we cannot guarantee absolute security.

10.4 You are responsible for keeping the verification code you receive confidential. We will never ask you for your verification code — not by call, not by message, not through a support agent. Anyone who asks you for it is a fraudster.

10.5 In the event of a breach that materially affects your personal data, we will notify you and the competent authority as the law requires.

11. Storage on your device and cookies

11.1 The soogram.com website uses no cookies, and contains no advertising tracking and no third-party analytics tools. The only exception is the Cloudflare Turnstile widget on the merchant signup form (clause 2.8), which runs inside a frame from a Cloudflare domain and may use storage of its own to check that you are not a bot, not to track you.

11.2 What the website may use is local storage in your browser (localStorage) for two things only: keeping you signed in once sign-in is offered on the website, and remembering your chosen language. This data stays on your device and is not sent to us as cookies. The informational and legal pages on soogram.com store nothing on your device.

11.3 You can delete it at any time from your browser settings (clear site data); doing so will sign you out.

11.4 The mobile app keeps your session in the system’s secure store (Keychain on iOS and its equivalent on Android), and stores your language and the governorate you browse from locally.

11.5 If we ever add an analytics tool or non-essential cookies, we will not enable them before amending this clause and providing a way to refuse them.

12. Children

The platform is intended for people aged eighteen or over. Date of birth is requested at registration and account creation is refused below that age. We do not knowingly collect children’s data. If we learn that an account belongs to a child, we delete it and its data. If you are a parent or guardian and believe your child has created an account, write to us and we will delete it immediately.

13. Links and external services

The platform may contain links to websites or services we do not operate. This policy does not apply to them and we are not responsible for their practices. Review the privacy policy of each.

14. Changes to this policy

14.1 We may amend this policy and will publish the updated version on soogram.com with its effective date.

14.2 For material changes, we will notify you through the app or by email a reasonable time before they take effect.

14.3 Continuing to use the platform after the effective date means you accept the updated version.

15. Complaints

15.1 If you object to how we process your data, write to us first at privacy@soogram.com. We respond within 10 days.

15.2 If you are not satisfied with our response or receive none, you have the right to lodge a complaint with the Personal Data Protection Unit at the Ministry of Digital Economy and Entrepreneurship of the Hashemite Kingdom of Jordan.

16. Contact

Privacy and data rights: privacy@soogram.com
General support: support@soogram.com
Website: soogram.com