Privacy Policy

Effective date: July 1, 2026

This Privacy Policy explains how Sahel Couture ("sahelcouture.com", "SahelCouture", "we", "us", or "our") collects, uses, shares, and protects personal data in connection with the SahelCouture platform, including our website, applications, and related services (the "Service"). For the purposes of the Egyptian Personal Data Protection Law No. 151 of 2020 (the "PDPL") and other applicable data protection laws, SahelCouture is the controller of the personal data described in this Policy.

We have written this Policy to describe what we actually do today. Where a practice may change in the future — for example, the introduction of analytics tools — we say so explicitly, and any such change will be reflected in an updated version of this Policy before it takes effect.

1. Personal Data We Collect

1.1 Data you provide when creating an account

  • Email address — required; used as your login identifier and to send you transactional messages about your account.
  • Password — required; stored only in hashed (irreversibly encoded) form. We cannot see your actual password.
  • Display name — required; the name shown with your profile on the Service.
  • Gender (female/male) — optional.
  • City (Cairo, Alexandria, or Other) — optional.
  • Profile photo — optional upload.
  • Short bio — optional free-text description (up to approximately 280 characters).
  • Language preference (English or Arabic) — determines the language of the emails we send you.
  • Marketing consent — a separate, optional checkbox indicating whether you wish to receive personalised updates from us. This is recorded as a distinct consent flag and can be withdrawn at any time (see Section 8).
  • Instagram handle — an optional field that exists in our signup form and data model but is not currently used by any feature of the Service.

1.2 Data you provide through use of the Service

  • Venue and event submissions. If you submit a venue or event for the directory, we collect the business details you provide: name, category, location and map coordinates, operating hours, photographs, and contact information. Submissions are reviewed by our administrators through a moderation queue before publication, and approved listings are displayed publicly on the Service.
  • Invitation data. If you invite someone to join through our founding-member (VIP) program, we collect the name and contact information (email address or WhatsApp number) of the person you invite, as provided by you, and we record which member issued each invitation and whether it was accepted.

1.3 Data about people who have not created an account (invitees)

If a SahelCouture member invites you to join the Service, we hold your name and the email address or WhatsApp number the inviting member provided, together with a record of who invited you. We use this data only to deliver the invitation and to operate the invitation programme. If you do not wish to receive invitations or want this data deleted, contact us at privacy@sahelcouture.com and we will remove your details from the invitation records.

1.4 Data collected automatically

  • Session and security cookies. See Section 4 (Cookies).
  • Server logs. Like virtually all internet services, our servers automatically record routine technical information when you access the Service, such as your IP address, the pages requested, the date and time of the request, and browser type. We use this information for security, troubleshooting, and operating the Service, not for advertising or profiling.

1.5 Data we do not collect

We do not currently collect payment or financial information (the Service does not process payments), biometric data, or precise device location. We do not use analytics or advertising trackers (see Section 4), and we do not build advertising profiles of our users.

2. How We Use Personal Data, and Our Legal Basis

Under the PDPL, we process personal data only where we have a lawful basis to do so. The list below sets out each purpose and its basis:

  • Creating and operating your account (email, password, display name, language preference) — necessary for the performance of our agreement with you (the Terms of Use).
  • Sending transactional emails (account confirmations, invitation deliveries, service notices), in your chosen language — necessary for the performance of our agreement with you.
  • Displaying your profile (display name and, where you choose to provide them, photo and bio) — performance of our agreement with you for required fields; your consent for optional fields, which you may withdraw by removing the information from your profile or contacting us.
  • Optional demographic fields (gender, city) — your consent, given by choosing to fill in these fields; used to understand our early community and improve the relevance of the Service. You may leave them blank or ask us to delete them at any time.
  • Personalised updates and marketing communications — your consent, given via the separate marketing checkbox at signup. You may withdraw this consent at any time (see Section 8), and withdrawal does not affect your account or use of the Service.
  • Reviewing and publishing venue and event submissions — performance of our agreement with the submitting user, and our legitimate interest in maintaining an accurate, trustworthy directory.
  • Operating the invitation programme (processing invitee names and contact details, tracking invitations) — our legitimate interest in growing the Service through personal invitations during the pre-launch period, balanced by the safeguards described in Section 1.3, including invitees' right to have their details deleted.
  • Security, fraud prevention, and moderation (server logs, session management, reviewing conduct) — our legitimate interest in keeping the Service and its users safe, and compliance with our legal obligations.
  • Complying with legal obligations, including responding to lawful requests from competent authorities — compliance with applicable law.

3. Who We Share Personal Data With

We do not sell personal data, and we do not share it with third parties for advertising purposes. We share personal data only in the following limited circumstances:

  • Mapbox (map services). The interactive venue map on the Service is rendered using Mapbox GL JS, a service of Mapbox, Inc. When you view a page containing the map, your browser requests map tiles directly from Mapbox's servers, which means Mapbox receives your IP address and standard request information, in the same way as any embedded mapping service. Mapbox's own privacy policy governs its handling of that data.
  • Email delivery. Transactional emails (such as account confirmations and invitations) are sent through our email service provider, which processes recipient email addresses and message content on our behalf for the sole purpose of delivering our emails.
  • Hosting and infrastructure. The Service and its data are hosted with our cloud infrastructure provider, which stores data on our behalf. See Section 6 regarding the location of processing.
  • Legal requirements. We may disclose personal data where required by applicable law, regulation, or a binding order of a competent court or authority, or where reasonably necessary to establish, exercise, or defend legal claims or to protect the safety of any person.
  • Business transfers. If SahelCouture is involved in a merger, acquisition, or sale of assets, personal data may be transferred as part of that transaction, subject to the requirements of applicable data protection law; we would notify users of any such change.

Where third parties process personal data on our behalf, we require them to process it only on our instructions and to protect it appropriately.

4. Cookies

The Service currently uses only the following cookies, both of which are strictly necessary for the Service to function:

  • Session cookie — keeps you signed in as you move between pages.
  • CSRF protection cookie — a standard security cookie that protects forms on the Service against cross-site request forgery attacks.

We do not currently use any analytics, advertising, or tracking cookies. There is no Google Analytics, no Meta (Facebook) Pixel, and no device fingerprinting on the Service. If we introduce analytics or similar tools in the future, we will update this Policy before doing so and, where required by applicable law, seek your consent.

5. Data Retention

We retain personal data only for as long as it is needed for the purposes described in this Policy. Under Egypt's Personal Data Protection Law (Law No. 151 of 2020), personal data must not be retained for longer than is necessary to fulfil the purpose for which it was collected, unless a longer retention period is required by applicable law — we apply this principle across every category of personal data described in this Policy, including server logs, inactive accounts, and any future customer-support or transaction records:

  • Account data is retained for as long as your account is active. If you close your account or ask us to delete it, we will delete or anonymise your personal data within a reasonable period, except where we are required to retain certain records by law or need them to resolve disputes or enforce our agreements.
  • Invitation data for invitees who do not join is retained only as long as needed to operate the invitation programme, after which it is deleted or anonymised.
  • Published venue and event listings are retained while the listing remains live; business contact information within listings is treated as part of the listing.
  • Server logs are retained for a short, limited period for security and troubleshooting purposes.

6. Where Your Data Is Processed (Cross-Border Transfers)

The Service is operated from Egypt, but your personal data may be processed or stored on servers located outside Egypt, including through our cloud hosting provider and the service providers described in Section 3 (for example, Mapbox processes map requests on its own international infrastructure).

Where personal data is transferred outside Egypt, we will do so in accordance with the requirements of the PDPL and its implementing regulations, including — where applicable — ensuring an adequate level of protection in the destination, putting appropriate contractual safeguards in place with the receiving party, obtaining any required consent, and obtaining any licence or permit required from the competent Egyptian authority. We will update this section with more specific information about hosting locations once our production infrastructure is finalised.

7. How We Protect Your Data

We apply appropriate technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration, and destruction. These include storing passwords only in hashed form using industry-standard algorithms, restricting administrative access to personal data to authorised personnel, and using standard security protections in our application framework (including CSRF protection and session management). No method of transmission or storage is completely secure, and we cannot guarantee absolute security, but we work to protect your data in line with good industry practice and applicable law. In the event of a personal data breach affecting your rights, we will act in accordance with our obligations under the PDPL, including notifying the competent authority and affected individuals where required.

8. Your Rights

Under the PDPL and this Policy, you have the following rights in relation to your personal data:

  • Right to know. You may ask us to confirm whether we hold personal data about you, and to be informed of the purposes for which it is processed and the legal basis for that processing.
  • Right of access. You may request a copy of the personal data we hold about you.
  • Right to correction (rectification). You may ask us to correct personal data that is inaccurate or incomplete. You can also update most account information directly in your profile settings.
  • Right to withdraw consent. Where our processing is based on your consent — including marketing communications and optional profile fields — you may withdraw that consent at any time. Withdrawal takes effect going forward and does not affect the lawfulness of processing carried out before withdrawal.
  • Right to deletion (erasure). You may ask us to delete your personal data, including by closing your account. We will honour such requests except where retention is required by law or necessary for the establishment, exercise, or defence of legal claims.
  • Right to object and to restrict. You may object to, or ask us to limit, processing carried out on the basis of our legitimate interests, and we will do so unless we have compelling legitimate grounds to continue.

To exercise any of these rights, contact us at privacy@sahelcouture.com from the email address associated with your account (or, if you are an invitee without an account, from the contact address the invitation was sent to). We may need to verify your identity before acting on a request. We will respond within the period required by applicable law and in any event without undue delay.

If you believe we have processed your personal data in violation of applicable law, you also have the right to lodge a complaint with the competent Egyptian data protection authority (the Personal Data Protection Centre established under the PDPL).

9. Children's Privacy

The Service is not directed at children, and our Terms of Use require users to be at least eighteen (18) years of age. We do not knowingly collect personal data from children. If you believe a child has created an account or that we otherwise hold a child's personal data, please contact us at privacy@sahelcouture.com and we will delete it.

10. Changes to This Policy

We may update this Privacy Policy from time to time — for example, if we add new features, adopt new service providers, introduce analytics tools, or if the law changes. When we make changes, we will post the updated Policy on the Service with a revised effective date. If a change materially affects how we use your personal data — in particular, any new category of data collection, any new tracking technology, or any new sharing of data — we will take reasonable steps to notify registered users in advance (for example, by email or by prominent notice within the Service) and, where the change requires consent under applicable law, we will obtain it before the change takes effect.

11. Contact Us

For any questions about this Privacy Policy, or to exercise your rights, contact: