Privacy Policy

Release / Last Updated Date: July 11, 2026

1. Introduction to Our Commitment to Privacy

We at Cookster Advertising Agency (the legal owner and operator of the Cookster app), a registered company in the Kingdom of Saudi Arabia under Commercial Registration.

place the protection of your personal data and privacy at the top of our priorities. As a "Data Controller" under the Saudi Personal Data Protection Law and its executive regulations, we are committed to the highest standards of transparency, integrity, and security when handling any personal data you provide us or that we collect to enable you to enjoy a unique experience in discovering and sharing restaurants and food.

This comprehensive privacy policy explains how we collect, store, use, and share your data with third parties, and details your statutory rights and how to exercise them effectively.

This policy applies to all visitors, registered users (individuals and institutions), and advertisers within the Kingdom of Saudi Arabia, as well as to any data processed through the smartphone application.

We note that our website is intended for informational and blog purposes only, and does not include account creation mechanisms.

2. Exact Categories of Personal Data Collected

In adherence to the data minimization principle, the Cookster app collects only the data strictly necessary to operate the service, and under no circumstances do we collect any category of "sensitive data," such as health, criminal, or data related to ethnic and religious origin.

The sources and nature of the data vary according to the table outlined below:

Important Note on the Nature of Content: The Cookster app's design relies on community participation; therefore, all content you upload (videos, photos, reviews, recipes) is "public" and visible to everyone by default.

You can control the privacy of posts by choosing to make them "Private/Hidden" or "Followers Only" in the privacy settings for each post.

3. Legal Purposes for Data Processing and Regulatory Justifications

We do not process your personal data without relying on a sound regulatory justification that complies with the Personal Data Protection Law.

The following table summarizes the association of data with the purpose and legal justification:

We affirm our full commitment not to send any direct marketing messages or notifications (such as restaurant campaigns or sponsored content) to your email or as repetitive push notifications outside the application's normal browsing context.

4. Protection of Children's Privacy (Under 18 Years Old)

Cookster takes pride in providing a suitable environment for younger demographics, including allowing those under 18 years old to use the platform. If you are under 18 years of age, by proceeding with the registration process or continuing to use the application, you explicitly acknowledge and confirm that you have obtained the prior consent of your legal guardian to create an account and share your personal data in accordance with this privacy policy. Accordingly, the legal guardian bears full legal responsibility for the minor's use of the application and for any data shared or content interacted with on the platform

5. Frameworks for Data Sharing with Third Parties (Processors)

Technical sustainability and the delivery of a high-quality user experience require collaboration with reliable third-party service providers to operate the application.

We assure you that we do not sell your personal data to third parties.

Data sharing is restricted to the specific categories below and under the umbrella of binding legal contracts, ensuring full compliance with the law:

• Hosting and Server Services: Storing and retrieving data and securing the cloud infrastructure.
• Analytics Tool Providers: To understand usage dynamics and evaluate successful features and what needs improvement.
• Map and Location Service Providers: To translate coordinates into visual locations and calculate actual distances.
• Advertising Companies and Marketing Networks: To provide the infrastructure for displaying randomized ads and sponsored content within the app interface.
• Technical and Support Teams: Technical support entities responsible for fixing software bugs, modifications, and monitoring performance.

6. Cross-Border Data Transfer and Storage, and Risk Assessment

Please note that the Cookster app's cloud infrastructure stores user data on servers located outside the Kingdom of Saudi Arabia.

Due to the sensitivity of cross-border data transfer, we subject transfer operations to the highest degrees of legal compliance in accordance with Article 29 of the Law and the Data Transfer Regulations.

To ensure the transfer does not compromise your privacy or the level of protection guaranteed to you locally:

• We continuously conduct Transfer Risk Assessments (TRAs) to identify and mitigate any potential negative impacts and ensure that data transfer is limited to the minimum necessary.
• We apply the maximum appropriate regulatory approved safeguards by signing the Standard Contractual Clauses (SCCs) issued by SDAIA with all hosting and processing entities outside the Kingdom, to impose a contractual obligation governing the sovereignty of Saudi protection laws over your data and your right to remedy.

7. Data Retention Policies and Destruction Mechanisms

Based on the principle of relevance to the purpose, we retain your personal data for as long as your account is active to ensure the continuity of your ability to benefit from Cookster's features.

The data lifecycle ends and destruction procedures are activated in the following cases:

• Account Deletion Upon User Request: If you permanently delete your account from the application, we immediately remove and destroy all your personal data, records, and associations permanently, making it impossible to identify you or recover the data.
• Legislative Exceptions: Exempted from immediate destruction are narrow cases that require limited retention to meet valid judicial requirements, for security purposes, or in compliance with other applicable laws in the Kingdom of Saudi Arabia.

8. Your Statutory Rights and Effective Ways to Exercise Them

The Personal Data Protection Law grants you full control over your information through a set of acquired rights.

At Cookster, we are committed to empowering you to exercise the following rights as a data subject:

• The Right to Know and Access (Copy of your data): Requesting details of the data we have collected and a clear electronic copy of it.
• The Right to Rectification and Updating: Requesting the modification of any inaccurate data, completing missing data, or updating it with ease.
• The Right to Destruction (Account Deletion): Demanding the erasure of your data and the cancellation of your digital presence on the platform whenever you wish.
• The Right to Withdraw Consent: Stopping the collection of precise data such as geographical location through your phone's system settings, which will disable nearby offer features but will not affect the core functions of the application.
• The Right to Object and Restrict Processing: Objecting to ban decisions, demanding not to be subjected to marketing processing, and objecting to content removal.

Mechanisms for Exercising Rights and Responding: You can submit any of these requests, as well as complaints and objections, directly and easily either through the "designated field within the application" or by sending an "email" to our privacy team.

We pride ourselves on our high operational commitment represented in processing, responding to, and fulfilling your requests within a record timeframe of a maximum of (one week) from the date of receiving the request.

9. Prohibited Content Policy and Violation Management

Cookster is a digital community built on respect and the exchange of experiences transparently and safely.

Accordingly, all users are strictly prohibited from uploading or circulating any content that falls under the following categories:

• Content of insults, hatred, and racial discrimination.
• Nudity and sexually explicit content.
• Violence, threats, and intimidating others.
• Violation of intellectual property rights and privacy (including filming restaurants and people or uploading videos of them without their prior permission).
• Fraud messages, suspicious links, and malicious software.
• Promoting any legally and statutorily prohibited materials or practices.

We have provided a "Submit a Report" feature within the application for immediate reporting of any violations.

Violators are subject to a strict escalation of penalties including: issuing a formal warning, direct removal of content, temporary suspension of the account, up to permanent banning for the user who repeatedly or grossly violates.

As indicated earlier, we guarantee you the right to "object to the ban decision or content removal" to ensure fair review.

10. Data Security and Protection Obligations

It is our responsibility to protect the technical infrastructure of the application. We apply advanced administrative and technical controls, including encryption (HTTPS), restricting access permissions for employees, and securing data exchange channels to ward off leakage risks.

In the event of any security breach affecting your personal data in a way that poses a potential risk to your rights and freedoms, we are legally committed to notifying the Saudi Data and Artificial Intelligence Authority (SDAIA) within the statutory period (72 hours), and notifying you immediately without unjustified delay with guidance on risk mitigation mechanisms.

11. Privacy Policy Updates

We reserve the right to periodically review and amend the privacy policy to reflect emerging developments in the technical functionalities of the Cookster app or for continuous alignment with legislative amendments issued by SDAIA.

You will be notified of any material updates directly affecting your rights through application notifications, with a clear log of update dates available for reference.

12. Contact Details and Data Protection Officer

We have provided multiple channels to serve you and answer your inquiries related to privacy and personal data protection:

• Legal Entity: Cookster Advertising Agency .
• Country / City of Physical Headquarters: Kingdom of Saudi Arabia / Dhahran.
• Communication via Application: Please head to the "Profile" section within the application to choose the chat support option.
• Communication via Email: You can correspond with our appointed Personal Data Protection Officer to ensure our compliance with the law via email: info@cookster.org

In the event you are dissatisfied with our response or our handling of your requests related to your personal data, you have the right to file an official complaint directly to the Saudi Data and Artificial Intelligence Authority (SDAIA) in its capacity as the competent regulatory body.