Sannaa
Last updated: 4 October 2026

Privacy Policy

This policy explains how Sannaa, as the data controller, collects, processes and protects your personal data when you use it, in line with the Saudi Personal Data Protection Law and its implementing regulations.

Data we collect

  • Account data: your email address and, if you sign in with Google, the name, email and profile picture Google sends.
  • Content you upload or write: product photos, your own photo if used for the virtual presenter, and texts and descriptions.
  • Generated content and activity: tool, cost in points, status and date.
  • Balance and payment data: pack, amount, the payment gateway's transaction reference and status. We never receive or store your card details.
  • Photo consent: the consent text and the time you agreed to it.
  • Technical data: IP address and browser information, for security and to verify you are not a bot.

Why we process your data

  • Providing the service: running generations and keeping your work in your account.
  • Managing your account, balance and purchases.
  • Completing and verifying payments and preventing fraud.
  • Protecting the platform, enforcing usage limits and preventing fake accounts.
  • Service messages such as sign-in links and job notifications.
  • Complying with the laws of the Kingdom.

We do not sell your personal data, and we do not use your content to train our own AI models.

Legal basis

We process your data based on your consent at sign-up, to provide the service you request, for our legitimate interest in protecting the platform, and to meet legal obligations. You may withdraw consent at any time, which may prevent us from providing the service.

Who we share data with

We share the minimum data needed with service providers that process it on our behalf under contractual protection obligations:

  • Database, authentication and hosting provider.
  • AI model providers that run generations, receiving only the image or text the request needs.
  • A language model provider that improves the wording of your description.
  • File and result storage provider.
  • The licensed payment gateway.
  • Email delivery provider.
  • Human verification provider.
  • Advertising and analytics platforms (TikTok, Snapchat, Meta, Google Analytics and Google Ads) and the product analytics tool PostHog (EU servers), only after you accept cookies.
  • Cloudflare Web Analytics, for aggregated visit statistics without cookies or cross-site tracking.

Transfers outside the Kingdom

Some providers are located outside Saudi Arabia, including in the European Union and the United States. We transfer only the minimum data needed, under the controls set by the law and the regulation on transferring personal data outside the Kingdom.

Retention

We keep your account data and work while your account is active. When you ask us to delete your account, we delete your personal data and content within 30 days, except payment records the law requires us to keep for the statutory period.

Your rights

The Personal Data Protection Law gives you the right to:

  • Be informed of how and why your data is collected and processed.
  • Access your data and obtain a copy in a clear format.
  • Correct, complete or update your data.
  • Request destruction of your data once it is no longer needed.
  • Withdraw your consent to processing.

Exercising your rights

Email [email protected] from your account's email address and we will respond within 30 days. You may also complain to the Saudi Data & AI Authority (SDAIA) if you believe your data was processed in breach of the law.

How we protect data

  • Encrypted connections between your browser and our servers.
  • Each user's data is isolated at the database level, so no one sees anyone else's data.
  • Secret service keys never reach the browser.
  • Limited, need-based access for our team.

If a data breach occurs, we notify the competent authority and you as the law requires.

Browser storage and cookies

We use browser storage to keep you signed in, to hold temporary data about your last payment, and to remember your cookie choice. This is needed for the platform to work.

Advertising and analytics cookies (TikTok, Snapchat and Meta pixels, Google Analytics and Google Ads) are loaded only after you press “Accept” in the cookie banner, and never if you press “Reject”. We use them to measure page views, completed sign-ups and completed purchases (amount and currency only) to improve our ads. We never send them your email or your content.

With the same consent we use the product analytics tool PostHog to understand and improve how the platform is used: pages you visit, buttons you press, your navigation path and a recording of your session showing page activity. Every field you type in (such as email and texts) is masked in recordings, and if you are signed in the session is linked to your account and email so we can help you. Admin pages are never recorded, and the data is stored by PostHog in the European Union.

You can change your choice at any time from “Cookie settings” at the bottom of the page.

Children

The platform is not intended for anyone under 18, and we do not knowingly collect their data.

Updates and contact

We publish any update on this page with its date and email you about material changes. Contact: [email protected].