Privacy Policy

Who we are

Thakeen is an AI marketing platform for businesses in the Gulf. This policy explains what we collect, how we use it, and your rights under the Saudi Personal Data Protection Law (PDPL).

What we collect

Account data: name, email, mobile number, password (hashed).

When you sign up we record which version of the terms of service and of this privacy policy you were shown, and when you agreed.

Brand data: your website, products, audience, tone, and what you tell Noor.

Connected platforms: when you connect a store or account (such as WordPress, WooCommerce or Telegram) we store access tokens or keys encrypted and read only what the permissions you approved allow.

Usage data: requests to Noor, what you approve or reject, and technical logs needed to run the service.

Agent scope log: when a request or a reply falls outside what the team works on, we keep the first 200 characters, the agent and the verdict for 31 days, visible to the founder only.

How we use it

To run the service: create content, plans and messages, and publish to platforms you connected on your instruction.

To improve Noor for your brand: your edits are stored as preferences for your account only.

We do not sell your data, and Thakeen does not train models on your content. These services process data for us: Hostinger hosts the app; Upstash stores the account and workspace data and schedules timed jobs; AI providers (Anthropic for text; fal.ai, kie.ai and Higgsfield for images and video) process the content they work on, and the Straitly gateway may carry text-model requests to the text provider (it is off by default and used only if we switch it on); images and videos are kept as private copies on our Hostinger servers, visible only to members of the workspace, and a short-lived link is handed to a platform or provider only when you publish or generate, and copies made before 13 October 2026 may remain on Vercel Blob at addresses that cannot be guessed until we move them; Resend sends email; Composio holds the access for accounts you connect through it, among them Google Drive, Dropbox and OneDrive if you link them: we read only the file you pick, write only a new file when you press Save to, and delete nothing there; Cloudflare Turnstile checks the sign-up and password-reset forms for automated abuse when it is switched on; Paymob processes card payments when online payment is offered. To generate images and video we send the image description built from your post and brand, and the post's current image, to fal.ai, kie.ai and Higgsfield. Higgsfield's terms allow it to use inputs and outputs to improve its models, and kie.ai's terms allow it to use content to operate and improve its service. Images and videos made by the team are AI-generated.

Connected platforms

You can disconnect any account at any time from the Integrations page; tokens are deleted immediately. We publish only when you ask; governance settings can auto-approve items but never publish them.

Partner programme

Partner links: opening a partner's link (/p/CODE) sets a first-party cookie (thakeen_partner) for 30 days that holds only the partner's code and the time of the click, so we know who referred you if you sign up. We use it for nothing else.

If you sign up through a partner or with their code, your account records which partner referred you and when, and we record your payments to work out their commission. The partner sees a random pseudonymous label instead of your name and email, with your signup date, your status (trial, paid, lapsed), the months counted and the payment amounts their commission is based on; never your name, email or phone.

If you are a partner, we keep the bank account holder's name and the IBAN only to pay your commission. Only the founder sees them in full, you see them masked, they are never written to any log, and they are deleted with your account.

With them we keep the country you live in and your tax number if you enter one (and whether you told us you are VAT-registered), to know which tax we bear when we pay your commission (VAT or withholding tax), and the amounts of those taxes with each transfer, for our books. They are deleted with your account.

When you apply to the partner programme we keep what you enter in the form, and when you agreed to the partner programme terms and which version.

Retention and deletion

We keep data while your account is active. You can download a copy of your data yourself from Settings, Danger zone (“Download my data”): your account, the recorded consent, plan and credits, brands, tasks, files, conversations, and connected accounts without their access tokens. You can delete your account yourself on the same page: your account, brands, files, content and connection tokens are deleted immediately. Our copies of your generated images and videos on Hostinger are deleted with it; older copies on Vercel Blob are not removed by this step. What you published stays with the platform, and some images stay at fal.ai at their own short-lived link; render records expire on their own within 14 days. To request deletion of anything else, use the support form in the Help Center; we complete requests within 30 days.

The agent scope log deletes itself after 31 days.

Your rights

Access, correction, deletion, objection, and portability. Contact us through the support form in the Help Center or WhatsApp +966 55 923 5281.