Local legal-review draft. German/UAE legal review and qualified human approval of Arabic are required before publication.
Controller and contact
RAQM1 operator and data-controller identification is provided on the Legal page. Operator details
Use Support and complaints for access/export, correction, deletion, restriction, objection, consent withdrawal or another privacy request. Identity checks must be proportionate; do not submit identity documents in an ordinary support form. Direct contact: admin@raqm1.ae.
Applications and listing information
Application intake stores your name/brand, email, UAE relevance, category, destination, description, language, review status and screening evidence. This supports steps requested before a contract (Article 6(1)(b) GDPR) and fraud/content review under assessed legitimate interests (Article 6(1)(f)). Rejected applications are not publicly published.
Public listing information is limited to the approved identity, description and destination, together with ranking presentation when publication is active. Contact details, identity/control evidence and moderation reports are private. Administrator and participant access use Supabase authentication. Uploaded media remains unavailable unless the production storage and screening workflow is enabled.
Payments, support and evidence
Dodo Payments provides the secure checkout and acts as merchant of record. RAQM1 does not collect raw payment-card numbers. RAQM1 records the listing and destination, selected amount, payment intent, versioned policy acceptance and signed provider-event references. Financial ledger records support reconciliation and linked reversals.
Support requests store name, email, request type, content/contract/decision reference, statement, language, receipt time and case status. Evidence and notifications are private. Contract/support handling relies on Article 6(1)(b) where relevant, legal obligations on Article 6(1)(c), and abuse prevention and defence of claims on an assessed Article 6(1)(f) basis. Retained records must not be reused for unrelated marketing.
Screening, recipients and international processing
Deterministic screening checks submitted text and destinations. If OpenAI moderation is configured, submitted listing text and destination text are sent to that provider; account passwords, card details and identity documents are not part of that request. Disabled, failed or uncertain checks route to human review. A reachability check connects to the destination website from the server; it is not a malware or full-page content scan.
Vercel serves the application. PostgreSQL/Supabase stores configured intake records and provides authentication. Resend delivers configured notifications, OpenAI supports automated content screening, and Dodo Payments processes checkout and payment events. Actual entities, regions, subprocessors, retention and contractual roles depend on the configured accounts. Provider names alone are not evidence of EU-only processing or a valid transfer mechanism.
Before restricted transfers occur, the operator must establish the applicable GDPR Chapter V and UAE transfer grounds, assess safeguards and publish accurate recipient/transfer details. Article 28 processor agreements, processing records, security review and a DPIA assessment remain operational duties. No exclusively automated decision with significant effect is promised: a person can reconsider screening through the appeal route.
Device storage and analytics
Fonts and ordinary assets are served locally. The locale preference supports the language chosen by the visitor. The necessary raqm1-consent local-storage record keeps the choice, notice version, timestamp and expiry for 180 days. Storage failure defaults to no optional analytics.
Optional Vercel analytics loads only if enabled by the operator and accepted by the visitor. Reject all is offered alongside Accept all. Privacy settings allows later withdrawal, which removes analytics on reload. Query strings and fragments are excluded; private/application/support/payment paths are excluded from analytics events. Outbound-click requests require the same choice; eligible clicks on approved public listings are recorded with duplicate and crawler filtering. No advertising pixels, social embeds or browser push are introduced.
Retention
Operational baseline: raw clicks 90 days, routine application logs 30 days, security logs up to 12 months and unpaid drafts 30 days, subject to necessity, legal holds and the approved schedule. The local retention function deletes expired intake-limit records and raw clicks, and redacts resolved requests only after an explicitly assigned retention deadline and absent a legal hold.
Financial/tax records and necessary evidence may require longer statutory retention. Moderation evidence depends on dispute and limitation periods. Record-specific periods and backup expiry depend on applicable requirements and provider configuration; no promise of immediate deletion of all history is made. Scheduled retention and backup expiry are operationally monitored.
Rights and complaints
Where applicable you may request information/access, correction, erasure, restriction, portability, object to legitimate-interest processing, withdraw consent without affecting earlier lawful processing, and seek human review. GDPR requests are normally answered within one month; a permitted extension must be explained within that initial period. Necessary retained records and third-party rights may limit the data provided or erased.
You may complain to a competent data-protection authority, including in your habitual residence, workplace or place of alleged infringement. For a private-sector Bavarian establishment, BayLDA is the relevant authority to verify: https://www.lda.bayern.de/. UAE data-rights and complaint routes require confirmation for the final operating arrangement.