Privacy Policy
Last updated: September 2026
This explains what we collect, why, and how we protect it. Because this service handles photographs of children, it is written in plain language a parent can follow rather than in legal boilerplate.
Who we are
Salfa Hub, commercial registration 7055298918, VAT registration 315068824200003, Al Sawari District, Al Khobar 34724, Kingdom of Saudi Arabia. This is the company you are contracting with when your delivery address is in Kingdom of Saudi Arabia.
For anything about your privacy or your data: hello@salfa.app
What we collect
For a storybook, card or sticker sheet: the child's photograph you upload, their first name, an approximate age, and simple appearance details used only for the artwork.
For a photo album or artwork book: the photographs you choose to include, any captions you write, and the order you put them in.
Your email, phone number and delivery address, to fulfil the order. Order and payment records. Card numbers never reach us and we never store them.
Guardian consent
We do not accept a child's photograph until you confirm you are their parent or legal guardian. We record that consent with a timestamp and the version of the wording you agreed to.
It is checked again inside every generation job, not only at upload. Any job that would process a photograph without recorded consent stops.
Where the photograph goes
It is stored in a private bucket that is not publicly readable. There is no public link to your child's photograph.
To create storybook, card or sticker artwork we send the photograph to fal.ai, an AI image provider whose servers are in the United States. That is a transfer of personal data outside your country, and we state it plainly because it matters: if you are not comfortable with it, we cannot prepare that order.
We send the image data rather than a link to it, so no third party is ever handed a URL that resolves to your child.
Photographs in an album or artwork book are NOT sent to any AI provider. They go only to our printer, to be printed.
How long we keep it
The child's photograph you upload for a storybook, card or sticker sheet is deleted 30 days after you upload it — whether or not you go on to place an order. A job runs every night and removes the ones that are due.
Photographs in an album or artwork book are the product itself, so they are kept with your order for as long as the order exists — that is what lets you reorder, and lets us reprint if something goes wrong. They are not deleted on a schedule.
The finished artwork for a storybook stays with your order for the same reason. You can ask us to delete anything, including album photographs, at any time at hello@salfa.app and we will do it.
Payments
Payments are processed by Tap Payments. Card details are entered on Tap's own page and never pass through our systems.
We send Tap your first name, email address, phone number and an order reference — the minimum it needs to take the payment and to let us match it back to your order.
Cookies and analytics
We use PostHog for product analytics. It records page views, page exits and a small set of product events — which story you viewed, which style you chose, which step of the personalisation you reached.
Anonymous visitors are not given an identified profile; that only happens once you sign in.
We use essential cookies for your market, language and drafts. Google Analytics measures website activity. Meta Pixel and Conversions API measure advertising results, including product views, checkout and confirmed purchases. Meta receives advertising cookie identifiers, browser information, purchase amount and currency, and hashed purchaser email and phone for matching. Hashing does not make these identifiers anonymous. We do not send children’s photographs, names, album contents or delivery addresses to Meta.
We do not train on it
Your child's photograph is not used to train any AI model, by us or by our providers. We do not sell your data.
Your rights
Under the Personal Data Protection Law you may access your data, correct it, delete it, withdraw consent, and object to how it is processed.
Write to hello@salfa.app and we will act on it. You also have the right to complain to the Saudi Data & AI Authority (SDAIA).
If something goes wrong
If personal data is exposed in a way likely to harm you, we will notify the Saudi Data & AI Authority (SDAIA) and the people affected without undue delay.
We will tell you what happened, what it means for you, and what we are doing about it.