Privacy Policy

Version: 1.2 Last updated: 8 July 2026 Effective date: 8 July 2026

PICTAURA

Privacy Policy

This Privacy Policy (the "Policy") describes how the Pictaura platform, operated by Abdullah Mohammed Alotaiby under [CR or Freelancer Permit Number, Kingdom of Saudi Arabia] ("Pictaura", "we", or the "processing entity"), collects, processes, retains, and shares personal data when you use the Pictaura platform available at pictaura.com and any related applications (the "Platform"). This Policy is to be read together with the Terms of Service and forms an integral part of them.

This Policy is subject to the Personal Data Protection Law issued by Royal Decree No. M/19 dated 9/2/1443H and its Implementing Regulations (the "Law" or "PDPL"), supervised by the Saudi Data and Artificial Intelligence Authority (SDAIA). Pictaura currently operates exclusively within the Kingdom of Saudi Arabia.

1. Definitions

• "Personal Data": any data, of whatever source or form, that would lead to the identification of an individual specifically, or that makes their identification possible.
• "Sensitive Data": data revealing racial or ethnic origin, religious or political opinion, associational membership, criminal or security data, biometric or genetic data, or data relating to physical or mental health.
• "Processing": any operation performed on personal data, whether collection, recording, storage, updating, retrieval, use, disclosure, transfer, deletion, or otherwise.
• "Data Subject": the individual to whom the personal data being processed relates, whether a Client, a Photographer, or a visitor to the Platform.
• Any other terms not defined in this Policy have the meaning given to them in the Terms of Service.

2. Scope of the Policy and the Entity Responsible for Processing

Pictaura is the controller of the personal data collected through the Platform within the meaning of the Law, and determines the purposes and means of processing this data. This Policy applies to all users of the Platform — Clients, Photographers, and visitors — within the Kingdom of Saudi Arabia.

Pictaura does not currently use any artificial intelligence technologies in the processing of personal data or in making automated decisions concerning users. If any such feature is introduced in the future, this Policy will be updated before its activation to disclose the nature of the processing and its legal basis.

3. Data We Collect

3.1 Account creation data

• Full name, mobile number, email address, city/region, and encrypted password.
• For Photographers: a profile bio, photography specialty, and a portfolio of no fewer than five works.

3.2 Identity and eligibility verification data

• A copy of the valid National ID or Iqama of Photographers, for verification of identity and legal eligibility.
• Licensing data: freelance permit, commercial registration, or tax registration, as applicable.
• Additional verification data for high-stakes booking categories (such as weddings), where requested.

3.3 Financial and banking data

• Bank account number (IBAN) of Photographers for the purpose of paying out earnings.
• Client payment method data, which is processed directly by the licensed payment processor Tap Payments; Pictaura does not retain full payment card data on its systems.

3.4 Booking and photography data

• Booking details: date, location, session type, and agreed scope of work.
• Photos delivered through the Platform delivery feature, which may include images of the Client or other persons appearing in the session, including minors where documented guardian consent exists.

3.5 In-platform chat data

The content of conversations between Clients and Photographers through the Platform internal chat system. This data is processed primarily to facilitate communication, and may be reviewed by Pictaura to verify compliance with the anti-circumvention and prohibited-conduct rules in the Terms of Service, or to resolve an active dispute.

3.6 Reviews and ratings data

The text of reviews and the ratings left by Clients and Photographers after a booking is completed.

3.7 Technical and usage data

• IP address, device and browser type, and operating system.
• Usage logs: pages visited, timing, and actions taken within the Platform.
• Cookies and similar technologies, as described in Section 9.

3.8 Support communications data

The content of your correspondence with the support or legal teams via support@pictaura.com or legal@pictaura.com.

3.9 Data from Pictaura's social media accounts

Pictaura operates accounts on social media platforms (such as Instagram, Twitter/X, or others) for marketing and public communication. When you interact with these accounts (by commenting, messaging, or following), we may see the data made available to us by your privacy settings on that platform, such as your account name, public picture, and the content of your interaction. We may also receive aggregated, non-identifying analytics about the performance of these accounts from the social media providers themselves. Pictaura does not control the privacy practices of these platforms, which are governed by their own policies, not this Policy.

Note: Pictaura does not currently collect any sensitive data within the meaning of the Law (such as health, biometric, or criminal data) as a routine part of operating the Platform. If exceptional circumstances require the submission of a medical document (such as a cancellation-penalty waiver supported by a medical report under Section 7.3 of the Terms of Service), such data is handled under enhanced safeguards, access to it is restricted to authorised personnel, and it is destroyed as soon as the purpose of its submission ends unless a legal retention obligation exists.

4. Sources of Data Collection

• Directly from you when registering, creating a booking, communicating through chat, or submitting verification documents.
• From the other party to a booking (for example: the appearance of a person in a photo delivered by the Photographer).
• Automatically through your use of the Platform (technical data and usage logs).
• From the payment processor (Tap Payments) regarding the status of a financial transaction, without full payment card details.

5. Legal Basis for Processing and Purposes

Pictaura processes personal data on the basis of one or more of the following legal bases established in the Law and its Implementing Regulations:

• Performance of the contract with you: to enable bookings, confirm identity, process payments through escrow, deliver photos, and resolve disputes under Section 10 of the Terms of Service.
• Legal obligation: to comply with anti-money-laundering regulations, tax and Zakat regulations, and requests from competent government authorities.
• Pictaura's legitimate interest, without prejudice to the rights of data subjects: to protect Platform security, prevent fraud and circumvention, improve the service, and analyse usage.
• Explicit consent: in cases specifically required by the Law, such as using photos in which third parties appear in marketing materials, publishing photos of minors, or direct marketing communications unrelated to account operation.

The detailed purposes of processing include: creating and managing accounts; verifying the identity and eligibility of Photographers; completing bookings and processing payments and payouts through Tap Payments; hosting delivered photos and making them available for download for ninety (90) days; operating and monitoring the chat system for the anti-circumvention and prohibited-conduct purposes set out in the Terms of Service; managing reviews; providing technical support; analysing and developing the Platform; complying with applicable Saudi regulations; and defending Pictaura's legal rights where necessary.

6. Sharing Data with Other Parties

Pictaura does not sell your personal data to any party. Pictaura may share your data with the following parties, solely for the purposes stated against each:

• The other party to the booking: each of the Client and the Photographer sees only the data necessary to complete the booking (such as name, session details, and delivered photos), without direct contact details before booking confirmation, in line with the platform-only communication rule in Section 6 of the Terms of Service.
• Tap Payments: as the payment institution licensed by the Saudi Central Bank (SAMA) that processes all Platform payments and Photographer payouts.
• Hosting and technical infrastructure providers: to store account data and delivered photos and to operate the Platform securely.
• Identity verification service providers: to verify the National ID or Iqama and the regulatory documents of Photographers.
• Technical support and messaging providers: to operate the chat, notification, and email systems.
• Competent government and judicial authorities: where there is a binding legal request, or to comply with anti-money-laundering, tax, and Zakat regulations, or to protect the rights of Pictaura, its users, or the public.
• Professional advisers: such as accountants and legal advisers, to the extent necessary for their advice.
• Parties to an acquisition, merger, restructuring, or asset sale: if Pictaura undergoes an acquisition, merger, restructuring, or a sale of all or part of its assets, or the operation of the Platform transfers to another provider, your personal data may be transferred to the successor or acquiring party as part of the assets of that transaction. In such a case, Pictaura is committed to notifying affected users in advance, and the data remains subject to the same protection obligations in this Policy unless the user is notified otherwise and given the right to object in accordance with the Law.

Pictaura binds third parties that process data on its behalf under data processing agreements consistent with the requirements of the Law, and restricts their processing exclusively to the purposes specified by Pictaura.

7. Data Retention

• Delivered photos: hosted by Pictaura for ninety (90) days from the date of delivery, then moved to archive or deleted according to the operational policy in force at the time. The Client is responsible for downloading the photos within this period.
• Identity verification data and regulatory documents: retained for the period necessary to fulfil the purpose of their processing or the period required by the relevant Saudi laws and regulations, whichever is longer.
• Financial data and transaction records: retained for the same period referred to above, or until the expiry of any related claim or dispute, whichever is longer.
• Chat content: retained for the duration of the account and for a reasonable period afterwards sufficient to investigate potential anti-circumvention violations (Section 6.3 of the Terms of Service) or to resolve a dispute, not exceeding twelve (12) months from the date of the last message, unless an active dispute requires a longer period.
• Reviews: retained for as long as they appear on the Platform, unless removed under Section 15 of the Terms of Service.
• Basic account data after closure: certain data (such as name, booking number, and violation history) may be retained after account closure for legal and operational purposes, including evidencing fulfilment of legal obligations, preventing re-registration after a permanent ban, and defending Pictaura's rights in any future claim.

When the purpose of processing ends and any legal retention obligation expires, Pictaura deletes the personal data or anonymises it in a manner that no longer allows the identification of its subject.

8. Data Security

Pictaura takes reasonable technical and organisational measures proportionate to the nature of the data and the scale of processing, including encrypting communication between the user and the Platform, restricting internal access to data on a need-to-know basis, and not storing full payment card data on Pictaura's systems. However, absolute security cannot be guaranteed for any information system or internet transmission, and the user is responsible for keeping their login credentials confidential and for notifying Pictaura immediately via support@pictaura.com upon suspecting any unauthorised access.

In the event of a breach likely to cause serious harm to personal data or its subjects, Pictaura will notify the competent authority and affected data subjects in accordance with the mechanism specified by the Law and its Implementing Regulations. Pictaura is committed to notifying the competent authority without delay and no later than seventy-two (72) hours from the occurrence or discovery of the incident.

9. Cookies and Similar Technologies

Pictaura's website and applications use essential cookies to operate the Platform (such as keeping you signed in), and analytics cookies to understand usage patterns and improve performance. You can manage these through your browser or device settings, noting that disabling essential cookies may affect the functioning of some Platform features.

10. External Links and Social Media Sites

Pictaura's website or applications may contain links to sites or platforms that Pictaura does not operate and does not control, including the social media platforms referred to in Section 3.9. Any data you share through those external sites or platforms is governed by their own privacy policies and terms of use, not by this Policy. Pictaura's inclusion of these links does not constitute an endorsement or a review of the privacy practices of those parties, and you are advised to review the privacy policy of any external site before sharing your data with it.

11. Privacy of Persons Appearing in Photos and Minors

The Photographer may not publish, share, or commercially use delivered photos in which the Client or identifiable persons appear without their prior written consent; this applies by default to wedding and event photography, in line with Section 12.4 of the Terms of Service.

Photos in which minors appear require prior written consent, documented through the Platform, from the parent or legal guardian, and such photos may not be displayed in Pictaura's marketing materials without additional explicit and specific consent. Pictaura does not process minors' data independently of the context of the booking concluded by the guardian, and does not direct any marketing to them. If no response is received from the guardian within ten (10) days from the date of the consent request, Pictaura is committed to destroying any data collected about the minor and their guardian in that context.

Under the limited marketing licence in Section 12.3 of the Terms of Service, Pictaura may display low-resolution, watermarked versions of selected photos for the purpose of marketing the Platform and the Photographer's profile, subject to the consents of the persons appearing in them as set out above; the Photographer may withdraw this licence at any time from their account settings.

12. Chat Monitoring

Pictaura may review the content of in-platform conversations to verify compliance with the anti-circumvention and prohibited-conduct rules in Sections 6 and 13 of the Terms of Service, upon receiving a report, or to resolve a dispute. Such review is not used for any marketing purpose, and access to it is restricted to employees specifically authorised for that purpose.

13. International Data Transfers

Pictaura currently operates within the Kingdom of Saudi Arabia only, and seeks to host personal data within the Kingdom whenever possible. If Pictaura engages technical service providers headquartered outside the Kingdom, or whose processing of data occurs outside the Kingdom, this will take place only under one of the cases permitted by the Law, including: a decision by the competent authority recognising the level of protection in the receiving country as adequate; the existence of an approved agreement or contractual mechanism guaranteeing a level of protection equivalent to that provided by the Law; or the necessity of the transfer for the performance of a contractual obligation in the interest of the data subject — in all cases limited to the minimum data necessary. In all circumstances, no transfer or processing of personal data outside the Kingdom will take place without obtaining the prior written approval of the competent regulatory authority, in addition to satisfying one of the bases referred to above.

14. Your Rights Under the Personal Data Protection Law

The Law guarantees you the following rights regarding your personal data held by Pictaura:

• The right to be informed: to know the legal basis and purpose of the collection of your data, as set out in this Policy.
• The right of access: to request access to your personal data held by Pictaura and to obtain a copy of it.
• The right to request correction: to correct or complete your inaccurate or incomplete data.
• The right to request destruction: to request the deletion of your data when the purpose of its processing has ended, subject to the legal retention obligations set out in Section 7.
• The right to withdraw consent: to withdraw any previously given consent for consent-based processing, without affecting the lawfulness of processing carried out before the withdrawal.
• The right to lodge a complaint: to submit a complaint to the Saudi Data and Artificial Intelligence Authority (SDAIA) as the authority competent to supervise the application of the Law.

To exercise any of these rights, please contact privacy@pictaura.com. Pictaura will verify your identity before acting on any request and may request additional information for this purpose. Your request will be answered within a period not exceeding thirty (30) business days from the date of receipt, extendable by an additional period not exceeding thirty (30) business days, provided you are notified of the extension and its reasons before the first period expires.

15. Children's Privacy

Persons under eighteen (18) years of age may not create an account on the Platform as a Client or a Photographer, in line with Section 2.1 of the Terms of Service. Pictaura's processing of minors' data is limited to their appearance in photos delivered by a Photographer under a booking concluded by the guardian, in accordance with the controls in Section 11 above. If Pictaura becomes aware that an account has been created in the name of a person under eighteen, the account will be closed immediately and its data deleted in accordance with the applicable retention policy.

16. Changes to This Privacy Policy

Pictaura may update this Policy from time to time to reflect regulatory or operational changes. In the event of a material change, active users will be notified at least thirty (30) days before it takes effect, by email and by an in-platform notice, in line with Section 17 of the Terms of Service. Continued use of the Platform after the effective date of the change constitutes acceptance of the updated Policy.

17. Contact

• Privacy enquiries and exercise of rights: privacy@pictaura.com
• General support: support@pictaura.com
• Legal affairs: legal@pictaura.com
• Operator: Abdullah Mohammed Alotaiby, under [CR or Freelancer Permit Number], Riyadh, Kingdom of Saudi Arabia.

By using the Pictaura platform, you acknowledge that you have read and understood this Privacy Policy.