Privacy Policy

2. Scope of this Policy

This Policy covers the Trendly website, the Trendly mobile applications, dashboards, shared links, and our communications with you. It does not cover third-party services you reach from the Platform — including social media platforms, payment providers and Brand websites — which are governed by their own privacy policies.

3. Personal data we collect

3.1 Information you give us

• Account data: name, username, email address, phone number, password (stored only in hashed form), profile photo, biography, language and country.
• Profile data: content categories, audience description, rate expectations, portfolio material, city, and the platforms you create on.
• Business data (Brands): company or brand name, commercial registration details, VAT number, billing address, team member details and role.
• Verification data: identity or business documents we ask for to verify an account, ownership of a social account, or eligibility for payouts.
• Payment and payout data: billing details, bank account or IBAN for payouts, invoices and transaction history. Full card numbers are handled by our payment providers and are not stored by Trendly.
• Content and communications: campaign briefs, offers, submitted content, messages exchanged with other Users, reviews, support tickets and any information you choose to send us.

3.2 Data from connected social accounts

When you connect an Instagram, Facebook, TikTok, Snapchat or YouTube account, we collect, through the official API of that platform and only within the permissions you grant:

• profile information (username, profile picture, biography, account type, follower and following counts);
• audience insights (age ranges, gender split, countries, cities, languages, active times) in aggregated form as provided by the platform;
• content and performance metrics (posts, reels, stories, videos, likes, comments, shares, saves, reach, impressions, views, watch time);
• engagement rates, growth trends and historical performance derived from the above;
• access tokens needed to maintain the connection, which are stored in encrypted form.

3.3 Data we collect automatically

• Device and log data: IP address, device type and model, operating system, browser type, language settings, crash reports and diagnostic data.
• Usage data: pages and screens viewed, features used, searches run, campaigns viewed, offers sent, timestamps and referring URLs.
• Cookies and similar technologies, as described in section 10.

3.4 Data from other sources

• Publicly available information about a creator or brand, used to build or enrich a profile and to detect fraudulent or duplicated accounts.
• Information from payment providers about the status of a transaction, a chargeback or a verification check.
• Information from a Brand, agency or manager who invites you to the Platform or adds you to a team or a Bundle.
• Referral information where another User invites you.

4. Children

The Platform is not intended for anyone under 18. We do not knowingly collect personal data from children. If we learn that we hold data belonging to a person under 18, we will delete it and close the account. If you believe a minor has provided us with personal data, contact [email protected] immediately. Content featuring a child in a commercial promotion additionally requires the verified consent of a parent or legal guardian and full compliance with applicable law.

5. How we use personal data

• To create and manage your account, authenticate you and keep it secure.
• To build and display Creator profiles, audience insights and performance analytics to Brands evaluating a collaboration.
• To operate the marketplace: publishing campaigns, matching and recommending Creators, sending and managing offers, and running collaborations end to end.
• To process payments, hold funds in escrow, release payouts, issue invoices and apply VAT.
• To verify identity, verify account ownership, detect fake followers or artificial engagement, and prevent fraud, spam, money laundering and abuse.
• To provide customer support and to resolve disputes between Users.
• To send service communications about your account, collaborations, payments, security and changes to our terms.
• To send marketing communications where you have consented or where permitted by law, with an opt-out in every message.
• To measure, analyse and improve the Platform, develop new features, and produce aggregated or anonymised statistics and benchmarks.
• To comply with legal, regulatory, tax and accounting obligations, and to establish, exercise or defend legal claims.
• To meet the requirements of the social platforms whose APIs we use.

6. Legal basis for processing

We process personal data under the Saudi Personal Data Protection Law and its implementing regulations, and — where applicable to you — under equivalent laws in your jurisdiction. Our bases are:

• Performance of a contract — to provide the Platform, run collaborations and process payments under our Terms of Service.
• Your consent — for connecting social accounts, for marketing communications, and for any optional processing. You may withdraw consent at any time; withdrawal does not affect processing already carried out.
• Legitimate interests — to secure the Platform, prevent fraud, verify authenticity, improve the service and defend legal claims, where those interests are not overridden by your rights.
• Legal obligation — to comply with tax, accounting, anti-money-laundering, regulatory and law-enforcement requirements.

7. Who we share personal data with

8. Information that is public or visible to others

• Creator profiles, including username, photo, categories, audience statistics and published collaboration content, may be visible to Brands on the Platform and, where you enable a public profile or a shared link, to anyone with that link.
• Content you publish on your own social channels is public by its nature and is governed by that platform's rules.
• Reviews, ratings and completion statistics may be visible to other Users.
• You control much of this from your account settings, including whether a public profile or shared link is active.

9. Data from Meta, TikTok, Snapchat and YouTube

• We access this data only through official APIs, only with the permissions you grant, and only for the purposes described in this Policy — building your profile, verifying your account, and reporting collaboration performance.
• We use this data in accordance with the developer terms and platform policies of each provider, including any limited-use requirements they impose.
• We do not use connected-account data to build advertising profiles for third parties, and we do not sell it.
• You can disconnect an account or revoke our access at any time in your Trendly settings or in the settings of the social platform itself. On revocation we stop retrieving new data and delete or de-identify the associated tokens; historic campaign reports may be retained in accordance with section 12.

10. Cookies and similar technologies

• Strictly necessary — sign-in, session management, security and load balancing. The Platform cannot function without these.
• Preference — remembering your language (English or Arabic), layout and display choices.
• Analytics — understanding which features are used, diagnosing errors and improving performance, in aggregated form.
• Marketing and attribution — measuring the effectiveness of our own campaigns, where you have consented.

You can control cookies through your browser settings and, on mobile, through your device's advertising and tracking settings. Blocking strictly necessary cookies will prevent parts of the Platform from working.

11. International transfers

Trendly is based in the Kingdom of Saudi Arabia. Some of our service providers process data outside the Kingdom. Where personal data is transferred abroad, we do so only in the circumstances permitted by the Personal Data Protection Law and its implementing regulations, and we put appropriate safeguards in place — including contractual data protection commitments, assessment of the recipient's level of protection, and limiting the transfer to what is necessary for the stated purpose.

12. How we protect personal data

• Encryption of data in transit using TLS, and encryption of sensitive values such as social access tokens at rest.
• Passwords stored using one-way hashing; full card data handled exclusively by PCI-compliant payment providers.
• Role-based access control, so staff access personal data only where needed for their role, under confidentiality obligations.
• Network protection, logging, monitoring and regular review of our infrastructure and dependencies.
• Backup and recovery procedures.
• Vendor due diligence and contractual security obligations for our processors.

No system can be guaranteed completely secure. You also play a part: use a strong, unique password, keep your credentials private, and tell us immediately at [email protected] if you suspect unauthorised access.

13. How long we keep personal data

• Account and profile data — for as long as your account is active, and for a reasonable period afterwards to handle disputes and reactivation requests.
• Collaboration, payment, invoicing and tax records — for the period required by Saudi commercial, tax and accounting law, typically at least 10 years from the end of the financial year in which the transaction took place.
• Connected-account data and tokens — until you disconnect the account, revoke access, or delete your account.
• Support, dispute and moderation records — for as long as needed to resolve the matter and to defend legal claims.
• Marketing preferences — until you withdraw consent, plus a record of the withdrawal itself.
• Aggregated or anonymised statistics that can no longer identify you — indefinitely.

When a retention period ends, we delete the data or irreversibly anonymise it.

14. Your rights

Subject to the conditions and exceptions in the Personal Data Protection Law, you have the right to:

• be informed about how and why your personal data is processed;
• access your personal data and obtain a copy of it in a readable, commonly used format;
• request correction of data that is inaccurate, incomplete or out of date;
• request destruction (deletion) of your personal data where it is no longer needed for the purpose it was collected for, or where processing was based on consent you have withdrawn;
• withdraw your consent at any time, where consent is the basis of the processing;
• object to processing based on our legitimate interests, and to opt out of marketing communications at any time.

To exercise a right, write to [email protected] from the email address registered on your account, or use the controls in your account settings. We may ask you to verify your identity before we act. We will respond within the period required by law, and normally within 30 days. Our service is free; we may charge a reasonable fee or decline to act only where a request is manifestly excessive or repetitive, and we will explain why.

Some rights are limited — for example we must retain transaction and tax records even after an account is deleted, and we may retain data needed to prevent fraud, enforce our Terms, or defend a legal claim.

15. Deleting your data and closing your account

• You can request deletion from your account settings, by following the steps at trendly.com.sa/data-deletion, or by emailing [email protected].
• Before deletion we will ask you to complete or settle any active collaboration and to withdraw any outstanding balance.
• On deletion we remove or anonymise your profile, your connected-account data and your access tokens, and remove your profile from Brand search.
• We retain the records described in section 13 where the law requires it, and messages or content already delivered to another User may remain in that User's records where they have a lawful basis to keep them.

16. Marketing communications

We send service messages — about your account, collaborations, payments and security — because they are necessary to provide the Platform; these cannot be opted out of while your account is open. Marketing messages are sent only where you have consented or where otherwise permitted by law, and every marketing message includes a way to unsubscribe. You can also manage notification preferences in your account settings.

17. Automated processing and profiling

We use automated processing to rank search results, recommend Creators to Brands, estimate audience quality and engagement, classify creator tiers, and flag suspicious activity for review. These processes support human decision-making; we do not make decisions producing legal effects on you based solely on automated processing without human review. If an automated check restricts your account, you can ask us to review it by contacting support.

18. Personal data breaches

We maintain procedures to detect, investigate and respond to personal data breaches. Where a breach occurs, we will notify the competent supervisory authority and, where the breach is likely to cause serious harm to you, notify you directly, within the timeframes required by applicable law, and describe what happened, what data was involved and what steps we and you can take.

19. Changes to this Policy

We may update this Policy to reflect changes to the Platform, to our practices, or to the law. The current version is always published on this page with a new “Last updated” date and version number. Where a change is material, we will notify you by email or in-app before it takes effect. Continued use of the Platform after that date means you accept the updated Policy.

20. Contact us

For any question about this Policy, to exercise a right, or to raise a privacy concern: