1. Data we collect
Account data (name, email, phone), identity verification data (national ID, business registry, KYC evidence), project and investor profile data, uploaded documents, messages, transaction data, and technical data (device, IP, cookies) required to operate the service.
2. How we use it
To operate the platform, verify identities, compute trust and matching scores, connect founders and investors, prevent fraud and abuse, process payments, comply with legal obligations, and improve the service.
3. Legal basis
We process personal data on the basis of contract performance, your consent, our legitimate interests in operating a safe platform, and compliance with applicable Saudi PDPL and other laws.
4. Sharing
We share data with verified counterparties you interact with (subject to access levels you approve), payment processors, cloud infrastructure providers, identity-verification vendors, and regulators when legally required. We do not sell personal data.
5. Access levels
Investors only see the details of your project that you have chosen to unlock at each stage. Sensitive files remain private until you explicitly grant access inside a deal room.
6. Retention
We retain account and transaction data for as long as your account is active and for a legally required period afterwards (typically 5–10 years for financial records). Verification evidence is retained for compliance with KYC/AML obligations.
7. Security
We apply encryption in transit and at rest, role-based access controls, audit logging, rate-limiting on sensitive endpoints, and regular reviews. No system is perfectly secure; report suspected incidents to security@thara.net.
8. Your rights
Subject to Saudi PDPL, you can access, correct, download, or delete your personal data, withdraw consent, and object to certain processing. Contact privacy@thara.net to exercise these rights.
9. Cookies
We use strictly necessary cookies to keep you signed in and optional analytics cookies to understand usage. You can control non-essential cookies from the banner and your browser settings.
10. International transfers
Data may be processed on cloud infrastructure outside Saudi Arabia under contractual safeguards that provide protection equivalent to PDPL requirements.
11. Children
Thara is not intended for anyone under 18 and we do not knowingly collect data from minors.
12. Changes
We will notify you of material changes at least 14 days before they take effect through in-app notification or email.