Privacy Policy

This policy explains what personal data REAP collects, how it is used, stored and protected, and the rights you have over it. By using the platform you agree to the practices described here.

01Who operates REAP

REAP is operated on an individual basis by Mohammed Basloom, who is the party responsible for processing the personal data described in this policy (the data controller). There is presently no separate registered commercial entity behind the platform. Contact details are at the end of this page.

02What data we collect

We collect only what the platform needs to function:

• Account data — the full name and email address you enter when you sign up.
• Your password — handled entirely by our authentication provider (Supabase) and stored as a one-way hash. We never see it and cannot recover it.
• Work you save — the valuations and assessments you choose to save to your account, including the inputs you entered, the name you gave the file, and its last-modified date.
• Data kept in your browser — your language preference, your current working draft, and your session token. These stay on your device and are not transmitted to us.

03Using REAP as a guest

If you choose Explore as guest, no account is created and nothing is saved to our servers. Your work stays in your browser only, and is lost if you clear your browser data or switch device.

04Why we use your data

• To create your account and authenticate you when you log in.
• To save your work and make it available on any device you log in from.
• To send strictly operational emails: signup confirmation, password reset, and email change.

We do not send marketing emails, and we do not use your data for any purpose beyond those listed above.

05Where your data is stored

We rely on specialist providers to run the platform. Each processes data on our behalf and only as far as its role requires:

• Supabase — authentication and database. Your account data and saved work are hosted in the ap-south-1 (Mumbai, India) region, meaning outside the Kingdom of Saudi Arabia.
• Resend — delivery of the operational emails above, sent from [email protected].
• Cloudflare Pages — website hosting and content delivery.

By using the platform you consent to your data being transferred to and processed by these providers outside the Kingdom.

06How your data is protected

• Everything travels over an encrypted connection (HTTPS/TLS).
• Row-level security is enforced in the database, so no account can read or modify another account's records.
• Passwords are never stored in readable form anywhere.

No online system is absolutely secure, however. We recommend using a strong password that you do not reuse elsewhere.

07How long we keep it

We keep your account data and saved work for as long as your account exists. When you ask us to delete your account, your data and saved work are permanently removed.

08Your rights

Under the Saudi Personal Data Protection Law (PDPL) you have the right to:

• Access the personal data we hold about you and obtain a copy of it.
• Have inaccurate or incomplete data corrected.
• Request deletion of your account and data.
• Withdraw your consent to processing — noting this means closing the account.

To exercise any of these rights, contact us using the details below. We will respond within 30 days at the latest.

09Changes to this policy

We may update this policy from time to time; the date at the top of this page always reflects the current version. Continued use of the platform after an update constitutes acceptance of the revised policy.

10Contact

For any privacy question, or to exercise your rights: