Legal

Privacy policy

Effective 5 November 2026

Who we are

This policy explains what data sanadak media collects, why, who it is shared with, how long it is kept and how to have it deleted. sanadak media is operated by sanadak LLC, a Wyoming limited liability company ("we", "us"), 30 N Gould St Ste R, Sheridan, WY 82801, United States. Contact: hello@sanadak.co.

sanadak media is software for media planning and buying agencies. Agency staff use it to receive briefs, build media plans, get them approved, issue buying documents and invoices, and compare planned with actual delivery. Our customers are agencies; the people who use it are agency staff and the client contacts they invite to approve a plan.

Our role and the agency's

For the data an agency puts into sanadak media or connects to it (its plans, clients, campaigns, ad account data and its users' mailboxes), the agency decides why and how the data is used, and we process it on the agency's behalf and on its instructions, as its processor or service provider. For our own website, demo requests and the administration of customer accounts, we decide how the data is used and are the controller.

Data we collect

Account data

Name, work email address, job title, role in the agency and approval limits, set by the agency.
Sign-in data: a one-way hash of the password, two-factor and passkey settings, and session records.

Activity data

The audit trail: who did what in the product and when, with the IP address and browser used.
Server logs kept for security and troubleshooting: IP address, browser, pages requested and time.

Client contacts

Name, email address and job title of the client contacts an agency invites to approve a plan, with their decision, any comment, and the time and IP address of the decision.

Agency business data

Briefs, plans, budgets, suppliers, orders, invoices and payments that the agency enters or generates in the product.
Ad creatives (images and videos) and campaign settings that users upload or enter to create or change campaigns on a connected ad platform.

Demo requests

When you use our contact form: your name, work email, agency, role and message.

Data from connected platforms

An agency user can connect accounts they already manage. Each connection is made through the platform's own sign-in and consent screen, and only the data listed here is read. On ad platforms, a signed-in user can also instruct sanadak media to pause or resume campaigns, change budgets and schedules, and create campaigns, ad sets and ads; for this we send the platform the settings the user chose and any creatives (images and videos) the user uploaded. Nothing is published, paused or changed without that user's action, after the agency's approval rules, and every action is recorded in the audit trail. Full details, platform by platform, are on our integrations page.

TikTok

TikTok ads. Reads your campaign results and, when you ask, pauses, resumes or adjusts campaigns and launches new ones.

Ad account names and IDs, currency and time zone.
Campaign, ad set and ad names and IDs, with objective, status, budget and schedule.
Daily results: spend, impressions, reach, frequency, clicks, video views and conversions as the platform reports them.

Actions a signed-in user can instruct:

Pause and resume campaigns, ad sets and ads.
Change budgets and schedules.
Create campaigns, ad sets and ads, with creatives (images and videos) a user uploads in the product.

Snapchat

Snapchat ads. Reads your campaign results and, when you ask, pauses, resumes or adjusts campaigns and launches new ones.

Ad account names and IDs, currency and time zone.
Campaign, ad set and ad names and IDs, with objective, status, budget and schedule.
Daily results: spend, impressions, reach, frequency, clicks, video views and conversions as the platform reports them.

Actions a signed-in user can instruct:

Pause and resume campaigns, ad sets and ads.
Change budgets and schedules.
Create campaigns, ad sets and ads, with creatives (images and videos) a user uploads in the product.

Google Ads

Search, YouTube and other Google Ads campaigns. Reads your campaign results and, when you ask, pauses, resumes or adjusts campaigns and launches new ones.

Ad account names and IDs, currency and time zone.
Campaign, ad set and ad names and IDs, with objective, status, budget and schedule.
Daily results: spend, impressions, reach, frequency, clicks, video views and conversions as the platform reports them.

Actions a signed-in user can instruct:

Pause and resume campaigns, ad sets and ads.
Change budgets and schedules.
Create campaigns, ad sets and ads, with creatives (images and videos) a user uploads in the product.

Email

Gmail (Google Workspace) or Outlook (Microsoft 365). Connect your own work mailbox, Gmail or Outlook. Reads and sends email from your mailbox only, never anyone else's; your company's admin approves the connection.

The user's name and email address from their Google or Microsoft profile.
Messages in the signed-in user's own mailbox: sender, recipients, subject, body, dates and attachments.
Replies the user writes in sanadak media are sent from their own mailbox, so Gmail or Outlook stays in step.

In short: from ad platforms we read ad account names and IDs, campaign settings and advertising metrics (spend, impressions, reach, frequency, clicks, video views and conversions). We do not read personal data about the people who see the ads, we do not read anything from accounts the user has not chosen to connect, and we take no action on an ad account unless a signed-in user instructs it. From email, whether Gmail (Google Workspace) or Outlook (Microsoft 365), we read only the signed-in user's own work mailbox, and a person only ever sees their own mailbox.

How we use data

To provide the product to the agency: briefs, plans and benchmarks, approvals, buying documents, plan against actual, reports, invoices and email inside the product.
To keep the audit trail the agency relies on.
To keep the service secure, prevent abuse and fix problems.
To reply to demo requests and support questions, and to run the customer relationship with the agency.
To meet legal obligations, such as keeping tax records.

We do not use data for advertising, we do not build profiles of people, and we do not use customer data or platform data to train AI models. Where the product suggests a change to a plan, the suggestion is calculated from the plan's own figures; if AI wording is switched on, only those plan figures (never mailbox content or personal data) are sent to our AI provider to phrase the suggestion, under terms that do not allow the provider to train on them. A person always decides whether to accept a suggestion.

Legal bases

Where laws such as the EU and UK GDPR or the Saudi Personal Data Protection Law (PDPL) ask for a legal basis, we rely on:

Purpose	Legal basis
Providing the product to the agency and its users	Performance of our contract with the agency; for the agency's own data, the agency's instructions
Reading data from a connected ad account or mailbox, and carrying out campaign actions a user instructs	The consent the user gives on the platform's consent screen, which they can withdraw at any time by disconnecting
Security, audit trail and abuse prevention	Our and the agency's legitimate interest in a secure, accountable service
Replying to demo requests and support questions	Our legitimate interest in answering you, or steps you ask for before a contract
Keeping invoices and tax records	Legal obligation

Platform commitments

sanadak media's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We use data received from Meta, TikTok, Snapchat, Google and Microsoft only to provide the features described here to the user and agency that connected it, in line with each platform's developer terms and policies. We do not sell it, use it for advertising or to build profiles, share it with data brokers, or combine it with data from other agencies.

Sharing and sub-processors

We do not sell personal data or any data read from advertising platforms or mailboxes, and we do not share it with third parties for their own purposes or for cross-context behavioural advertising. Inside an agency, data is visible to that agency's users according to their roles; mailbox content is visible only to the mailbox owner, and to colleagues only when the owner links a message to a shared record such as a plan or an invoice.

We use these service providers to run the product, under contracts that limit their use of data to providing their service to us:

Provider	What they do	Location
DigitalOcean, LLC	Hosting of servers and databases	London, United Kingdom
Laravel Forge (Laravel Holdings Inc.)	Server provisioning and deployment	United States
Anthropic, PBC	Optional wording of plan suggestions, from plan figures only	United States

Google (for Gmail and Google Workspace) and Microsoft (for Outlook and Microsoft 365), like Meta, TikTok, Snapchat and Google Ads, are not our sub-processors: they are the services a user chooses to connect, and they hold that user's mailbox or ad account under their own terms and privacy policies. We exchange data with them only on the user's behalf, as described above.

We may also disclose data where the law requires it, or to a buyer of our business under the same commitments. We will update this list before adding a new sub-processor.

International transfers

sanadak LLC is based in the United States, our servers are in the United Kingdom, and our customers are mainly in Saudi Arabia and the Gulf. Data may therefore be processed in countries other than your own. Where the law requires it, we protect transfers with appropriate safeguards, such as standard contractual clauses or the transfer conditions of the PDPL. An agency can ask for its install to be hosted in a Saudi Arabian cloud region.

How long we keep data

Data	Kept
Ad platform data	While the connection is active and the agency's account is open, so the agency keeps its campaign history and benchmarks. Deleted within 30 days of a deletion request or of the agency closing its account.
Access tokens for connected accounts	Deleted as soon as the connection is removed.
Mailbox messages	While the mailbox is connected. Deleted within 30 days of the user disconnecting it or asking us to delete it.
Uploaded creatives	While the agency's account is open, with the campaign they were used in; deleted within 30 days of a deletion request or of the account closing.
Account and agency business data	While the agency's account is open; deleted within 30 days after it closes.
Audit trail	As long as the record it describes, then deleted with it.
Server logs	Up to 30 days.
Demo requests	Up to 24 months after our last contact, unless you become a customer.
Invoices and tax records	For the period tax law requires (in Saudi Arabia, at least 6 years), and nothing else is kept with them.

Security

All traffic uses HTTPS. Access tokens for connected accounts are encrypted at rest. Staff access is limited by role, and every action is logged in an audit trail that cannot be edited. Each agency has its own install and database. Details are on our security page.

Your rights

Depending on where you live, including under the Saudi PDPL and the EU and UK GDPR, you have the right to:

be told how your data is used (this policy);
access your data and get a copy of it in a readable, commonly used format;
have inaccurate or incomplete data corrected;
have your data deleted;
restrict or object to some uses of it;
withdraw consent at any time, for example by disconnecting an account, without affecting what was done before;
complain to a data protection authority, such as the Saudi Data and AI Authority (SDAIA) or the authority where you live.

sanadak media does not make decisions about people that have legal or similarly significant effects by automated means alone. To use any of these rights, email hello@sanadak.co from the address you use with sanadak media. We reply within 30 days. Where the agency you work with is the controller of your data, we pass your request to the agency and help it answer.

Deleting your data

Email hello@sanadak.co from the address you use with sanadak media, with the subject "Data deletion request", and we will delete your data within 30 days and confirm by email. You can also remove sanadak media's access at any time in the settings of Meta, TikTok, Snapchat, Google or Microsoft. Full steps are on the data deletion page.

Cookies

We use only cookies that the product needs to work: a session cookie that keeps you signed in and a security cookie that protects forms against cross-site request forgery. We do not use analytics, advertising or tracking cookies, and we do not load third-party trackers.

Children

sanadak media is a business tool and is not meant for anyone under 18. We do not knowingly collect data from children.

Changes

If we change this policy we will update the effective date above, and tell agency administrators by email before any material change takes effect.

Contact

Questions or requests: hello@sanadak.co, or write to sanadak LLC, 30 N Gould St Ste R, Sheridan, WY 82801, United States.