Privacy Policy

When you book or contact us, we collect:

• Contact info: full name, email, phone (WhatsApp), and company name (optional)
• Booking details: shoot dates, project type, equipment selection, delivery address (if applicable)
• Payment proof: a screenshot of your bank transfer (uploaded to confirm payment)
• Account info (if you register): email and a hashed password (never stored in plain text)

We do not collect government IDs, financial account numbers, or biometric data online. ID verification happens in person at pickup if required.

Your data is used only for:

• Processing and confirming your booking
• Communicating about pickup, delivery, payment, and returns
• Generating quotations and invoices that comply with Saudi VAT law
• Authenticating you when you sign in to your account
• Resolving any damage or loss claims arising from a rental

We do not use your data for advertising, profile selling, or third-party marketing.

Customer data is stored in Supabase (Frankfurt, EU) and Vercel (US/EU edge), both encrypted at rest. Email correspondence flows through Resend. Bookings and customer accounts are protected by row-level security so that customers can only access their own bookings — admins can access all bookings to fulfill them.

Booking records are retained for 5 years in line with Saudi tax-record requirements. Account data is kept for as long as your account is active — you can request deletion at any time (see below).

We use cookies for two purposes only:

• Auth cookies — to keep you signed in (Supabase Auth)
• Cart persistence (localStorage) — to remember items you’ve added to your cart between visits

We do not use third-party analytics, advertising, or tracking cookies.

We share data only with our service providers, and only what they need:

• Supabase — database hosting (account + booking data)
• Vercel — web hosting
• Resend — sending transactional emails (confirmations, password resets)

We never sell, rent, or trade your data to third parties.

You can at any time:

• View and edit your profile from /account/profile
• See all your bookings at /account/bookings
• Request a copy of all data we hold about you, or request deletion of your account, by emailing Sales@proco.studio from your registered email

Note: deletion requests cannot remove records that we are legally required to retain (e.g., tax invoices for 5 years), but the rest can be deleted.

If we ever experience a data breach affecting your information, we’ll notify you by email within 72 hours of confirming the incident, along with what was exposed and what you should do.

We may update this policy occasionally to reflect changes in services or law. Material changes will be announced via email to active customers.

Questions about your data? Contact us or email Sales@proco.studio.