1. Who we are
Bardiah is operated by Sindibad Al Bokali ("we", "us"). We are the data controller for the personal data described in this notice, meaning we decide why and how it is processed. You can reach us at privacy@bardiah.com.
2. What we collect and why
- Account data: name, email address, password credentials. Used to create and secure your account. Legal basis: performance of our contract with you.
- Workspace and brand content: logos, brand books, colours, typography, reference images, email copy and designs you upload or create. Used to provide the design service. Legal basis: contract.
- Support messages: the content of emails and in-app messages you send us. Used to answer you. Legal basis: legitimate interests (supporting customers).
- Usage and telemetry: pages viewed, features used, error logs, device and browser type, IP address. Used for security, abuse prevention and product improvement. Legal basis: legitimate interests.
- Marketing preferences: if you opt in to product updates. Legal basis: consent, which you can withdraw at any time.
Payment card details are collected and processed by Paddle, not by us. We never see or store full card numbers.
3. AI processing
When you use AI-assisted design or writing features, the relevant content (for example brand assets and the copy in the email you're editing) is sent to our AI model providers solely to generate the requested output. It is not used by us to train public models.
4. Who we share data with
- Service providers / subprocessors: hosting, database, storage, email delivery, error monitoring and AI model providers, acting on our instructions.
- Merchant of Record: Paddle.com, which sells our subscriptions and handles payments, subscription management, invoicing, tax compliance and refunds.
- Professional advisers: legal and accounting advisers where necessary.
- Authorities: where we are required to disclose by law.
We do not sell your personal data.
5. International transfers
Our providers may process data outside your country, including in the EEA, the UK and the United States. Where data leaves the UK/EEA we rely on adequacy decisions or Standard Contractual Clauses with appropriate safeguards.
6. Retention
We keep account and content data for as long as your account is active. After you close your account we delete or anonymise your content within 30 days, except records we must keep for legal, tax or accounting purposes (typically up to 7 years for invoicing data held via Paddle). Logs are retained for up to 12 months.
7. Your rights
Depending on where you live, you may have the right to access your data, correct it, delete it, restrict or object to processing, receive it in a portable format, and withdraw consent at any time. Email privacy@bardiah.com and we will respond within one month. If you are in the UK or EEA, you also have the right to complain to your local data protection supervisory authority.
8. Security
We apply appropriate technical and organisational measures, including encryption in transit and at rest, row-level access controls in our database, scoped access tokens, and least privilege for staff access.
9. Cookies
We use essential cookies for sign-in sessions and security, and limited analytics cookies to understand product usage. We do not use advertising cookies. You can clear or block cookies in your browser settings; blocking essential cookies will prevent sign-in from working.
10. Changes
We may update this notice; material changes will be announced in-app or by email. See also our Terms of Service and Refund Policy.