Privacy Policy
Effective Date: 1 April 2026 · Last Updated: 18 October 2026
1. Introduction
GulfStockHub ("Platform", "we", "us", or "our") is a B2B industrial marketplace connecting buyers and sellers of industrial equipment across the Gulf Cooperation Council (GCC) region at gulfstockhub.com.
This Privacy Policy explains what personal data we collect and why; how we use and protect that data; who we share it with; how long we retain it; and what rights you have over your data.
By registering an account or using the Platform you acknowledge that you have read and understood this Privacy Policy.
2. Data Controller
The data controller responsible for your personal data is:
For all data protection enquiries, access requests, and deletion requests, contact us at the email above with the subject line "Privacy Request".
3. What Personal Data We Collect
3.1 Data You Provide Directly
Account registration
- Full name, email address, password (stored as a cryptographic hash — never in plain text)
- Country and city of operation
- Optional: company name, professional designation
Mobile verification (via WhatsApp)
- Mobile phone number (country code + local number)
- Verification status and date of verification
- To verify your number, we send a one-time code to your WhatsApp account
Listing creation
- Product details: title, description, category, condition, technical specifications
- Commercial terms: price, currency, payment terms, delivery terms, lead time, warranty
- Location: country and city of the item
- Uploaded files: product images and technical documents (PDF)
Seller contact number
- The WhatsApp number you verify to publish listings (stored encrypted)
- A record that a visitor requested it (listing, time, and a daily-rotating hash of their IP address — used for abuse limits and demand statistics)
Reports
- Content of reports you submit about listings (reason and details)
3.2 Data Generated Automatically
- Session data: authentication tokens (JWT) stored in browser cookies
- Usage data: listing view counts (aggregated), watchlist additions
- Site usage statistics (first-party): the pages you open, the buttons and links you click (their labels, never what you type), time on each page, how you arrived (referring site or campaign link), your approximate location (country and city, from the network), and your device type, browser and screen size. Collected by our own code, stored on our own servers, seen only by the GulfStockHub team, used to improve the Platform, and deleted after 12 months.
- Device and access data: IP address and browser type retained as part of normal server logs
4. How and Why We Use Your Data
| Purpose | Data Used | Legal Basis |
|---|---|---|
| Creating and managing your account | Name, email, password, country, city | Contract performance |
| Enabling mobile verification (via WhatsApp) | Mobile number | Contract performance; fraud prevention |
| Displaying your listings to other users | Listing content, images, documents, location | Contract performance |
| Sending transactional email notifications | Email address | Contract performance |
| Letting buyers contact you about your listings | Name or company name, verified WhatsApp number | Contract performance |
| Preventing bulk harvesting of contact details | Hashed IP address, contact-request counts | Legitimate interests (security) |
| Reviewing reports of fraudulent listings | Reporter ID, reported listing, reason | Legitimate interests (platform integrity) |
| Bot and fraud protection (Turnstile) | Browser fingerprint signals | Legitimate interests (security) |
| Responding to enquiries and support requests | Email, account details | Contract performance; legitimate interests |
| Complying with legal obligations | As required by law | Legal obligation |
We do not use your data for targeted advertising, selling or licensing to third parties, or automated decision-making that produces significant legal effects on you.
5. Data Sharing and Disclosure
5.1 With Other Users of the Platform
When you post a listing, its content (title, description, specifications, price, location, images, and documents) is publicly visible to all visitors, including non-registered users. Your name (or company name), city, and membership date are shown on your listings. Your verified WhatsApp number is shown to any visitor who clicks to contact you about a listing, whether or not they have an account. Your public email is shown the same way to visitors who click Email on your listings, seller page or RFQs. By default it is the email you signed up with; you can turn it off or choose another address under Dashboard → Settings. Conversations that follow happen on WhatsApp, by email or by phone, outside the Platform, and we do not see them.
5.2 With Our Technology Service Providers
We use trusted third-party service providers for hosting, security, email delivery, and phone verification. These providers only process the minimum data necessary to operate the platform, and each operates under their own published terms and privacy policies, which apply alongside this policy.
5.3 Legal Requirements
We may disclose your personal data if required by applicable law, court order, regulatory authority, or government request in any GCC jurisdiction or elsewhere. We will notify you where legally permitted to do so.
5.4 Business Transfer
If GulfStockHub is acquired, merged, or restructured, your data may be transferred to the successor entity. We will notify registered users by email before any such transfer and provide an opportunity to delete your account.
6. International Data Transfers
Your account and listing data, files, email delivery, and mobile verification message delivery are handled by trusted third-party service providers whose infrastructure may be located in the EU, the US, or elsewhere. We choose providers that publish their own privacy and security commitments. By using the Platform, you acknowledge that your data may be transferred internationally as described above.
7. Data Retention
| Data Type | Retention Period |
|---|---|
| Account data (name, email, profile) | Duration of account + 3 years after closure |
| Listing content | While listing is active; archived for 2 years after expiry or removal |
| Uploaded images and documents | While listing is active; deleted within 90 days of listing removal |
| Negotiation messages (feature retired September 2026; existing records only) | 3 years from the date of the last message |
| Contact-request records | 12 months |
| Reports submitted | 3 years from submission date |
| Authentication logs (session tokens) | 30 days (rolling JWT expiry) |
| Email delivery logs | As per our email provider's retention policy (typically 30–90 days) |
Deleting your account: You can delete it yourself at any time under Dashboard → Settings → Security → Delete account. Your listings, RFQs, seller page, alerts and uploaded files are removed at once. Or email [email protected] with the subject "Account Deletion Request". We will process your request as soon as reasonably possible, subject to any legal retention obligations.
8. Your Rights
| Right | What it means |
|---|---|
| Access | Request a copy of the personal data we hold about you |
| Correction | Request correction of inaccurate or incomplete data |
| Deletion | Request deletion of your data where it is no longer needed |
| Restriction | Request that we limit how we use your data in certain circumstances |
| Portability | Request your data in a structured, machine-readable format |
| Objection | Object to processing based on our legitimate interests |
| Withdraw consent | Where processing is based on consent, withdraw it at any time |
To exercise any of these rights, email us at [email protected] with the subject "Privacy Request", specifying which right you wish to exercise and your registered email address. We aim to respond as quickly as we reasonably can. We may need to verify your identity before processing your request.
9. Cookies and Session Tokens
| Cookie | Purpose | Type | Duration |
|---|---|---|---|
| sb-access-token | Authentication session (JWT) | Essential | Session / rolling 30-day refresh |
| sb-refresh-token | Refreshes your login session | Essential | 30 days |
We do not use advertising cookies, tracking pixels, or analytics cookies. You cannot opt out of the session cookies listed above without losing the ability to log in — they are strictly necessary for the Platform's core functionality. For our first-party usage statistics we keep a random identifier (gsh_vid) in local storage and a per-tab visit identifier (gsh_sid) in session storage; neither holds personal details, and clearing your browser's site data removes them.
10. Security
We take reasonable technical and organisational measures to protect your personal data, including:
- Row Level Security (RLS): enforced at the database level — each user can only access their own records unless explicitly shared.
- Encrypted authentication: passwords are stored as cryptographic hashes (never in plain text); session tokens are signed and time-limited.
- HTTPS everywhere: all data in transit is encrypted using TLS.
- Access controls: administrative database access is restricted to authorised personnel.
- Principle of least privilege: application components are granted only the minimum database permissions required.
Despite these measures, no internet transmission or storage system is completely secure. If you believe your account has been compromised, contact us immediately at [email protected].
11. Children's Privacy
The Platform is intended exclusively for users aged 18 and over who are acting in a business or professional capacity. We do not knowingly collect personal data from children under 18. If we become aware that a user is under 18, we will promptly close their account and delete their data.
12. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or applicable law. We will notify registered users by email before material changes take effect. The "Last Updated" date at the top of this page indicates when the policy was last revised. Continued use of the Platform after the effective date of changes constitutes acceptance of the updated policy.
13. Contact and Data Requests
GulfStockHub
Email: [email protected]
Use subject line "Privacy Request" — general data enquiries
Use subject line "Account Deletion Request" — to delete your account and data
Use subject line "Data Request" — to request a copy of your data
We aim to acknowledge your request and respond in full as quickly as we reasonably can.
Also see: Terms of Service · Contact Us