Privacy Policy

Data controller: Fipera Trading - F.Z.E (Fipera) · United Arab Emirates · Contact: hello@fipera.com

1. Who we are

Fipera Trading - F.Z.E, a Free Zone Establishment (F.Z.E) established in the Ajman Free Zone, United Arab Emirates, is the data controller for personal data processed in connection with Gulf Sticker Swap.

Legal name: Fipera Trading - F.Z.E
Trade / brand name: Fipera
Legal form: Free Zone Establishment (F.Z.E)
License no.: 40169
Registration no.: 40169
Free zone: Ajman Free Zone
Licensing authority: Free Zones Authority of Ajman (FZA)
Registered address: Office - C1 - 1F - SF5937, Ajman Free Zone C1 Building, Ajman Free Zone, Emirate of Ajman, United Arab Emirates
Makani no.: 4442612247

Fipera (“we”, “us”) operates Gulf Sticker Swap(the “Service”). We determine why and how your personal data is processed and are responsible for it under applicable data protection law, including the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021, “PDPL”) where it applies to you.

For privacy requests, email hello@fipera.com with “Privacy” in the subject line.

2. What data we collect

Account data: email address, nickname, country and city of residence, account role, account status, age confirmation timestamp.
Listings: the stickers you mark as Available or Wanted, your duplicate counts, and the timestamps of those changes.
Swap data:swap requests you send or receive, their status, your acknowledgements (including the “Mark as completed” confirmation), and trust score updates.
Messages: the text content of messages you exchange inside a swap, the sender, the swap they belong to, and timestamps; an automated flag if our content filter detects a payment pattern.
Reports and moderation actions: reports you file or receive, moderator notes, warnings, suspensions and bans.
Technical and security data: authentication session, browser/device user-agent, IP address and request metadata in limited security, rate-limit, hosting and abuse-prevention logs.
Notification preferences: whether you opted in to email alerts, the address used for notifications (which may differ from your sign-in email), and timestamps of preference changes.
Contact form data: if you contact us through the public help page, we collect the email address, message content, submission timestamp, Turnstile verification result and moderation/admin review status needed to handle the request.
Analytics usage data (only if you consent): pages visited, referring URL, device and browser type, and approximate geography derived from your IP address. We do not use this data to identify you by name or to build advertising profiles.

We do not collect images, audio, video, payment information, biometric data, or precise geolocation. We do not use advertising trackers or sell your data. Optional analytics run only after you choose Accept all in our cookie banner (or re-enable them via cookie preferences).

3. Legal bases (PDPL / GDPR principles)

Contract necessity for delivering the Service you request, including account access, listings, matches, swaps and in-app messages.
Consent for optional notification emails (swap alerts, match digests, listing reminders, and completion reminders). You may withdraw consent anytime via Profile settings or the unsubscribe link in each email.
Service safety, security and legal claims for moderation, retention, automated filtering, suspension, abuse prevention and dispute handling; where GDPR or similar law applies, this may be treated as our legitimate interest.
Eligibility and compliance acknowledgements for the age gate and chat terms acknowledgement, so we can enforce adult-only access and safe messaging rules.
Legal obligation for responding to lawful requests by competent authorities.
Consent for optional analytics (Vercel Web Analytics and Google Analytics 4). You may withdraw consent anytime via Profile → Cookie preferences or by choosing Essential only when the cookie banner is shown.

4. How we use your data

To operate the Service: authenticate you, show your listings, match you with collectors, deliver and store your messages, update trust scores.
To keep the Service safe: review reported or auto-flagged content, suspend abusive accounts, comply with our Terms.
To respond to your requests: support, privacy rights requests, dispute review.
To send service-related emails you opted into: swap request and acceptance notices, match digests, listing alerts, and swap completion reminders. We do not send marketing or promotional email.
To comply with the law.
To understand how the Service is used (only with your analytics consent): aggregate page views and performance metrics to improve reliability and product decisions.

We do not use your data for behavioural advertising or sell it to anyone.

Automated processing

We use limited automated tools to keep the community safe. An automated content filter flags messages that match payment-solicitation patterns, and an account may be automatically suspended when it accumulates a defined number of validated reports within a set period. These tools support — but do not replace — human moderation: warnings, suspensions, bans, and report outcomes are reviewable by a person. We do not use your data for automated decisions that produce legal effects on you without the ability to request human review. To contest an automated flag or suspension, or to ask for human review, email hello@fipera.com.

5. Visibility to collectors and search engines

Sticker Swap is a members-only community tool. There are no public profile pages (for example, no URL where anyone on the open web can view your profile without signing in). Marketing and legal pages may be indexed by search engines; member areas are blocked in robots.txt and require authentication.

What other signed-in collectors can see

To help you find swap partners, we show the following to other users who have completed onboarding and are signed in (for example on Matches, Market, and Swaps):

nickname, country, city, avatar, trust score, and completed swap count;
which stickers you have listed as Available or Wanted (listings you add for matching — not a hidden inventory of stickers you have not listed).

This visibility is intentional so collectors can discover each other inside the community. It is not the same as publishing your data on the open web.

What we do not show to other collectors

your sign-in email address or notification email address (other members cannot look these up in the app);
private swap chat messages (you, the other party to that swap, and authorised moderators/service operators only where needed for reports, safety, abuse prevention or legal compliance);
your email notification preferences.

Notification emails we send you include only your own address as the recipient; we do not include another member's email in messages to you.

Search engines and scraping

We design the Service so that member nicknames and listings are loaded after sign-in and are not intended for public search indexing. A person who creates a free account could still view and manually collect community listing data through normal use of the app; we apply rate limits and abuse controls for that reason. This is separate from your email appearing on Google or other search results — which we do not expose.

7. International transfers

Where data is transferred outside the country of your residence (for example, to Supabase, Vercel, Google, Resend, Cloudflare or Upstash infrastructure in the EU, US or other service regions), we take steps required by applicable law for lawful transfers. Depending on the context, these may include your consent, service necessity, contractual safeguards, processor data-processing terms, standard contractual clauses or equivalent measures, and legal-claim or compliance grounds. Analytics data shared with Google or Vercel is transferred only when you have given consent.

8. Retention

Messages: ninety (90) days from creation; one hundred eighty (180) days when associated with a report or automated safety flag; longer when under explicit legal hold. Deletion means removal from active systems; backups and provider logs expire on their normal deletion cycles unless a legal or security obligation requires longer retention.
Account, listings, swaps, reports:for as long as your account is active. When you delete your account from Profile → Delete account, we remove your auth credentials and profile immediately; listings, messages, and non-completed swaps are deleted; completed swap records may remain for your former partners with your identity removed (shown as “Former collector”). Residual logs and backups are purged within thirty (30) days, except where we must retain data for a legal obligation or to defend a legal claim.
Invite attribution:if you joined via a friend's link, we store which collector referred you on your profile for as long as your account is active (used for community growth metrics only, not advertising).
Email send logs: recipient user id, template type, and sent-at timestamp retained for ninety (90) days for abuse prevention and deliverability debugging.
Contact messages: retained while needed to respond, investigate, keep an admin audit trail, comply with legal obligations, or defend legal claims. We periodically archive or delete closed contact messages that are no longer needed.
Analytics: Google Analytics 4 retains event data for up to fourteen (14) monthsby default (configurable in our GA4 property). Vercel Web Analytics retention follows Vercel's current analytics policy. Analytics data is not linked to your account profile.

9. Your rights

Subject to applicable law (UAE PDPL, KSA PDPL, GDPR where relevant), you have the right to:

(a) access the personal data we hold about you;
(b) request correction of inaccurate data;
(c) request deletion of your data;
(d) request a portable copy of your data;
(e) object to or restrict certain processing;
(f) withdraw consent (where processing is based on consent);
(g) not be subject to a decision based solely on automated processing that produces legal or similarly significant effects on you, and to request human review of such a decision;
(h) lodge a complaint with the supervisory authority in your country — for the UAE, the UAE Data Office.

To exercise these rights, email hello@fipera.com. You may delete your account at any time from Profile → Delete account (nickname confirmation required). You may also turn off notification emails from Profile settings or use the unsubscribe link in any notification email. To withdraw analytics consent, use Profile → Cookie preferences → Turn off analytics or choose Essential only when the cookie banner is shown. We will respond within thirty (30) days. Identity verification may be required.

10. Security

We use reasonable technical and organisational measures designed to protect your data, including TLS encryption in transit, hosted database encryption at rest, row-level access policies, least-privilege access to administrative tools, and audit logging of administrative actions where available. Email addresses are not readable by other members through the app API. We do not provide end-to-end encryption for messages — this is intentional, so that we can moderate and respond to legitimate safety and legal requests. You should not transmit information you wish to keep private from the Service operator.

11. Children

The Service is for users aged eighteen (18) and over. We do not knowingly collect personal data from children. If you believe a child has provided data, please contact us and we will delete it promptly.

12. Cookies

We use essential cookies to keep you signed in. Optional analytics cookies and similar technologies load only if you choose Accept all in our cookie banner.

Name / storage	Type	Purpose	Duration
Supabase auth cookies	Essential	Keep you signed in	Session / refresh period
`_ga`, `_ga_*`	Analytics (consent)	Google Analytics 4 usage statistics	Up to 2 years
`gss_referrer_id` (HttpOnly)	Essential	Remember who invited you when you complete signup via an invite link	30 days
`localStorage`: cookie_consent, analytics_consent	Preference	Remember your cookie choices	Until you clear site data

Vercel Web Analytics does not use cookies when enabled; it collects anonymous page-view metrics only after consent. We do not use advertising or cross-site tracking cookies.

13. Changes

We may update this Privacy Policy. Material changes will be notified in-app at least seven (7) days before they take effect.

14. Data protection contact and breach notification

Designated contact. Fipera Trading - F.Z.E has designated hello@fipera.com as the point of contact for data protection enquiries under applicable law, including the UAE PDPL. Postal address: Office - C1 - 1F - SF5937, Ajman Free Zone C1 Building, Ajman Free Zone, Emirate of Ajman, United Arab Emirates. Use subject line “Privacy” or “Data breach” to help us route your message.

Reporting a concern. If you believe your personal data has been misused, disclosed without authority, or affected by a security incident, email us promptly with a description of what happened and any relevant dates or swap/message references. We will acknowledge receipt where practicable.

Our breach response. If we become aware of a personal data breach, we will investigate, take steps to contain and remediate it, document the incident, and — where required by applicable law — notify the UAE Data Office and/or affected individuals without undue delay, including when the breach is likely to result in a risk to your rights.

Timelines and content of regulatory or individual notifications follow applicable law (including UAE PDPL Executive Regulations where they apply). We cannot guarantee a fixed response time for every report, but we treat credible security and privacy reports seriously. See also section 9 (Your rights) and section 16 (Contact).

15. Account deletion

You may permanently delete your account from Profile → Delete account. You must type your nickname to confirm. Deletion is immediate and cannot be undone.

Removed: your sign-in access, profile, listings, in-app messages, pending swap requests, and email notification preferences.
Blocked: deletion while you have an active swap with chat open (status accepted). Complete or cancel that swap first.
Retained without identity:completed swap records may remain so your former swap partner can keep their history; your side appears as “Former collector” with no nickname, email, or location.
Admin accounts cannot self-delete through the app — contact hello@fipera.com.

16. Contact

hello@fipera.com. Please put “Privacy” in the subject line for faster routing.