Privacy Policy

Last updated: 4 October 2026

This policy explains what personal data Shatably collects, why we process it, who we share it with, and what rights you have under Egypt's Personal Data Protection Law No. 151 of 2020.

1. Who We Are and Who Controls Your Data

Shatably is operated by Sinai Tech Ventures LLC (شركة سيناء تك فنتشرز ذ.م.م), an Egyptian limited liability company with its registered address at 53 Capital Mall, Behind the Courthouse, 2nd Floor, Fifth Settlement (New Cairo), Egypt. It is the controller of the personal data processed through the platform. The full commercial register number, tax number and responsible representative are listed on the Imprint page, linked in the footer of every page. For data protection matters, contact legal@sinaitechventures.com.

2. Data We Collect

Account data: your name, email address, a hashed password and your account type. Project data: country, city and district, area and number of rooms, budget range, project description and property details, and the contact name and phone number you provide. Files you upload: project photos, drawings, inspiration images and voice recordings. Provider business data: company name and description, skills, logo, country and service areas, budget range, WhatsApp number, phone, business email and uploaded verification documents. Quotation content: proposed price, timeline, provider notes and decline reasons. We also collect support messages, abuse reports and basic technical logs needed to run and protect the service.

3. Why We Process It and On What Basis

We process your data to deliver the service you asked for: creating your account, matching your project with providers, passing quotations between you, communicating about your projects, protecting the platform from misuse and improving the service. This rests on the performance of our agreement with you, on the consent you give when you register or submit a quotation request, on our legal obligations and, for the usage analytics described in section 9, on our legitimate interest in measuring reach and improving the platform, all within the framework of Personal Data Protection Law No. 151 of 2020. You may withdraw your consent at any time, without affecting processing carried out before the withdrawal.

4. Who We Share It With

When you submit a quotation request, the platform discloses your project details, contact name and phone number to the providers matched to that request, so they can reach you and prepare their quote. Apart from that we do not sell or trade your personal data, and we make it available only to a limited set of categories of processors acting on our instructions: a specialist hosting provider, on whose servers the usage analytics we host ourselves also run. No third-party analytics provider receives your data. We disclose data to competent authorities only where the law requires it.

5. Transfers Outside the Arab Republic of Egypt

Platform data is stored on servers located outside the Arab Republic of Egypt, operated by a specialist hosting provider under a data-processing agreement that includes safeguards equivalent to those required by Personal Data Protection Law No. 151 of 2020 for cross-border transfers. The party responsible for that transfer is the platform operator named on the Imprint page.

6. How Long We Keep It

We keep your account data for as long as your account exists, and then for twelve months after it is closed so that any later question or dispute can be handled. Project records, quotation requests and submitted quotes are kept for five years for evidence, dispute resolution and record-keeping purposes. We act on deletion requests within those retention limits, and delete or anonymise anything held beyond them.

7. Security

Passwords are stored hashed with bcrypt and cannot be read back as text. All traffic to the platform runs over encrypted HTTPS. Access to data is restricted to authorised staff on a need-to-know basis, and administrative actions taken by staff are logged. When the platform hits an error, an error report is recorded on our own servers so we can fix it: the error message and technical stack trace, the page path without query parameters, the app version, your browser family and a short pseudonymous code derived from a one-way hash of your IP address and the date. Reports do not deliberately include your IP address itself, your account details or the contents of forms. Error reports are not shared with any third party.

8. Your Rights Under the PDPL

You have the right to know what data we process about you and to access it, to have it corrected or updated, to have it erased, to withdraw your consent, and to object to or restrict processing. To exercise any of these rights, write to support@shatably.com or legal@sinaitechventures.com and we will respond within thirty days of your request. You also have the right to complain to the Personal Data Protection Center in the Arab Republic of Egypt, or to the competent national authority in your country of residence if you are in the GCC.

9. Cookies, Analytics (Umami) and Local Storage

Cookies: the platform sets strictly necessary cookies only: shatably-country to remember the country or market you selected, NEXT_LOCALE to remember your display language, and the Auth.js sign-in cookies, namely the session cookie, the CSRF protection cookie and the post-login callback URL cookie. We use no advertising or cross-site tracking cookies. Browser storage: your browser also uses local storage to remember that you dismissed the app install prompt, an admin sign-out marker, a random per-tab identifier that groups the error reports of one visit (session storage, deleted when the tab closes), a draft of a new project and the offline cache. Analytics (Umami): we use Umami, an open-source web analytics tool that we host ourselves at analytics.selimsalman.de on a server in Germany. No third-party analytics provider receives the data, and it is not sold or used for advertising. Umami sets no cookies and stores nothing on your device for analytics, does no cross-site or cross-device tracking and builds no persistent visitor profile: visits are distinguished by an anonymised identifier derived from a hash that includes a rotating salt, and your IP address is used only transiently for that and for a coarse country lookup and is not stored. It records the page URL and title, the referrer, your browser, operating system, device type, screen size, language and country, the time of the visit, and named interaction events such as clicks on a contact button. A Do Not Track setting in your browser is honoured. Because nothing is stored on or read from your device beyond what your browser transmits anyway, and the data is not tied to an identifiable person, we show no consent banner. We carry out this processing on the basis of our legitimate interest in measuring reach and improving the platform, within the framework of Personal Data Protection Law No. 151 of 2020. You can object at any time with the switch below; your opt-out is stored in your browser local storage under the key umami.disabled and applies to that browser only.

10. Children and Changes to This Policy

The service is not directed at people under eighteen and we do not knowingly collect their data; if we learn otherwise, we delete it. We may update this policy when the service or legal requirements change, publishing the updated version on this page and revising the last updated date above it, and we notify users of material changes by email or inside the platform.