Galu Privacy Policy

Effective date: 27 October 2026

Version: 1.2

This policy explains what personal data Galu handles, why, where it is kept, for how long and what rights you have. It is published in Arabic and English. If the two versions differ, the Arabic version prevails.

1. Who we are

Galu is a brand operated by Ahmed Mustafa, an individual working under Saudi freelance document number FL-657428298, based in Jeddah, Saudi Arabia. In this policy "Galu", "we" and "us" mean Ahmed Mustafa operating Galu.

Contact: privacy questions to privacy@getgalu.com, anything else to support@getgalu.com.

2. Our role

Galu gives online stores a recording page. A store sends the page's link to its buyers, and a buyer can send a short video or a photo of what they bought. Galu handles personal data in three different roles:

• Merchants (the people who open a Galu account for their store). Galu decides how your account data is used, so Galu is the controller of it.
• Buyers (the people who open a store's recording page). The store decides to collect what its buyers send, so the store is the controller and Galu processes that data on the store's behalf as its processor. The recording page shows the store's privacy notice before a buyer sends anything. Section 3 describes what that page collects.
• Visitors to getgalu.com. Galu is the controller of the little it collects about visitors (section 4).

If you are a buyer and you contact Galu about something you sent to a store, we will tell the store and help it answer you. The privacy notice on the store's recording page shows how to contact the store directly (section 9).

3. What the recording page collects for a store

When a buyer uses a store's recording page, Galu collects and stores, for that store:

• A video of up to 60 seconds, or one photo, taken with the buyer's camera on the page. A photo is redrawn on the buyer's phone before upload, which removes location and camera details from the file. Showing a face is optional.
• Optional details, each only if the buyer adds it: their name and a star rating from 1 to 5.
• Permission to be contacted, only if the buyer ticks that box: that the store may contact them about what they sent. Galu collects no phone number or email address for this; the box records the permission only.
• Submissions sent before this version took effect may also hold an email address and a caption of up to 2000 characters that the buyer added. They are kept, shown to the store and deleted with the rest of the submission.
• The buyer's answers: whether the store may show the video or photo on its website, and that the buyer is 18 or older.
• A record of those answers: the exact words the buyer saw, the version and full text of the privacy notice shown on the page, the page language, the time, the buyer's IP address and browser details (user agent). These records show what the buyer agreed to.
• Where the link came from, if the store's link carried a tag (email, WhatsApp, SMS, CRM or QR code).
• Page progress events: which step of the page was reached, the browser type and the link tag. These carry no IP address, no browser details beyond the type, and nothing that identifies the buyer.

Galu does not send emails or messages to buyers.

4. What we collect about merchants and visitors

Merchants:

• Account details: your email address and password. The password is stored only as a hash by our sign-in provider; Galu never sees it.
• Store details you enter: store name, your name, country, business category, logo, brand colour, the question on your recording page, your own privacy notice for buyers if you write one, the contact for buyers that your recording page shows (an email address or phone number), your language choices and notification settings.
• Your acceptance of the terms: the version you accepted and when.
• Support messages you send from the app: your name, store name, account ID, subject, message and email address.
• Service records: the in-app notifications we show you, a log of the emails we send you (type, status and time), and any account deletion request.

Visitors to getgalu.com (merchants and buyers included): the hosting provider processes the IP address and request details of every request to serve the page. On Galu's marketing pages only, and only if you accept analytics, Google Analytics collects the details in the Cookie Policy. Your cookie choice is recorded with its time, your IP address and browser details.

5. Why we use personal data

• To provide Galu to merchants, under our Terms of Service: running your account and recording page, storing what buyers send, showing it as each buyer allowed and as you approve, alerting you to new submissions and answering support requests.
• For buyers, only on the store's instructions: to collect, store and show what the buyer sent as the buyer chose, and to keep the record of the buyer's answers. The store relies on the buyer's consent, which the page records.
• To keep Galu secure and prevent misuse: for example the IP address and browser details in consent records, upload limits and sign-up checks against disposable email addresses.
• To meet legal obligations.
• For website analytics, only with your consent and only on the marketing pages.

Galu does not sell personal data, does not use it for advertising, and does not use buyers' videos or photos to train any artificial intelligence model.

6. Who can see it

• The store sees everything sent through its recording page, in its dashboard. It can view the videos and photos, export the submission list (which includes the web address of each video and photo), and export the consent records, which include buyers' IP addresses and browser details.
• The public sees a video or photo only if the buyer said yes and the store approved it. It then appears on the store's Galu wall page and anywhere the store embeds it, with the buyer's name if given (otherwise "Customer"), the star rating if given, and the date and time. The contact permission is never shown publicly, and neither is an email address or caption on an earlier submission.
• Anyone who opens a store's recording page sees the store's name, its logo and the contact for buyers shown in its privacy notice.
• Media file addresses: videos and photos are stored at long random web addresses on Galu's media domain. These addresses are not published or listed unless the item is shown on the store's wall, but anyone who obtains the exact address of a file can open it, including a file that is not shown publicly.
• Galu's own staff: only Ahmed Mustafa, and only as described in section 10 of the Terms of Service.
• Galu's service providers (sub-processors), each for the purpose shown:

Third parties that run in a visitor's browser:

Error reporting with Sentry is built into the app but is not switched on. If Galu switches it on, Sentry becomes a sub-processor and Galu will give the notice described in the Terms of Service first.

• Authorities: we disclose personal data where Saudi law requires it. If we are asked to disclose a store's data, we tell the store unless the law forbids it.

7. Where data is kept and transfers outside Saudi Arabia

Galu's database and store logos are hosted in Frankfurt, Germany. Video and photo files are stored in the European Union. Galu's emails are sent from the European Union. The website is hosted by a United States company whose network serves each request from a location near the visitor. So personal data, including data about buyers in Saudi Arabia, is stored and handled outside the Kingdom:

• European Union: Supabase Inc.; Cloudflare, Inc. (R2 storage); Resend Inc.
• United States: Vercel Inc.

Galu has chosen these providers and regions on a documented good-faith assessment that the data is protected adequately for its purpose. Each store, as controller of its buyers' data, should make its own transfer risk assessment. Galu provides a transfer risk assessment template, built on the guideline published by the Saudi Data and AI Authority (SDAIA), with Galu's details filled in.

8. How long data is kept

• A merchant account is kept while it is open. When you ask to delete it in Settings, your dashboard is locked and you are signed out everywhere at once, and the recording page stops accepting submissions. You can cancel during the next 30 days. After 30 days Galu deletes your account and everything in it: submissions, consent records, videos, photos, logos and your sign-in account.
• Database backups are taken daily and kept for 7 days, so deleted data leaves the backups within 7 days of being deleted. There is no point-in-time recovery. Video and photo files have no backups: once a file is deleted it cannot be recovered.
• A short deletion note is kept for each deleted submission: its ID, who asked for the deletion and how many consent records were removed. It contains no video, photo, name, email address or IP address. Store links that have been used are kept so they are never given to another store.
• A submission is kept while the store keeps it. A buyer can ask the store to delete it (section 9).
• When a store deletes a submission in its dashboard, the video or photo files are deleted, usually within minutes. The submission's details (name, rating and contact permission, and on an earlier submission its email address and caption) and its consent records stay in the store's account, hidden, until the store's account is deleted.
• When a store records a buyer's request to delete ("Buyer withdrew consent" in its dashboard), Galu deletes the submission, its consent records and its files, and keeps only the deletion note above.
• When a store records a buyer's request to stop showing, the item can never be shown publicly again. The store keeps it.
• When a free trial ends, nothing is deleted. The recording page stops accepting new submissions.
• Email and notification records are kept until the account is deleted.
• Support messages are kept in Galu's support mailbox for as long as needed to handle them.
• Cookie choice records (time, choice, IP address and browser details) are currently kept with no fixed end date.

9. Your rights

Under Saudi Arabia's Personal Data Protection Law you have the right to be told how your data is handled, to access it and get a copy, to have it corrected, to have it deleted, and to withdraw your consent.

• Merchants: email privacy@getgalu.com. You can also correct your details and delete your account in Settings, and export your data from the dashboard.
• Buyers: to stop showing or delete what you sent, at any time, or for anything else about your data, contact the store at the contact shown in the privacy notice on its recording page. The store is responsible for your data and must act on a request to stop showing or delete without delay. Galu helps the store answer.

We answer requests within 30 days. If you are not satisfied with our answer, you can complain to the Saudi Data and AI Authority (SDAIA).

10. Security

Section 9 of the Terms of Service describes the measures Galu takes. In short: every connection is encrypted, each store's data is kept apart by database access rules, only Ahmed Mustafa has staff access and every account with access to Galu's systems is protected by multi-factor authentication.

11. Age

Galu accounts are for people aged 18 or older. A buyer must confirm they are 18 or older before sending anything.

12. Cookies

The Cookie Policy lists everything Galu stores in your browser.

13. Changes to this policy

When we change this policy we publish the new version here with a new version number and effective date. For a material change we tell merchants by email or by a notice in the app before it takes effect. A change of sub-processor is announced to merchants at least 14 days before it takes effect, as described in the Terms of Service.

14. Contact

Ahmed Mustafa, operating Galu, freelance document FL-657428298, Jeddah, Saudi Arabia.

Privacy: privacy@getgalu.com. Support: support@getgalu.com.