Privacy policy

• Account details such as name, email and phone number.
• Reservation, delivery address and location pin, purchase, review and support history.
• Saved listings, price-alert targets, notification choices and referral attribution.
• Gold-request preferences and any optional reference image; store-visit time, phone and note.
• A minimal identity-check record for each order: provider reference, resident or visitor route, pass/fail status and timestamps.
• Vendor identity, licence, address and verification documents.
• Privacy-minimal funnel events such as marketplace, product, comparison and checkout steps; search text itself is not stored in analytics.
• Page views without personal data: the page address, the referring website, campaign tags in the link (utm_…), language, device type (mobile, tablet or desktop) and a random number for the current browser tab. No IP address, browser details or account is stored with them, and none are recorded if your browser sends Do Not Track or Global Privacy Control.
• If you choose WhatsApp price alerts: your WhatsApp number, when you opted in or out, and the delivery status of each alert.
• Technical and security information such as timestamps, IP address and audit events.

WhatsApp alerts are optional. We send them only if you tick the WhatsApp box on the gold-rate alert form, and only as the approved alert message. Reply STOP to stop them at any time, or switch the alert off in your account. They are delivered through Meta’s WhatsApp Business service, and WhatsApp’s own terms and privacy policy apply inside WhatsApp.

Before every new order, UAE residents use Didit’s hosted service to capture the front and back of an Emirates ID and complete a liveness and face-match check. Visitors use a passport and complete the same face check.

Identity document images, selfies and biometric templates are collected and processed by Didit. Get Gold does not receive or store those files. It receives the provider’s outcome needed to authorize one order. Biometric processing requires explicit notice and consent in the hosted flow.

We use information to authenticate users, identify the person placing each order, display account history, create purchase requests, notify users about orders and watched listings, attribute referrals, measure the marketplace funnel, verify vendors, prevent overselling and fraud, moderate reviews, provide support and maintain legally relevant records.

A vendor receives the customer and reservation information needed to confirm and fulfil that vendor’s order, plus confirmation that the identity check passed—not the identity images.

Approved vendors can review open gold requests. An optional reference image stays in private storage and is shared through a short-lived link; competing offer prices are not shown to other vendors. An approved delivery company receives only the fulfilment information needed after it is assigned. We do not sell personal data and we do not publish private documents.

These providers process information on Get Gold’s behalf to run the website. Some of them process data outside the UAE.

• Supabase — database, sign-in and file storage.
• Vercel — website hosting.
• Didit — identity checks: document images, face scan and liveness check.
• Resend — sending account, order and alert emails.
• Cloudflare Turnstile — bot protection on sign-up and sign-in forms.
• Cloudflare — cleaning up store product photos (no customer data).
• Gold-price data providers send us prices only and receive no personal data.

We use a small number of cookies to keep you signed in and remember your language. We do not use advertising cookies. The Cookies page lists each one.

Reservation price snapshots, the minimal identity-check outcome and audit records are retained to preserve transaction integrity. Identity document and biometric retention is controlled in Didit and must be configured to the shortest period allowed by the applicable contract and legal obligations.

Privacy-minimal funnel events and page views are automatically removed after about 13 months. Reference images and visit/request details should be deleted or anonymized when they are no longer reasonably needed for matching, support or a legal obligation. Access controls, private storage, expiring links and server-side authorization are used to restrict sensitive data.

You may turn off optional marketing and external notification channels, remove saved listings, deactivate price alerts, ask to access or correct account information, or raise a deletion request. In-account order and security records remain available. Some transaction, fraud-prevention or legal records may need to be retained.

To make a request, email partnership@getgold.ae from the address on your account.