Privacy policy

Gold Station (Gold Line Company, Unified National Number 7049747830) operates the Gold Station marketplace — the Gold Station app and the website erp.gst-sa.net — which connects customers with approved Saudi gold merchants. We are based in Riyadh, Saudi Arabia and are responsible for the personal data described here under the Saudi Personal Data Protection Law (PDPL).

Every merchant on the marketplace is an independent business. When you deal with a merchant (a rental request, a used-gold sale or, where available, a purchase), that merchant also processes the data of that transaction under its own responsibility.

We collect what you give us and what is needed to run the service — nothing else:

• Account details: name, email address, mobile number and password (stored only as a one-way hash that nobody can read), and a referral code if you enter one.
• Delivery addresses you save.
• Bank account details (bank, IBAN, account holder name) if you add them, so that Gold Station can transfer money owed to you, such as a refund.
• Photos you choose to upload: used-gold listings, theft reports, authenticity reports and support attachments. The app only opens the camera or your photo library when you choose to take or pick a photo.
• Content you submit: used-gold listings and the offers you accept, rental requests, theft and authenticity reports, product reviews, support tickets and messages.
• Transactions: rental requests, the used-gold offers you accept and, where purchasing is available, orders, payments, invoices and returns.
• Usage: products you view (linked to a random session identifier, not to your account), stories and merchant ads you view or tap (linked to your account when you are signed in), and the stores you follow.
• Search terms: used to return results; we do not store them.
• Technical data: our servers log incoming requests (including IP address, time and the page requested) for security and troubleshooting, and we use your IP address in hashed form, or your account ID, to limit request rates over short time windows.

What we do not collect: your location, contacts, advertising or device identifiers, crash or diagnostic reports, or payment card numbers (where payment is available, cards are entered with the licensed payment provider directly and we do not store them). Fingerprint and face unlock happen entirely inside your device's operating system; the app receives only a success or failure result.

The website sets only the cookies strictly needed to keep you signed in — no advertising or analytics cookies. Your cart and wishlist are stored on your device.

• To create and run your account and provide the services you ask for (performing our agreement with you).
• To pass your request to the merchant concerned — for example a rental request to the store you chose, or your used-gold listing and its photos to merchants selected by Gold Station so they can make offers. A used-gold deal is completed directly between you and the merchant; Gold Station does not pay for the gold and no payment happens on the platform.
• To transfer money Gold Station owes you, such as a refund, to the bank account you added.
• To answer your support requests.
• For security and to prevent fraud and abuse, including reviewing theft and authenticity reports.
• To measure how stories and merchant ads perform on the marketplace; merchants see totals, not who viewed.
• To meet legal obligations, such as keeping VAT records and answering lawful requests from competent authorities.
• To send service messages: email confirmation, password recovery and notices about your requests. We do not send marketing messages without your consent.

• The merchant you deal with, limited to the transaction you started.
• Theft reports: reviewed by Gold Station staff first; after review they may be circulated to merchants so they can recognise the reported piece — without your name or contact details, and with photos re-processed to strip embedded data such as location.
• Service providers acting only on our instructions: Supabase (database, authentication and file storage — Frankfurt, Germany), Vercel (website and app API hosting — Frankfurt, Germany) and Resend (delivery of account emails).
• The licensed payment provider, where payment is available, to process the payment itself.
• Competent authorities, where the law requires it.

Some of these providers process data outside the Kingdom of Saudi Arabia. We transfer data abroad only as the PDPL and its regulations permit, with safeguards that preserve the level of protection. We do not sell your data, and we do not share it with advertising networks or data brokers.

We keep your data while your account exists. When you delete your account, your personal data and content are deleted immediately, except what the law requires us to keep: paid-order, invoice, accounting, return and payment records, which remain without your name or contact details for the period Saudi VAT law requires. We also keep a record proving the deletion took place, holding only a one-way fingerprint of the account ID.

Server logs and rate-limit counters are short-lived and deleted automatically. Search terms are not stored.

Under the PDPL you have the right to:

• Be informed of how and why your data is collected and processed — this policy is part of that.
• Access your data and obtain a copy of it.
• Correct or update your data — you can edit your profile, addresses and bank accounts directly under My account.
• Have your data destroyed — by deleting your account as described below, or by writing to us.
• Withdraw your consent wherever processing relies on it.

To exercise any of these rights, write to support@goldstation.sa from the email address registered to your account; we reply within 30 days. You may also lodge a complaint with the Saudi Data & AI Authority (SDAIA).

In the app or on the website: My account → Security & password → Delete account. Deletion happens immediately once you confirm your password. If you cannot sign in, write to us from your registered email address. The full details — what is deleted, what is kept, and when deletion has to wait — are on the Account deletion page.

• All connections are encrypted with HTTPS, and the app refuses unencrypted connections.
• Database access controls limit every customer to their own records.
• Passwords are stored only as one-way hashes.
• The app keeps your session in your device's secure storage, offers an optional fingerprint or face lock and, on Android, blocks screenshots of sensitive screens.

No system is perfectly secure; if you suspect someone has accessed your account, change your password and contact us.

The service is intended for people aged 18 and over, and we do not knowingly collect children's data. If you learn that a child has created an account, contact us and we will delete it.

The date of the last update is shown at the top of this page. If we make a material change, we will tell you in the app or by email before it takes effect.