Privacy Policy


This Privacy Policy explains how TAMO-HAUS ("we", "us") collects, uses, shares, and protects personal data when you visit our website, use our platform and Client Dashboard, connect your social-media accounts, contact us, or apply for a job with us. It should be read together with our [Terms of Use](/legal/terms) and our [Payment & Subscription Policy](/legal/payment-policy).

## 1. Who We Are & Scope

The party responsible for your personal data is Tamo Haus Advertising & Marketing Company W.L.L. (شركة تامو هاوس للدعاية والتسويق ذ.م.م), trading as TAMO-HAUS, a limited liability company registered in the State of Kuwait under commercial registration no. 538574 and commercial licence no. 2025/21660, with its registered address at Sheikh Ali Abdulaziz Salem Al-Sabah Building, Al-Shuhada Street, Block 5, Sharq, Kuwait City, State of Kuwait. For any privacy matter, contact us at contact@tamohaus.com.

This Policy applies to the authorised representatives of our business clients and the staff of our clients, to visitors to our website, to people who contact us, to business contacts we approach about our services, and to job applicants and talent.

## 2. Data We Collect

Depending on how you interact with us, we collect:

- **Account and contact data:** name, email address, phone number, country and city, role, password (stored by our authentication provider in hashed form that cannot be reversed, never readable by us), and language preference.
- **Business data:** brand name, business activity (industry), business profile details, logo and brand assets, goals, target audience, budget range, visual-identity notes, and links to your social accounts.
- **Subscription and billing data:** chosen Package and commitment, subscription dates, invoices, payment records, the payment method used, and bank-transfer or payment-link references. We do not receive or store your full card number.
- **Content and files:** the materials, images, videos, and documents you upload or send us, the content we prepare for you, and your approvals, revision requests, and comments.
- **Data from Connected Accounts:** the data described in section 3, when you connect a social-media or advertising account.
- **Communications:** messages you send us by email, WhatsApp, the contact form, or the Client Dashboard, and our replies.
- **Technical data:** IP address, browser and device information (user agent), pages accessed, log and error data, and the cookies and browser storage described in section 11.
- **Consent records:** each time you accept our legal documents, we record which document and version you accepted, its SHA-256 fingerprint, the date and time, and your IP address and user agent.
- **Contact-form and enquiry data (non-clients):** your name, contact details, company, subject, message, preferred contact method, and the IP address and user agent of the submission.
- **Job-application data:** your name, email, phone number, age, nationality, country and city, the role you apply for, your answers, cover letter, portfolio and CV links, your photo, and your CV file, together with the IP address of the submission. Your photo and CV are stored in a private storage area that is not publicly accessible.
- **Talent-profile data:** if your application is accepted and you have given the consent described in section 6, your name, photo, age, gender, portfolio, and skills.
- **Business-contact data for sales outreach:** the business name, contact name, area, business email, phone number, and public social-media account of businesses we may approach about our services. We obtain this data from public business sources, such as business directories, the business's own website, and its public social-media pages.

## 3. Data from Connected Social Platforms

You may connect your accounts through each platform's official authorisation process (OAuth). We access only the permissions you grant, and we use them only to provide the Services to you:

- **Meta (Facebook Pages):** the list of Pages you manage; your Page name, follower counts, and Page insights (such as reach, impressions, and engagement); post-level counts (reactions, comments, shares, and views); the results of the advertising campaigns in your ad accounts (read-only); and permission to publish to your Page the posts that you have approved.
- **Meta (Instagram professional accounts):** your account's basic profile (such as username and follower count), account- and media-level insights (such as reach, profile views, likes, comments, saves, and shares), and permission to publish content that you have approved.
- **TikTok:** your basic profile information and account statistics (such as follower and video counts), the list of your videos and their performance, and permission to publish videos that you have approved.
- **Snapchat:** your account identifier and display name and access to Snap's Marketing API, used to link your account and, where your Package includes Snapchat services, to support that activity.

Through these connections, we do not read your private messages or the text of comments, and we do not create, change, or pay for advertisements.

**Admin or partner access:** where you give our team admin, manager, or partner access to your accounts (for example in Meta Business Suite or your advertising accounts), our staff can see what that access shows, such as messages, comments, and advertising settings, and they use it only to manage your accounts and campaigns on your instructions and as your Package provides. Advertising campaigns are created and managed in your own advertising account using the platform's tools, and the platform charges the advertising budget to you. We treat everything seen through this access as your confidential information and never use it for any other purpose.

Access tokens are encrypted at rest. In the Client Dashboard you can control whether we may publish posts or stories and view content or analytics for each Connected Account. You can disconnect an account at any time from the Client Dashboard, and you can also revoke our access from the platform's own settings. When you disconnect, we ask the platform to revoke our access where it supports this, we delete the access token immediately so it can no longer be used, and we stop publishing to and collecting data from that account. The same happens when your account is deleted.

Each platform also processes your data under its own privacy policy: [Meta](https://www.facebook.com/privacy/policy), [TikTok](https://www.tiktok.com/legal/privacy-policy), and [Snap](https://values.snap.com/privacy/privacy-policy).

## 4. Data About Your Audience That We Process on Your Behalf

Insights about the followers and customers of your accounts, such as reach, engagement, and advertising results, are mostly aggregated statistics provided by the platforms. Where any of this data relates to identifiable people, you are responsible for it as the owner of the accounts, and we process it only on your behalf, under your instructions, and only to provide the Services to you. We do not use it for our own purposes or for any other client, and we delete it with your account.

## 5. How We Use Your Data

We use personal data to:

- create, review, and manage your account, Package, and subscription;
- deliver the Services, including preparing, scheduling, and publishing content you approved, managing campaigns, and preparing analytics and reports for you;
- issue invoices, record payments, and handle suspensions, cancellations, refunds, and disputes;
- communicate with you about the Services, approvals, invoices, support, and changes to our legal documents;
- protect the Platform, including preventing spam and abuse, keeping it secure, and fixing errors;
- keep evidence of the legal documents you accepted and establish, exercise, or defend legal claims;
- respond to enquiries, assess job applications, and, with your consent, show your talent profile to our clients;
- send business contacts information about our services, with an option to unsubscribe;
- comply with our legal, accounting, and regulatory obligations.

We do not use automated decision-making that has legal or similarly significant effects on you, and we do not use artificial-intelligence services to process client data or data from Connected Accounts. The only automatic actions on your account follow the rules you accepted, such as suspending services after an invoice remains unpaid beyond the grace period, or publishing approved content at its scheduled time.

## 6. Legal Basis & Consent

We process personal data on the following grounds:

- **Contract:** to provide the Services under our agreement with your business and to take steps before entering into it.
- **Consent:** for example, when you connect a social account, when you approve the use of your results in our marketing, or when, as a job applicant, you agree that your talent profile may be shown to our clients. You can withdraw consent at any time by emailing contact@tamohaus.com, without affecting processing that took place before the withdrawal.
- **Legal obligation:** for example, keeping accounting and invoice records.
- **Legitimate interests:** operating, securing, and improving our business, preventing fraud and abuse, keeping consent evidence, and approaching businesses about our services, provided that these interests are not overridden by your rights.

We process personal data in line with Kuwaiti law, including the Electronic Transactions Law No. 20 of 2014 and, where applicable, the data-privacy regulations issued by the Communication and Information Technology Regulatory Authority (CITRA). We keep personal data confidential and use it only for the purposes for which it was collected or for compatible purposes.

## 7. Limits on Our Use of Your Data

- We do not sell personal data or data from your Connected Accounts, and we do not share it with data brokers or advertising networks.
- Data from your Connected Accounts is used only to provide the Services to you. It is not used to make eligibility decisions about you or any person, for surveillance, or to build profiles for, or provide services to, any other client.
- We may show the final work we produced for you, with your brand name and logo, in our portfolio, as set out in the Terms of Use; you can ask us to remove a specific work or hide sensitive information at any time by emailing contact@tamohaus.com. This never includes data from your Connected Accounts.
- We use your results or figures in our marketing or case studies only with your prior written approval.
- We show a talent profile to our clients in the Client Dashboard only if the talent gave explicit consent in the application form, and we stop showing it once that consent is withdrawn.

## 8. Sharing Your Data & Service Providers

We share personal data only as needed to operate the Platform and provide the Services, with the following service providers, who process it on our behalf and under our instructions:

- **Supabase:** database, user authentication, and storage of some private files, hosted in the European Union (Frankfurt, Germany).
- **Vercel:** hosting and delivery of the website and Platform.
- **Cloudflare:** domain name services (DNS), file storage (R2) for uploaded content and private files, and the Turnstile anti-bot check on our forms, which receives your IP address.
- **Resend:** delivery of emails, such as account confirmation, invoices, notifications, and messages to business contacts.
- **Sanity:** management of our blog content. It does not hold client personal data.
- **Sentry:** error and performance monitoring, which may receive technical data such as IP address and browser information when an error occurs. It does not record your screen or sessions.
- **Meta, TikTok, and Snapchat:** when you connect your accounts and we publish or read data on your instructions.
- **WhatsApp (Meta) and our business email provider:** to exchange messages with you, as described in the Terms of Use.
- **Banks and payment providers:** to receive and confirm your payments and process refunds.

Talent profiles are shown to our business clients as described in section 7. We may also disclose personal data where required by law, a court, or a competent authority, to protect our rights or the safety of others, or to a successor in the event of a merger or transfer of our business, subject to this Policy.

## 9. Processing Outside Kuwait

Some of our service providers store or process data outside Kuwait, including in the European Union and the United States. Where this happens, we choose providers that apply recognised security standards and contractual commitments to protect personal data, and we limit what we share to what each provider needs.

## 10. Marketing Communications

We send marketing emails only to business contacts, and every such email includes an unsubscribe link. Once you unsubscribe, we stop sending you marketing emails and keep a record of your choice so that we can respect it. Service messages related to your account, invoices, and legal documents are not marketing and are sent while your account is active.

## 11. Cookies, Browser Storage & Embedded Content

We use only the following:

- **Strictly necessary cookies:** to keep you signed in and secure your session, to remember your language and the business selected in the dashboard, and to protect the connection of your social accounts (short-lived security cookies used during the authorisation process).
- **Browser storage (local and session storage):** to remember your display preferences (such as theme and menu layout) and notification choices, and to cache dashboard data temporarily in your browser so that pages load faster. This data stays on your device: session storage is cleared when you close the browser tab, and preferences stay until you clear your browser data.
- **Anti-bot protection:** Cloudflare Turnstile checks that form submissions come from a person and not an automated bot, and may use cookies or similar technologies for that purpose.

We do not use advertising cookies, tracking pixels, or third-party analytics. The fonts of our website are served from our own servers. Some pages, such as portfolio pages and content previews in the Client Dashboard, embed content from Instagram, TikTok, or YouTube. YouTube videos load in YouTube's privacy-enhanced mode. These platforms may set their own cookies under their own policies when their content loads or when you play it. If we add analytics or advertising cookies in future, we will update this Policy and ask for your consent where required.

You can control cookies in your browser settings, but blocking strictly necessary cookies will prevent you from signing in.

## 12. Data Retention

- **Account and business data:** kept while your account is active, and deleted when your account is deleted, as described in section 13.
- **Deliverables and their source files:** available in your account while it exists; the source files are kept for 12 months after the Services end, as set out in the Terms of Use, and then deleted.
- **Data from Connected Accounts:** tokens are deleted immediately when you disconnect the account, and in any case when your account is deleted. Data already collected remains part of your reports until your account is deleted, unless you ask us to delete it earlier.
- **Invoices and payment records:** kept for at least 5 years, or longer where Kuwaiti law requires, for accounting and tax purposes, even after your account is deleted.
- **Legal-consent records:** the record of which document version and fingerprint you accepted, when, and from which IP address and browser is kept for the life of your account and afterwards for the longest period in which legal claims may be brought under Kuwaiti law (currently 15 years), even after your account is deleted. After account deletion, the record is detached from your account, and your email address is the only account detail kept in it.
- **Job applications:** deleted, together with the photo and CV, 12 months after submission, unless you are hired or become a talent with your consent, or you ask us to delete them earlier.
- **Talent profiles:** kept while your consent is in place, and removed from client view once you withdraw it.
- **Enquiries and contact-form messages:** deleted 24 months after they are received.
- **Security and activity logs:** deleted after 12 months.
- **Business contacts:** kept until you ask us to delete them or unsubscribe; after you unsubscribe we keep only the record needed to respect your choice.
- **Backups:** our database backups roll off within 7 days, so deleted data disappears from backups within that period.

## 13. Account Deactivation & Deletion

You can deactivate or permanently delete your account at any time from the account settings in the Client Dashboard. Step-by-step instructions are available at [/legal/data-deletion](/legal/data-deletion).

- **Deactivation** is reversible: your account is hidden and sign-in is blocked, but nothing is deleted. Signing in again lets you reactivate the account.
- **Deletion** is permanent: sign-in is blocked immediately and the account enters a **3-day grace period**. If you sign in during that period, you can cancel the deletion and restore full access. If you do not cancel, your account and associated data, including the files you uploaded, are **permanently purged** when the 3-day period ends and cannot be recovered, and our access to your Connected Accounts is revoked, except for the records described in section 12 that we must or may keep. Download any Deliverables you need before you delete your account.

Deleting your account does not cancel amounts already due under the [Payment & Subscription Policy](/legal/payment-policy).

## 14. Your Rights & How to Exercise Them

Subject to applicable law, you may:

- access the personal data we hold about you and receive a copy of it, including in a commonly used electronic format on request;
- correct inaccurate or incomplete data, much of which you can update directly in the Client Dashboard;
- request deletion of your data, subject to the retention described in section 12;
- withdraw any consent you have given, such as for a Connected Account or for your talent profile, and ask us to remove your work from our portfolio;
- object to marketing at any time by using the unsubscribe link or contacting us.

To exercise a right, email contact@tamohaus.com from the email address registered on your account or used in your application, or use the Client Dashboard where available. We may ask you to confirm your identity. We will respond within 30 days of receiving your request.

## 15. Security

We apply technical and organisational measures appropriate to the nature of the data, including encryption in transit (HTTPS), encryption of social-account access tokens at rest, private storage for non-public files, role-based access controls, and access by our staff only on a need-to-know basis. No method of transmission or storage over the internet is completely secure, so we cannot guarantee absolute security.

## 16. Data Breaches

If we become aware of a security breach that affects your personal data, we will notify affected people without undue delay, explain what happened and the measures we are taking, and notify the competent authorities where required by law.

## 17. Children

Our website and Services are intended for businesses and adults and are not directed to persons under 18. We do not knowingly collect personal data from persons under 18. If you believe we have done so, contact us and we will delete it.

## 18. Changes to This Policy

We may update this Policy from time to time. Every version receives a new version number and is permanently archived with its publication date and SHA-256 fingerprint at [/legal/history](/legal/history); previous versions are never altered. We will notify existing clients of material changes by email and in the Client Dashboard at least 30 days before they take effect, and new clients are bound from the publication date. If you do not accept a material change, you may cancel your subscription before it takes effect with no cancellation fee and without having to pay back any commitment discount. Non-material changes, such as correcting typing errors, updating contact details, or clarifications that do not reduce your rights, may be published without prior notice. After you accept any version, we send you by email a copy of the exact text you accepted.

This Policy is published in Arabic and English. In case of any difference between the two versions, the Arabic version prevails.

## 19. Contact & Complaints

For any privacy question, request, or complaint, contact us at contact@tamohaus.com or by WhatsApp on +965 99566983. We will acknowledge your complaint and respond in substance within 7 business days, and requests to exercise your rights are answered within 30 days as described in section 14.