Your photos belong to your order.
A clear summary of how Souven handles account information, photos, designs, payment, delivery, and support data.
Data controller
Watd Technologies, Commercial Registration 1010829423, based in Riyadh, operates under the Souven trading brand and is the data controller described in this policy. Watd is registered with the National Personal Data Protection Register under number 3260005439.
What we collect
We collect account and verification information, contact details, the single image and instructions submitted for a commission, the selected design style, design versions, approvals, delivery address, and order history. From the payment provider we receive transaction identifiers and masked card details only; we do not store full card numbers.
Purposes and legal basis
We process data to perform your commission and sale contract, create previews and files, check printability, manufacture and deliver, process payment, and provide support. Some records are processed to meet legal obligations, prevent fraud, and protect the service. Optional uses such as marketing or stored payment methods require separate consent.
Service providers
Data may be processed through Supabase for authentication and database services, Cloudflare for storage, application delivery, and aggregated cookie-free site analytics, Google Firebase Analytics for website and order-funnel measurement, Meshy for model generation, Moyasar or Whop for payments, a manufacturer such as JLC3DP, and the selected email and shipping providers. Each receives only what is needed for its role.
Site and product analytics
We measure visited pages and broad steps such as account creation, source upload, preview generation, and confirmed payment to understand and improve the service. We do not send photos, design instructions, email addresses, phone numbers, delivery addresses, or payment details to analytics providers. Analytics uses a browser installation identifier instead of direct account details, and sensitive URL values are removed before page views are recorded.
Optional location sharing
We request your location only after you choose to use it and approve the browser prompt. Your coordinates and IP address are then sent to BigDataCloud to identify the city or area and to OpenStreetMap to display a map preview. We do not save precise coordinates with your order, and you can always enter the address manually.
Photo privacy
Photos and files stay in private storage and are accessed through short-lived links. We do not use your photos or collectible in marketing or a portfolio without separate, explicit marketing consent.
Creator collectibles and guest orders
Only the creator name and physical sample photos the creator agreed to publish appear on a listing. We use a fan buyer's contact details, address, and order record to fulfill and support the sale, and email a limited-life order access link. The creator sees sales and earnings without the buyer's name, email, or address.
Support cases and evidence
We use your name, email, order number, description, and submitted evidence only to handle the case. Attachments remain private and are deleted by default 90 days after case closure unless needed for an active remedy or legal obligation.
International processing
Some technology providers may process data on infrastructure outside Saudi Arabia. We assess the need and safeguards, send only the minimum required, and apply the relevant data-transfer requirements.
Retention and deletion
Source photos are deleted by default 30 days after delivery and manufacturing assets are retained for 90 days to support defects or remakes, unless support, legal hold, or separate consent applies. Financial, order, and audit records are retained for the applicable legal period, after which eligible data is securely destroyed.
Your rights and contact
You may request access or a copy, correction, withdrawal of optional consent, or destruction of data not subject to legal retention. Start in account settings or contact privacy@souven.co. We verify identity and aim to respond within 30 days, explaining any lawful extension or refusal and the available escalation route.
Incidents and complaints
We assess and document personal-data incidents and notify the competent authority and affected people where legally required. If privacy@souven.co does not resolve your complaint, you may escalate it to Saudi Arabia’s competent personal-data protection authority.