This Privacy Policy explains how Penweet (“Penweet”, “we”, “us”, or “our”), the operator of https://penweet.com, collects, uses, discloses, stores, and protects personal data when you visit or use our creative community platform for designers and agencies (the “Service”). It is designed to meet transparency requirements under the Saudi Personal Data Protection Law (PDPL) and, where applicable, other laws that may apply to users in the Gulf region, the EU/UK (GDPR/UK GDPR principles), and similar regimes. It should be read with our Terms of Use and Cookies Policy. By creating an account or using the Service, you acknowledge this Policy.
1. Data controller
The data controller for personal data processed through the Service is Penweet, operator of penweet.com. Privacy requests: privacy@penweet.com. General support: support@penweet.com. Postal or commercial registration details will be stated here once the operating entity’s formal address and registration number are finalized by the company; until then, use the email channels above.
2. Scope
This Policy applies to registered users (individuals and agencies), visitors, job applicants interacting with listings on Penweet, and anyone who contacts us. It does not govern third-party websites linked from the Service (including external apply URLs or OAuth providers), which have their own policies.
3. Personal data we collect
We collect only what is needed for the purposes below. Categories include:
- Account data (typically mandatory to register): first and last name, email address, password (stored hashed), date of birth components where collected, country, language/UI locale, Penweet ID, account type (individual/agency), and email verification status.
- Profile and professional data (mostly optional, but needed for a complete public profile): job title, bio, photos/cover, phone, website, company details (name, country, city, URL, size, industry), education, work experience, awards, skills, languages, and social links you choose to add.
- User Content and activity: portfolio projects and media, collections, drafts, stories, posts, likes, comments, shares, views, follows, blocks, reports (reason, details, context, status), team memberships, invitations, join requests, and messages you send or receive.
- Jobs data: job listing interactions and application information you submit (which may be shared with the listing party).
- OAuth data (optional): limited identity tokens/profile fields from Google or Facebook if you choose those sign-in methods.
- Settings: privacy preferences (e.g., who can message you, online-status visibility), notification preferences, and browser-notification choices.
- Technical and security data: IP address, browser/device information, approximate location derived from IP where used for security, cookies and session identifiers, logs, and diagnostic events needed to operate and secure the Service.
- Communications: messages you send to support or privacy inboxes, and landing-page registration interest forms where offered.
4. Mandatory vs optional data
Mandatory data is required to create and secure an account and perform the contract (e.g., name, email, password, age confirmation). Optional data enriches your profile, portfolio, and discoverability. If you withhold mandatory data, we cannot provide the related Service. If you withhold optional data, core account features may still work with reduced visibility or functionality.
5. How we collect data
- Directly from you when you register, edit your profile, upload work, message, apply to jobs, join teams, report/block, or contact us.
- Automatically through cookies, sessions, logs, and similar technologies as described in the Cookies Policy.
- From OAuth providers when you authorize sign-in.
- From other users when they interact with you (follows, messages, reports, team invites) consistent with their and your settings.
6. Legal bases and purposes
Depending on applicable law, we process personal data on one or more of these bases: (a) your consent (e.g., optional OAuth, non-essential cookies where required, certain marketing); (b) performance of a contract or pre-contractual steps (providing the account, portfolio hosting, messaging, teams, jobs discovery); (c) compliance with legal obligations; and (d) where permitted, legitimate interests in securing the Service, preventing abuse, improving reliability, and promoting the platform in a manner that does not override your rights. Under Saudi PDPL, we rely primarily on consent and other lawful bases recognized by that Law and its Implementing Regulations. Purposes include:
- Creating and managing accounts, Penweet IDs, authentication, and email verification.
- Displaying profiles and User Content according to visibility settings; operating Discover, feeds, search, stories, and design tricks.
- Enabling messaging, follows, blocks, reports, notifications, and team collaboration.
- Facilitating job discovery and transmitting applications to listing parties.
- Securing the Service: fraud/abuse prevention, rate limiting, incident response, debugging, and enforcing Terms.
- Sending transactional notices (security alerts, password reset, verification, material policy updates).
- Product analytics limited to improving reliability and user experience (not selling personal data).
- Complying with lawful requests and protecting rights, safety, and property.
7. Public visibility
Content and profile fields you set to public/everyone (or leave on those defaults) may be visible to other users and, for publicly reachable pages, to search engines and unauthenticated visitors. Portfolio projects may also be limited to followers or only you. Private messages, private team materials, and “only me” portfolio items are not intended for public display. Blocking limits certain interactions but does not erase content already published publicly. Account deletion anonymizes identity and hides portfolio items as only-you; residual comments or likes left on others’ content may remain in restricted form unless separately removed. Do not upload secrets, government ID scans, payment card numbers, or sensitive personal data you do not want processed.
8. Sharing and disclosure
We do not sell personal data. We may disclose data only as follows:
- Service providers (processors) that host infrastructure, store files, send email (e.g., SMTP/SES), provide caching/queues, error monitoring, or security services—under contracts requiring confidentiality and purpose limitation.
- Other users, according to your settings (public profile/portfolio, messages you send, team memberships, job applications you submit to a listing party).
- OAuth providers when you initiate social login (their processing is under their policies).
- Legal, safety, and corporate events: when required by law or valid legal process; to protect users, Penweet, or the public from harm or fraud; or in a merger, acquisition, or asset transfer with appropriate safeguards and notice where required.
9. International transfers
Penweet may process and store data in the Kingdom of Saudi Arabia and in other countries where our service providers operate (for example, cloud regions). Where personal data is transferred outside the Kingdom or your country of residence, we take steps required by applicable law, which may include contractual safeguards, provider due diligence, and limiting transfers to what is necessary for the Service. By using the Service, you understand that your data may be processed in such locations.
10. Retention and account deletion
We retain personal data while your account is active and as needed for the purposes above. Typical practices:
- Active account data: retained until you delete the account or it is terminated.
- Stories: designed to expire about 24 hours after publication, then removed from active story surfaces (residual backups may persist briefly).
- Account deletion (Settings): we anonymize identifying fields, set portfolio visibility to private where applicable, delete stories and messages associated with the account, remove OAuth links, revoke tokens/sessions, and soft-delete the user record. Soft-deleted records may remain in restricted form for security, abuse prevention, legal compliance, and backup integrity for a limited period before permanent purge from active databases.
- Reports and security logs: may be retained longer as needed to investigate abuse and meet legal obligations.
- Backups: overwritten on a rolling schedule; deletion from backups may lag live systems.
11. Security measures
We apply technical and organizational measures appropriate to the risk, including: hashed passwords; optional encrypted sessions; HTTPS; security headers; CSRF protection; authentication and ownership checks on sensitive actions; rate limiting on login, registration, uploads, chat, reports, and job applications; access controls; and soft-delete/anonymization on account closure. No method of transmission or storage is 100% secure. You must keep your credentials confidential and use device security best practices.
12. Your rights
Subject to applicable law (including PDPL and, where applicable, GDPR-style rights), you may have the right to:
- Be informed about processing (this Policy).
- Access personal data we hold about you.
- Request correction of inaccurate or incomplete data.
- Request deletion of personal data (“right to be forgotten”), subject to legal retention exceptions.
- Request restriction of or objection to certain processing where the law provides.
- Withdraw consent where processing is consent-based, without affecting prior lawful processing.
- Data portability where applicable law grants it.
- Lodge a complaint with the competent authority (in Saudi Arabia: the Saudi Data & AI Authority / National Data Governance frameworks as applicable; elsewhere, your local supervisory authority).
13. How to exercise your rights
Use in-product Settings to update profile, privacy, notifications, blocked users, sessions, and account deletion. For other requests, email privacy@penweet.com from your account email and include your Penweet ID. We may need to verify your identity before acting. We will respond within the timelines required by applicable law. If we refuse a request where permitted, we will explain the reason unless legally prevented.
14. Children
The Service is for users 18 years or older. We do not knowingly collect personal data from children. If you believe a minor has created an account, contact privacy@penweet.com and we will take appropriate steps to delete it.
15. Sensitive data
Please do not submit special-category/sensitive personal data (e.g., health, biometric templates, religious or political beliefs, precise government identifiers) unless a specific feature expressly requires it and lawful basis exists. Job applications and profiles should remain professional and proportionate.
16. Automated decision-making
We do not use solely automated decision-making that produces legal or similarly significant effects about you (such as automated hiring decisions). Ranking, recommendation, spam, or abuse filters may use automated signals to protect the Service; you may contact us to contest enforcement outcomes that affect your account.
17. Cookies
We use essential cookies for authentication, sessions, CSRF protection, and security, and may use preference or limited analytics cookies as described in the Cookies Policy. Where required by law, non-essential cookies are used only with consent via our cookie banner or equivalent control.
18. Security incidents
If a personal-data breach occurs that poses risk to your rights or privacy, we will take containment measures and notify the competent authority and affected individuals when required by applicable law, using the contact channels available for your account.
19. Changes to this Policy
We may update this Policy to reflect product, legal, or security changes. We will revise the “Last updated” date and, for material changes, provide additional notice where practical (email or in-product). Continued use after the effective date means you acknowledge the updated Policy, except where mandatory law requires fresh consent.
20. Contact
Privacy: privacy@penweet.com. Support: support@penweet.com. Website: https://penweet.com