Privacy policy

This policy explains what Safi collects, why, what is public, and how to delete your data. This is the launch version, and we will update it whenever something changes.

Last updated: November 13, 2026

What we collect

Account data: your email, name, picture, and what you add to your profile (such as social links). If you sign in with Google or GitHub we receive your name, email and picture only.
Startup data: name, description, logo, website, category, country, founding date, and any sale details you add (asking price, profit margin, your message to buyers).
Revenue data: we read successful payments from your payment gateway and store daily summaries (revenue, MRR, customer counts). We do not store card data or your customers’ personal data.
Messages: conversations between sellers and buyers inside Safi.
Technical data: server logs, your sign-in session, and aggregated visit analytics to improve the site.

Payment gateway keys

We ask for read-only keys, store them encrypted (AES-256-GCM), and never show them again after you save them, to anyone, including you. We only use them to read and verify your revenue. When you disconnect a gateway we delete the key, and we recommend revoking it in the gateway too.

What is public

Your startup page and its numbers are public, following the privacy settings you choose: exact, an approximate range, or hidden. If you list your startup for sale anonymously, we do not show its name, logo, website or your name.

Your email address is never public. A buyer who messages you sees your name as it appears on your profile.

How we use your data

We do not sell your data or share it with advertisers.

To run your account, verify revenue, and show the leaderboard and the marketplace.
To send sign-in codes, message alerts and notices about your account.
To protect the site from abuse.

Service providers

We rely on providers to run Safi: hosting (Vercel), database and realtime messaging (Supabase), email (Resend), and visit analytics (OpenPanel). They process data on our behalf and only to run the service, and their servers may be outside Saudi Arabia.

Retention and deletion

We keep your data while your account exists. You can delete your account at any time from your dashboard settings, which deletes your account, your startups and their numbers, and your gateway connections and keys. Backups may persist briefly before they are erased automatically.

To request a copy of your data, a correction or a deletion, email hello@trysafi.bid.

Cookies

We only use essential cookies: your sign-in session, language and theme (light or dark). We do not use advertising cookies.

Contact

For any privacy question: hello@trysafi.bid