Privacy Policy

1 Who We Are

Stagd FZ-LLC ("Stagd", "we", "our", "us") is a company registered in the Dubai Multi Commodities Centre (DMCC) Free Zone, Dubai, United Arab Emirates. We operate the Stagd platform — a marketplace connecting creators, brands, and agencies with photography and video studios across the UAE.

This Privacy Policy applies to all users of the Stagd platform, including Bookers (creators, brands, agencies), Studio Partners (studio owners and operators), Production Talent, and visitors to stagd.co.

This policy is governed by UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL) and applicable DIFC Data Protection Law No. 5 of 2020 where relevant.

2 Data We Collect

2.1 Account & Identity Data

When you create a Stagd account, we collect: full name, email address, mobile number, optional profile photo, password (stored as a salted bcrypt hash — never plain-text), account type, and for Studio Partners, Emirates ID or trade licence for verification.

2.2 Studio & Listing Data

For Studio Partners: address, photographs, pricing, capacity, equipment, and availability. The exact address is only disclosed to confirmed and paid Bookers.

2.3 Booking & Transaction Data

• Booking details: date, time, duration, studio, add-ons
• Payment information: processed by Stripe or PayTabs — we receive a transaction token, not full card details
• IBAN / bank account details (for Studio Partners receiving payouts)
• Booking history, cancellation records, and dispute information

2.4 Communications Data

• In-platform messages (masked until booking confirmation)
• Support tickets and help centre conversations
• Reviews and ratings submitted after bookings

2.5 Usage & Device Data

• IP address, browser type, operating system, device identifiers
• Pages visited, search queries, time on platform
• App version, crash reports, and performance diagnostics
• Approximate location (city-level) for search relevance

3 How We Use Your Data

4 Legal Basis for Processing

Under UAE PDPL and applicable data protection law, we process your personal data on the following legal bases:

• Contract performance — processing necessary to deliver the booking service you've requested
• Legitimate interests — fraud prevention, security, platform improvement, and AI feature delivery, balanced against your rights
• Legal obligation — compliance with UAE financial regulations, anti-money laundering requirements, and court orders
• Consent — marketing communications and optional AI features (you may withdraw consent at any time)

5 Data Sharing & Third Parties

We do not sell, rent, or trade your personal data. We share data only in the circumstances below.

5.1 Between Platform Users

When a booking is confirmed, contact details and the full studio address are shared between Booker and Studio Partner. Before confirmation, contact information is masked.

5.2 Service Providers

5.3 Legal & Regulatory Disclosure

We may disclose personal data to UAE government authorities, courts, or law enforcement when required by law or valid legal process.

6 Cookies & Tracking

• Essential cookies — required for authentication, session management, and security. Cannot be disabled.
• Performance cookies — anonymised analytics to understand how the platform is used (opt-out available).
• Preference cookies — remember your settings, location, and search filters.
• Marketing cookies — used only with your explicit consent to personalise advertising.

Manage cookie preferences via our Cookie Settings panel or your browser. Disabling non-essential cookies will not affect your ability to book studios.

7 Data Retention

• Active accounts — retained for the lifetime of your account plus 2 years after closure
• Booking records — 7 years (UAE commercial and tax law requirements)
• Payment records — 7 years (UAE Federal Law No. 2 of 2015)
• Marketing data — until you withdraw consent or 2 years of inactivity, whichever comes first
• Support tickets — 3 years from closure
• Usage/analytics data — 13 months in identifiable form, then anonymised indefinitely

8 Your Rights

Under UAE PDPL and applicable law, you have the right to: access a copy of your data, rectify inaccuracies, erase your data (subject to retention obligations), restrict processing, request portability, object to processing, and withdraw consent at any time.

Email privacy@stagd.co or use the Privacy Centre in your account settings. We respond within 30 calendar days.

9 International Transfers

Your data is primarily stored and processed in the UAE. Where data is transferred to third-party service providers outside the UAE, we ensure appropriate safeguards are in place including standard contractual clauses and transfers only to jurisdictions with adequate data protection standards.

AI feature inputs sent to OpenRouter are processed on a pseudonymised basis — personally identifiable information is stripped before any data leaves UAE infrastructure.

10 Children's Privacy

Stagd is not directed at individuals under 18. We do not knowingly collect data from minors. If you believe we have inadvertently collected data from a minor, contact privacy@stagd.co immediately and we will delete it without delay.

11 Security

• Encryption in transit — all data transmitted over TLS 1.3
• Encryption at rest — sensitive fields encrypted using AES-256
• Password hashing — bcrypt with minimum 12 rounds; never plain-text
• Access controls — role-based access; staff access to user data is logged and audited
• Infrastructure security — Cloudflare DDoS protection, regular penetration testing

In the event of a data breach likely to risk your rights, we will notify you and the relevant UAE authority within 72 hours as required by law.

12 Changes to This Policy

When we make material changes, we will post the updated policy with a new "Last Updated" date, send in-app and email notifications to all registered users, and where required by law, request fresh consent. Continued use after the effective date constitutes acceptance.

13 Contact & Data Protection Officer

If unsatisfied with our response, you may lodge a complaint with the UAE Data Office (established under Federal Decree-Law No. 45 of 2021).