Skip to content
galu.
Effective date: 27 October 2026

Galu Terms of Service

Effective date: 27 October 2026

Version: 1.2

These terms are the agreement between you, the merchant who opens a Galu account, and Ahmed Mustafa, an individual working under Saudi freelance document number FL-657428298 in Jeddah, Saudi Arabia, who operates Galu ("Galu", "we", "us"). They include the terms on which Galu processes your buyers' personal data for you (section 7) and the security measures Galu takes (section 9). You accept them when you create an account.

These terms are published in Arabic and English. If the two versions differ, the Arabic version prevails.

1. Who can use Galu

Galu is for people who run a store for business use, freelancers included. The person who opens the account must be 18 or older and must have authority to accept these terms for the store. Each account is for one store.

2. The service

Galu gives your store a recording page with its own link and QR code. You send the link to your buyers yourself, for example after delivery. On that page a buyer can send a video of up to 60 seconds or one photo, and can add their name and a star rating, and allow you to contact them about what they sent, if they choose. Every buyer is offered the same choices, whatever they say and however they rate.

In your dashboard you can watch, approve and delete what buyers send. Items you approve, and only those the buyer allowed to be shown, appear on your Galu wall page and anywhere you embed them. Galu also gives you message texts you can copy into WhatsApp, SMS or email; Galu does not send messages or emails to your buyers.

3. Free trial and fees

A new account has a free trial of 7 days, with up to 10 submissions during the trial. A submission over that number is kept but locked: it cannot be approved or shown. When the trial ends, your recording page stops accepting new submissions. Nothing is deleted.

Galu offers no paid plans today and charges you nothing. If paid plans are offered later, they will be billed through Salla under Salla's billing terms, as described in the Refund Policy, and these terms will be updated first under section 16.

4. Your responsibilities

You must:

  • use Galu lawfully, only for your own store and only with your own buyers;
  • show each buyer's video or photo only as that buyer allowed;
  • keep any privacy notice you write for your recording page accurate and lawful, if you replace Galu's notice;
  • answer your buyers' requests about their data (section 7.6 explains how Galu helps);
  • keep your sign-in details secret, and tell us at support@getgalu.com if you think someone else has used your account.

You must not:

  • upload or encourage content that is unlawful, misleading or that infringes anyone's rights;
  • edit or present a buyer's video or photo so that it says something the buyer did not say;
  • try to reach another store's data, test or bypass Galu's security, or overload the service.

5. Videos and photos

Your buyers own what they send. Between you and Galu, what your buyers send through your recording page is your store's content.

You can view them, and show them only as each buyer allowed. Galu uses them only to run your recording page and wall.

Galu does not sell them, does not use them in advertising, does not show them anywhere other than your wall page and your embeds, and does not use them to train any artificial intelligence model. You give Galu permission to store, copy, process and display them only to the extent needed for that.

6. Your account data

Galu is the controller of your own account data, as described in the Privacy Policy.

7. Data processing: Galu as your processor

7.1 Roles

For the personal data of your buyers, you are the controller and Galu is your processor under Saudi Arabia's Personal Data Protection Law and its Implementing Regulation. This section is the processing agreement between us.

7.2 Instructions

Galu processes your buyers' data only to provide the service described in these terms and as you set it up in your dashboard, which together are your instructions. If Galu believes an instruction breaks a law in force in Saudi Arabia, Galu will tell you in writing without delay.

7.3 Purpose, data and duration

  • Purpose: to collect what buyers send through your recording page, store it, show it as each buyer allowed and as you approve, keep the record of each buyer's answers, alert you to new submissions, and let you export and delete it.
  • Personal data: the video or photo; the buyer's name and star rating if they added them; their permission to be contacted, if they gave it; on submissions sent before this version took effect, an email address and caption if they added them; their answers on public display and age; the record of those answers including IP address, browser details, language and time; and the link tag.
  • People concerned: your buyers who use your recording page.
  • Duration: for as long as your account exists, then until deletion is complete as described in section 11.

7.4 Confidentiality

Only Ahmed Mustafa has staff access to your buyers' data, under the limits in section 10, and he is bound by confidentiality.

7.5 Personal data breaches

If Galu becomes aware of a breach affecting your buyers' data, Galu will notify you without undue delay and no later than 24 hours after becoming aware of it, by email to your account address. The notice will include what Galu knows at the time: what happened and when, when Galu found out, the categories and approximate number of buyers and records affected, the likely consequences, the measures taken or proposed, and a contact. Galu will send further details as it learns them. As controller, you are responsible for notifying the Saudi Data and AI Authority and your buyers where the law requires; Galu will help you with the information it holds.

7.6 Helping with buyers' requests

A buyer can ask you to stop showing, or to delete, what they sent, using the contact shown in the privacy notice on your recording page. You must act on such a request without delay: in your dashboard, use "Buyer withdrew consent" on the item to stop showing it or to delete it. Your dashboard also lets you correct how an item is shown, delete an item and export your data. If you need more help to answer a buyer's request, Galu will provide it on request.

7.7 Sub-processors

You authorise Galu to use the sub-processors listed on the Sub-processors page. Galu uses each of them under that provider's data processing terms.

Before adding or replacing a sub-processor, Galu will email you at least 14 days in advance. You may object within those 14 days by writing to privacy@getgalu.com. If Galu cannot address your objection, you may end the service by deleting your account before the change takes effect.

7.8 Laws of other countries

Galu's sub-processors are companies established in the United States. They may be subject to United States laws that can require them to disclose data to authorities there, even for data stored in the European Union.

7.9 Disclosures required by law

If a law in force in Saudi Arabia requires Galu to disclose your buyers' data, Galu may do so without your prior approval, and will tell you about the disclosure unless the law forbids it.

7.10 Information and checks

You may ask Galu in writing for the information you need to check that Galu meets this section. Galu will answer reasonable requests within 30 days.

7.11 If Galu breaks your instructions

If Galu processes your buyers' data against your instructions or this section, Galu is responsible for that processing as if it were the controller, as the Implementing Regulation provides.

8. Where data is kept

Galu's database and store logos are hosted in Frankfurt, Germany; video and photo files are stored in the European Union; emails are sent from the European Union; and the website is hosted by a United States company with a global network. The Privacy Policy gives the details. You are responsible for assessing transfers of your buyers' data outside Saudi Arabia as controller; the transfer risk assessment template has Galu's details filled in for that.

9. Security measures

Galu takes these measures:

  • Encrypted connections: the website, the dashboard, the recording page, the media files and Galu's connections to its providers use HTTPS.
  • Separation of stores: database access rules keep each store's data apart. Public pages can read only items that the buyer allowed to be shown and the store approved.
  • Uploads: a buyer's file is uploaded through a signed link that lasts 10 minutes and can only write into that store's folder, with limits on file type and size and on the number of uploads a minute.
  • Media addresses: videos and photos are stored at long random addresses that are not published or listed unless the item is shown on the store's wall. The files are not protected by sign-in: anyone who obtains the exact address of a file can open it.
  • Passwords: handled by Galu's sign-in provider and stored only as a hash.
  • Records of buyers' answers cannot be changed once written.
  • Staff access: limited as described in section 10, with multi-factor authentication on every account that can reach Galu's systems: Supabase, GitHub, Cloudflare and Vercel.
  • Backups: the database is backed up daily and each backup is kept for 7 days. There is no point-in-time recovery. Video and photo files are not backed up.

10. Staff access

Only Ahmed Mustafa can access merchant and buyer data, and only:

  • to give support when you ask for it;
  • to handle a security incident;
  • to meet a legal obligation;
  • to operate and maintain the service.

Multi-factor authentication is on for every account with that access (Supabase, GitHub, Cloudflare and Vercel).

11. Exporting and deleting your data

You can export your submissions, including the web address of each video and photo, and your buyers' consent records, at any time from your dashboard. Export what you need before you delete your account.

When you ask to delete your account in Settings, your dashboard is locked, you are signed out everywhere and your recording page stops accepting submissions. You can cancel during the next 30 days. After 30 days Galu deletes your account and everything in it: submissions, consent records, video and photo files, logos and your sign-in account. Deleted data leaves the database backups within 7 days. A short deletion note is kept for each deleted submission, with no video, photo, name, email address or IP address.

When you delete a single submission in your dashboard, its video or photo files are deleted, usually within minutes, and its details and consent records stay hidden in your account until your account is deleted.

12. Availability and changes to the service

Galu is provided as it is and as available. We work to keep it running but do not promise that it will be uninterrupted or free of errors. We may change features; we will tell you before a change that takes away something you rely on.

13. Suspension and ending

You can end these terms at any time by deleting your account. We may suspend or close an account that breaks these terms or the law, or where the law requires it, and will tell you why unless the law forbids it. Sections 5, 7, 11, 14 and 17 continue after the account ends, for as long as they are relevant.

14. Liability

To the extent the law allows, Galu is not liable for indirect or consequential loss, or for loss of profit, business or reputation. Galu's total liability to you for all claims is limited to the fees you paid Galu in the 12 months before the event that gave rise to the claim, or SAR 500, whichever is greater. Nothing in these terms limits liability for fraud, for deliberate misconduct, or where the law does not allow it to be limited.

15. Intellectual property

Galu's software, name and design belong to Ahmed Mustafa. Your store's content stays yours, and your buyers' videos and photos stay theirs, subject to section 5.

16. Changes to these terms

We will tell you about a change to these terms by email or by a notice in the app at least 14 days before it takes effect, except a change required by law or to keep the service secure, which may take effect sooner. If you do not accept a change, you can delete your account before it takes effect. Each version has a version number and an effective date.

17. Governing law and courts

These terms are governed by the laws of the Kingdom of Saudi Arabia. The competent courts in Jeddah have jurisdiction over any dispute about them.

18. Contact and notices

Ahmed Mustafa, operating Galu, freelance document FL-657428298, Jeddah, Saudi Arabia. Support: support@getgalu.com. Privacy and data processing: privacy@getgalu.com.

We send notices to the email address on your account.