Privacy policy

Last updated: 30 October 2026

This policy explains what personal data WhiteMore Intelligence (“WhiteMore”, “we”) collects when you use the WhiteMore platform, why, how long we keep it and how you can see, correct or delete it. It follows the Saudi Personal Data Protection Law (PDPL).

1. What we collect

  • Account details: your name, email address, role and account status, created by your organisation's administrator.
  • Access requests: when you ask for an account on our website, your name, work email and, if you give them, company, job title, phone and message.
  • What you save on the platform: watched districts and notes, saved reports and your alerts.
  • Security records: sign-ins and administrator actions (for example creating a user), with the email of the person who did them.
  • Technical data: your language choice (a cookie) and your sign-in session (kept in your browser). The map service receives your device's internet address to send map images.
  • We do not collect identity numbers, payment details, location tracking or advertising data, and we use no advertising or tracking cookies.

2. Why we use it

  • To give you access to the platform and keep it secure (needed to provide the service you or your organisation signed up for).
  • To send you the alerts you asked for.
  • To keep records of who changed what, so mistakes and misuse can be traced (our legitimate interest and legal duties).
  • Market data on the platform (sales, prices, districts) comes from public sources and is not personal data.

3. Who processes it for us

  • Supabase: database, sign-in and file storage.
  • Vercel: runs the website.
  • Mapbox: map images (receives your internet address and the map area you view).
  • An AI model, only when an administrator turns on assisted report summaries: it receives district market figures, never your personal data.
  • These providers act on our instructions under data processing terms. We do not sell personal data.

4. Where it is stored

  • Our providers' servers may be outside the Kingdom. Where that is the case we transfer data only as the PDPL and its transfer regulation allow, and we plan to move the database to a region inside the Kingdom.

5. How long we keep it

  • Account details, watched districts, saved reports and alerts: while your account is active. When you delete your account it is locked at once and deleted permanently 30 days later (or at once, if you choose “Delete everything now”); backup copies expire within a further 30 days.
  • Access requests: until reviewed; rejected requests are deleted after 90 days; approved ones become the account details above.
  • Security records: 24 months. After your account is deleted they are kept without your email.
  • Your language cookie lasts one year; the sign-in session ends when you sign out.

6. Your rights

  • See your data: Settings → Your data and privacy → Download my data gives you a copy at any time.
  • Correct your data: ask your administrator or write to us.
  • Delete your data: Settings → Your data and privacy → Delete my account, or write to us. You choose between a 30-day safety period and deleting at once. With the safety period you can restore the account yourself for 14 days (sign in and press Restore) and through us until day 30, after we confirm it is you; after day 30 nobody can restore it.
  • Withdraw consent or object to a use of your data, and ask how your data is used.
  • We answer requests within 30 days. You may also complain to the Saudi Data and AI Authority (SDAIA).

7. Security and breaches

  • Access is protected by sign-in and roles; data is encrypted in transit; administrator actions are logged.
  • If a breach affects personal data, we will report it to SDAIA within 72 hours of becoming aware of it and tell the people affected without undue delay when it may harm them.

8. Changes and contact

  • We will post any change to this policy here with a new date.
  • Questions or requests: reports@whitemore.com.