Privacy Policy

PRIVACY POLICY

Last Updated: September 12, 2026

The Cold List for Software Development LLC (“TheCoolist”), a limited liability company incorporated in the Hashemite Kingdom of Jordan, is responsible for processing Personal Information in connection with our websites, mobile application(s), and related Services. This Privacy Policy explains how we collect, use, disclose, and protect information about individuals who interact with our Platform(s), including users, subscribers, and personnel.

Unless we process Personal Information strictly on another party’s documented instructions (in which case we act as that party’s processor), TheCoolist determines the purposes and means of processing and acts as the controller.

We handle Personal Information in accordance with applicable laws, including the Jordanian Personal Data Protection Law No. 24 of 2023 (PDPL), the GDPR (where applicable), and other relevant regulations. Where required by law, we will provide just-in-time notices and obtain separate, explicit consent for certain processing (for example, personalized advertising or access to device features).

Location data associated with your Platform activity will be retained for no more than 90 days from your last activity and then deleted or anonymized unless required by law, or for security, fraud prevention or legal compliance.

By using the Services, you acknowledge that you have read this Privacy Policy and our Terms and Conditions (the “Terms”). This acknowledgment is not a substitute for consent where consent is required by law; in those cases, we will ask you for consent through clear prompts and settings.

We may update this Privacy Policy from time to time. If we make material changes, we will provide appropriate notice (e.g., in-app notice, banner, or email) and update the “Last Updated” date above. Unless stated otherwise, updates take effect when posted. Your continued use of the Services after the effective date constitutes acceptance of the updated Policy.

Capitalized terms not defined here have the meanings given in our Terms or in the relevant sections below.

1. INTERPRETATION AND DEFINITIONS

The words of which the initial letter is capitalized have meanings defined under the following conditions. The following definitions shall have the same meaning regardless of whether they appear in singular or in plural.

For the purposes of this Privacy Policy:

TheCoolist, Company, we, us, or our means The Cold List for Software Development LLC, the controller of Personal Information unless stated otherwise.

Account means a unique account created for you to access our Platform, Service or parts of our Service.

Cookies are small files that are placed on your mobile device or any other device by a website, containing the details of your browsing history on that website among its many uses.

Child means a natural person who has not reached the age of legal capacity in their place of residence. In Jordan this is under 18.

Controller means the entity that determines the purposes and means of processing Personal Information. Unless stated otherwise, this is TheCoolist.

Device means the device used by the user to access the Platform and Service such as a cellphone, smart phone, computer, or a digital tablet.

DPO (Data Protection Officer) means the role required under applicable law to oversee compliance with data-protection obligations.

Processor means an entity that processes Personal Information on behalf of a Controller pursuant to documented instructions.

Processing means any operation or set of operations performed on Personal Information, whether or not by automated means (such as collection, recording, organization, structuring, storage, adaptation, retrieval, consultation, use, disclosure, alignment, restriction, erasure, or destruction).

Personal Information (also Personal Data) means any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to identifiers such as a name, user ID, email address, profile photo, age, contact details, online identifiers (including IP address and device identifiers), or location data.

Profiling means automated processing of Personal Information to evaluate certain personal aspects of a person (e.g., preferences, behavior, interests), as defined under applicable law.

SDKs means software development kits integrated into our apps that enable analytics, error reporting, advertising, or other functionality.

Service or Services means the services we make available via the Platform from time to time.

Service Provider means any natural or legal person that processes Personal Information on behalf of the Company to facilitate or provide the Services (including hosting, support, analytics, advertising where applicable, or security).

Sensitive Personal Information means Personal Information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership; financial information; health (including physical, mental) or genetic data; biometric data used for unique identification; criminal-record data; sex life or sexual orientation; and any other category designated as sensitive under applicable law or by the competent authority.

Store Provider(s) refers to Google Play Store and/or Apple App store.

Tracking Technologies means Cookies, SDKs, pixels, tags, and similar technologies used to store or access information on a Device.

Usage Data means information collected automatically through the Services or the underlying infrastructure (for example, app usage metrics, diagnostics, crash logs, performance data, pages or screens viewed, session duration, referring URLs, approximate location, IP address, Device and app identifiers, operating system and version, and user agent).

User, you, or your means the individual accessing or using the Platform and/or Services, or the company or other legal entity on whose behalf such individual accesses or uses the Platform and/or Services, as applicable.

Platform or Platforms means our websites and mobile application(s) owned or operated by TheCoolist through which the Services are provided.

1. INFORMATION WE COLLECT AND DATA USAGE

TheCoolist respects your privacy and applies data-minimization practices. We do not require or intentionally collect Sensitive Personal Information. Please do not submit such data through the Services. If such data is inadvertently provided, we may delete it or restrict its use.

This Policy applies to our Platforms and related features, products, and Services where it is posted. By using the Platforms or Services, you acknowledge this Policy and our Terms.

Before we start processing, we will tell you: (i) the categories of data we will process and the start date, (ii) the purpose(s), (iii) the duration (we will not extend it without your new consent), (iv) the identity of any processor assisting us, (v) a summary of our security measures, (vi) whether we use Profiling, (vii) the legal basis we rely on, and (viii) whether data will be transferred outside Jordan (and, if so, the safeguards used).

The type of information we collect varies based on how you use the Platforms and Services (for example, when you register, create an account, subscribe to updates, or participate in posting areas such as photos or status updates).

If you have questions about this Policy or our privacy practices, please contact us using the details in the Contact section.

Information we collect

1) Information you provide to us

• Account & profile: name, email, login credentials, profile photo, bio, preferences.
• Content & interactions: posts, photos, comments, messages, and related metadata you upload or share.
• Communications: support inquiries, feedback, survey responses.
• Settings & choices: privacy/notification settings, consent choices.
• Contacts (if you approve): names, phone numbers, and emails from your device’s address book to help you connect with people you know. You can revoke this permission at any time. We do not access contacts without your action.

2) Information collected automatically (Usage & Device Data)

• Technical data: IP address, device and app identifiers, device type/OS, browser or user agent, language, time zone.
• Usage data: pages/screens viewed, features used, session duration, clicks, referring/exit pages, in-app events, diagnostics/crash logs, performance metrics.
• Tracking technologies: Cookies, pixels, and SDKs used for core functionality, analytics, and, where permitted, advertising. You can manage non-essential tracking in your device/app settings or via tools we present.

3) Location information

• Access to and use of the Platform and all Services is conditional upon granting and maintaining precise location permission. If you deny, withdraw, or disable this permission, access to the Platform and all its features will be denied until permission is re-enabled.
• Precise location data associated with your use of the Platform will be retained for no more than 90 days from your last in-app activity and then deleted or anonymized, unless a longer retention period is required by law or is reasonably necessary for security incident response, fraud prevention, or legal compliance.

4) Purchases and payments

• In-app purchases are processed by the Apple App Store or Google Play. We do not receive or store full payment card details. We may receive purchase confirmations/receipts to deliver items, manage subscriptions, and handle support. Billing issues and refunds are handled by the respective Store Provider.
• Payment information is processed by Store Providers under their own privacy policies; we act as data recipient only for receipts, not card details.

5) Information from other sources

• Store Providers (purchase confirmations, not card data).
• Single sign-on/social (e.g., account ID, email) if you choose to use it.
• Service providers/partners (analytics, security, anti-fraud, advertising/measurement where permitted).
• Other users (e.g., when they share or mention your content).
• Public sources/social where information is publicly available to us.

6) Inferences we create

We may derive insights (e.g., likely preferences) from other data we collect and combine them with your Personal Information to personalize and improve the Services.

7) Additional device permissions (feature-dependent, if you enable)

• Camera/Photos (e.g., to upload images).
• Microphone (e.g., for audio features).
• Bluetooth (e.g., to connect accessories).
• Motion sensors (e.g., to enable motion-activated features).
  You can disable any of these at any time in device settings; some features may not function without them.Top of FormBottom of Form

How we use information

We use the information described above to:

• Provide and operate the Services (create/manage accounts, deliver features, process purchases, provide customer support).
• Communicate with you (service/transactional messages, product updates, responses to inquiries).
• Personalize and improve the Services (diagnostics, analytics, testing, research, new feature development).
• Trust & Safety (authentication, fraud/abuse detection and prevention, incident response). We may review or scan content (automated tools and limited human review) to keep the community safe.
• Marketing (emails or in-app messages about products/features - you can opt out anytime).
• Advertising & measurement
  1. Personalized ads only with your consent where required.
  2. Without consent, you may see non-personalized ads (contextual/limited measurement).
• Compliance and enforcement (legal obligations, dispute resolution, enforcing our Terms).
• Aggregation/de-identification (create statistics/insights that do not identify you).
• AI/ML improvement (transparency & choice): we may use de-identified data and feedback to improve features and models. Where required—or upon request—you can opt out via in-app privacy settings or by contacting us.

Automated decision-making & Profiling. We do not make decisions solely by automated means that produce legal or similarly significant effects about you. If this changes, we will notify you and describe your rights. You may object to Profiling where it is unnecessary or excessive for the stated purposes.

Legal bases (where applicable)

Depending on your location, we process Personal Information on:

• Contract (to provide the Services you request).
• Legitimate interests (e.g., security, service improvement, non-personalized advertising/measurement, analytics), balanced against your rights and expectations—you can object at any time.
• Consent (e.g., personalized ads or certain analytics where required—withdraw any time in settings).
• Legal obligation (e.g., record-keeping, lawful requests).
• Vital interests (rare, e.g., safety).

When consent is required, it is explicit, documented, and specific to stated purposes and a defined duration. If we later change the nature/type/purpose of processing, we will obtain new consent first. If a person lacks legal capacity, they are not permitted to access or use the Services. We do not accept parental/guardian consent as a substitute for the minimum age requirement.

Your choices and controls

• App/device permissions: manage camera, photos, microphone, Bluetooth, motion sensors, location, and notifications in your device settings (some features may not work without them). Disabling location permissions will prevent access to the Services and/or Platform.
• Analytics/ads: manage consent/choices in-app (where available). Withholding or withdrawing consent will not affect non-personalized ads.
• Marketing: unsubscribe using the link in our emails or contact us.
• Cookies/SDKs: manage through device/app controls or any consent tools we present.
• Do Not Track / GPC: browser “Do Not Track” isn’t standardized; where Global Privacy Control (GPC) signals are recognized by law, we treat them as an opt-out of targeted advertising for that browser.

Withdrawal of consent will not affect the lawfulness of prior processing, and we will delete or restrict further use of data unless another legal basis applies.

Contact Information

We collect contact details you submit (e.g., name, email, and the content of your messages). We use this to respond to inquiries, verify identity where needed, send service notices, and—if you opt in—send marketing emails (you can unsubscribe at any time).

Account Access Information

When you create an account, we process email and login credentials to create and manage your account, verify your identity, and administer transactions.

If you choose single sign-on (e.g., Google, Apple), we receive your SSO account ID and email to authenticate you. You can unlink SSO with the provider to stop further sharing (some usernames/IDs may not be retrievable afterward).

Data on TheCoolist Platforms (analytics & ads)

We collect data to run and improve the Services (e.g., usage metrics, diagnostics).

• Analytics: Where required, analytics beyond strictly necessary purposes runs with your consent (manage in-app or device settings).
• Advertising: Personalized ads run only with your consent where required. If you withhold/withdraw consent, you may still see non-personalized ads.
• You can withdraw consent at any time in the app’s privacy/settings area; this does not affect the lawfulness of processing before withdrawal.

Purchases and Payments

In-app purchases are processed by the Apple App Store or Google Play. We do not receive or store full payment card details. We may receive purchase confirmations/receipts to deliver items, restore purchases, manage subscriptions, and provide support. For billing or refunds, please contact the relevant Store Provider.

Usage Information

When you use the Platforms, we automatically collect Usage Information, including:

• Technical: internet service provider, device type and OS, app version, browser/user agent, language, time zone, IP address.
• Interactions: pages/screens viewed, features used, session duration, clicks, referring/exit pages, in-app events.
• Diagnostics: performance metrics and crash logs to improve reliability.

Device Identifiers

We and our Service Providers may collect and use device identifiers (e.g., IDFA on iOS, Android Advertising ID, app/device IDs) to administer the app, detect/resolve issues, analyze trends, and, where permitted and with consent, measure advertising. You can reset or limit advertising identifiers in your device settings.

Do Not Track / GPC

Browser “Do Not Track” is not standardized and may not be honored. Where Global Privacy Control (GPC) signals are recognized by applicable law, we treat them as an opt-out of targeted advertising for that browser.

Information from Others

We may receive information about you from:

• Store Providers (purchase confirmations, not card data).
• SSO/Social sign-in (account ID, email) if you choose to use it.
• Service Providers (e.g., analytics, security, anti-fraud, ads/measurement where permitted).
• Other users (e.g., when your content is shared/mentioned).
• Public sources/social (only where information is publicly available to us).

Geolocation Information

With your permission, we may collect precise location via your device to enable location-based features. You can disable this in device settings. We may also infer approximate location from IP for security, localization, and analytics. We do not access background location unless you enable a feature that expressly requires it.
For maps/content, we may use third-party mapping providers (e.g., OpenStreetMap) that collect limited technical data per their policies. Our maps and general place search are powered by OpenStreetMap-based providers. Only the “recommend a place” feature is powered by Google Maps Platform (Places API); when you use that feature, your search text and related technical data are processed by Google under the Google Privacy Policy and the Google Maps/Google Earth Additional Terms of Service.

Use of Personal Information (summary)

We use Personal Information to provide and operate the Services, communicate with you, personalize and improve features, ensure Trust & Safety (spam/abuse detection; incident response), market products (opt-out anytime), serve/measure ads (personalized only with consent where required), comply with law, and to produce aggregated/de-identified insights that do not identify you.

We may also use de-identified data and feedback to improve features and models; where required or upon request, you may opt out via in-app privacy settings or by contacting us.

We do not make decisions solely by automated means that produce legal or similarly significant effects about you. If this changes, we will notify you and explain your rights.

Sharing and Disclosures

We do not share your Personal Information with unrelated third parties for their independent use without your consent, except as described below:

• With your consent. Including sharing with third parties for their own purposes (subject to their privacy notices).
• Service Providers (processors). Hosting, support, analytics, security, payments, messaging—acting on our instructions under written terms.
• Advertising/measurement partners. Where permitted and with your consent for personalized ads; without consent, only non-personalized ads/limited measurement.
• Analytics partners. To understand usage and improve the Services (often via SDKs), with contractual/technical safeguards.
• Legal/safety. To comply with law, respond to legal process, protect our rights/users/public, enforce Terms, or defend legal claims.
• Corporate events. In a reorganization, merger, or sale, under appropriate safeguards.
• Aggregated/de-identified data. Insights that do not identify you.

For transfers/exchanges within Jordan, we obtain your consent where required and keep records of transfers, purposes, and consents. For transfers outside Jordan, we verify the recipient’s protection level before transfer or rely on a legally permitted exception (including your explicit, informed consent), and maintain appropriate records. See International Users & Data Transfer.

We do not sell Personal Information. Where “share” for cross-context behavioral advertising is regulated, we do so only with consent, and you can opt out at any time in-app.

Our Platforms may include social widgets or “share” buttons provided by third parties. Your interactions are governed by those providers’ privacy policies; they may collect information about you or your device when you use those tools.

We take the security and confidentiality of Personal Information seriously. We implement reasonable technical, organizational, administrative, and physical measures designed to protect Personal Information against unauthorized access, disclosure, alteration, loss, or destruction, taking into account the nature of the data and processing risks, in line with applicable laws (including Jordan PDPL) and industry practices.

Security practices

To reduce risks, TheCoolist employs (among other measures):

• Access controls: role-based access, least-privilege, and periodic access reviews.
• Encryption: data in transit (e.g., TLS) and, where appropriate, at rest; secure key management and rotation.
• Logging & monitoring: audit logs for access and changes; anomaly detection.
• Vulnerability & patch management: periodic security testing (e.g., vulnerability scans/pen-tests), timely remediation, and secure configuration baselines.
• Secure development & change control: code reviews, dependency/supply-chain checks, secret management, and change approvals.
• Data minimization & segregation: collecting only necessary data, pseudonymization/de-identification where feasible, and tenant/data segregation.
• Business continuity & disaster recovery: backups, restoration testing, resiliency planning.
• Workforce safeguards: confidentiality obligations, security awareness training, and need-to-know handling.
• Third-party management: due diligence, written data-processing terms, and ongoing oversight of processors/SDKs; processors must follow our instructions and provide equivalent protections.

You are responsible for maintaining the confidentiality of your account credentials. Where available, we recommend enabling two-factor authentication (2FA) and using unique, strong passwords.

Limitations of security

No system is completely secure, and we cannot guarantee absolute security of our systems or those of third parties acting under this Policy, nor that data transmitted over the internet will not be intercepted. Exercise caution when sending Personal Information over email, messaging, or other unsecured channels.

Incident response & breach notification

We maintain an incident response program to investigate, contain, and remediate security incidents.

• Notification to individuals (Jordan PDPL). If we become aware of an incident affecting Personal Information that is likely to cause serious harm, we will notify affected individuals within 24 hours of discovery and provide steps they can take to mitigate potential harm.
• Notification to the supervisory authority (Jordan PDPL). We will notify the competent Unit at the Ministry of Digital Economy and Entrepreneurship within 72 hours of discovery and include available details such as the source and mechanism of the incident, categories of affected data/individuals, and known facts as they develop.
• Other jurisdictions. Where other laws impose additional or different breach-notification requirements, we will comply with those requirements as applicable.

We keep appropriate incident records and, where relevant, will inform you of remediation actions taken.

By using the Services, you agree that we may contact you electronically (e.g., in-app notices, banners, email) regarding security, privacy, and administrative matters related to your use of the Services.

1. EXTERNAL PROCESSING AND DATA STORAGE

Use of Service Providers (processors)

We may transfer Personal Information to our corporate affiliates and trusted Service Providers that process it on our behalf to deliver the Services (e.g., hosting/IT, customer support, payments/messaging, analytics, research/surveys, security/anti-fraud, marketing/measurement). Such processing is performed under written data-protection terms that:

• Process only on documented instructions. Processing is limited to the specified purposes and duration consistent with this Policy and our written instructions.
• Confidentiality & security. Processors must ensure confidentiality, implement appropriate technical and organizational measures proportionate to risk, and provide timely breach notification.
• Sub-processing controls. Sub-processors require our prior authorization; processors must impose equivalent protections and remain fully liable for sub-processors.
• Audit & assurances. Processors will make available all information necessary to demonstrate compliance and will allow for audits/inspections by us or an agreed independent auditor, subject to reasonable confidentiality and security.
• Assistance duties. Processors will assist with data-subject requests, security, breach notifications, DPIAs and, where required, consultations with supervisory authorities.
• Deletion/return. At the end of the engagement, processors will delete or return Personal Information (and certify deletion) unless retention is required by law.
• Transfers. Where processing involves transfer outside Jordan (or outside the EU/UK where applicable), processors must implement lawful transfer mechanisms and document safeguards (see International Users & Data Transfer).

We remain responsible for our processors’ performance as required by law. We maintain Records of Processing Activities (RoPA) and conduct vendor due diligence and periodic reviews. We keep a list of core sub-processors/SDKs (purposes and locations) and will provide advance notice of material changes where required.

Our corporate affiliates may act either as processors (under our instructions) or as independent controllers for their own purposes. Where an affiliate acts as an independent controller, it will provide its own privacy notice.

Data storage & location

Personal Information may be stored and processed on servers in Jordan and in other countries where we or our providers operate. Where data is accessed from or transferred to a country outside Jordan (or outside the EU/UK where applicable), we apply the safeguards described in International Users & Data Transfer, including: protection-level verification, lawful transfer tools (e.g., Standard Contractual Clauses/UK IDTA where applicable), transfer/impact assessments, encryption in transit (e.g., TLS) and, where appropriate, at rest, access controls, key management, pseudonymization/minimization, and transfer logs (recipient, purpose, categories, safeguards). If an adequacy decision is withdrawn or safeguards become ineffective, we will suspend or replace the mechanism or seek your explicit consent.

Remote access to data from another country by a processor or sub-processor is treated as a cross-border transfer and is subject to the same safeguards.

Data retention

We apply the principles of purpose limitation and storage limitation. Retention periods reflect the type/sensitivity of data, legal obligations, user settings/expectations, and operational needs. Where processing relies on consent, we record the duration and do not extend it without new consent.

We retain Personal Information only for as long as necessary to fulfill the purposes described in this Policy or to meet legal, accounting, or reporting obligations, then delete or de-identify it.

• Account data: retained while your account is active; upon deactivation, scheduled for deletion within 90 days (longer if required by law or for legitimate purposes such as fraud prevention or legal holds).
• Usage/diagnostics: typically 12–24 months, then aggregated/de-identified.
• Consent logs: retained for compliance (e.g., up to 5 years from withdrawal, where required).
• Security logs: retained for a limited period (e.g., 12–24 months) to investigate and prevent abuse.
• Purchase/subscription records: retained per tax/accounting law (usually 5–10 years, depending on jurisdiction).
• Local-only use (no account): certain data may remain on your device until you delete the app or clear storage.

Residual copies in encrypted backups are overwritten on rolling schedules (typically within ≤90 days) unless a legal hold or regulatory obligation requires longer retention.

Where feasible, we aggregate or de-identify data and may retain such non-personal information indefinitely.

We require our processors to align retention with our documented instructions, including deletion or return at the end of their engagement.

Notifications (push)

Some apps allow push notifications. We process a device token (provided by your platform) to deliver them. You can enable/disable push at any time in device or in-app settings. Tokens are retained while enabled and deleted when you unsubscribe, disable notifications, change devices, or uninstall.

Push tokens are used solely to deliver notifications and are not used for targeted advertising without your opt-in consent where required.

Children and rankings

Our Services are not intended for children or any person under the minimum age stated in Section IV (Children’s Privacy). We do not knowingly collect, process or publish children’s names, rankings, or virtual items.

1. CHILDRENS PRIVACY

The Services are not directed to children under the minimum age of legal capacity in their country of residence. In Jordan, this is under 18 full calendar years. Where local law sets a higher or different standard, we apply the highest applicable standard based on the User’s location.

Users under the age of 18, or the applicable minimum age in any jurisdiction if higher, are not permitted to access or use the Services. We do not knowingly collect, use, or disclose a Child’s Personal Information or for individuals below the minimum legal age. If we discover that such information has been collected, we will take steps to delete the account and any related data.

If a user indicates they are a Child during sign-up, we will take the necessary steps to delete the account and any related data. We do not provide children’s accounts, and we do not seek or rely on parental or guardian consent to allow children to access the Services.

We may amend this Children’s Privacy section to reflect legal or operational changes. The “Last Updated” date at the top of this Policy will be revised accordingly.

1. INTERNATIONAL USERS AND DATA TRANSFER

We and our Service Providers may process Personal Information in Jordan and in other countries. Remote access to data from another country is treated as a cross-border transfer. Some locations may have privacy laws that differ from (and may be less protective than) those of your country of residence.

Cross-border transfers

We do not transfer Personal Information outside Jordan if the destination provides a lower level of protection than Jordan’s PDPL, except where permitted by law, including:

• Judicial cooperation under treaties/agreements in force;
• International/regional cooperation with bodies combating crime;
• Medical necessity for the data subject’s treatment;
• Public-health matters (e.g., epidemics or disasters);
• Your explicit, informed consent after being told that the destination may lack adequate protection;
• Banking operations and money transfers.

Before any transfer, we verify the protection level of the destination and apply appropriate safeguards, including encryption (in transit and at rest), access controls, minimization and pseudonymization, transfer impact assessments, and written contractual terms. If a country is designated as adequate by the competent Jordanian authority, we rely on that adequacy determination. If safeguards fail or adequacy is withdrawn, we will suspend the transfer unless you provide new explicit consent.

Where EU or UK law applies, we rely on the mechanisms authorized under GDPR Chapter V (e.g., adequacy decisions, Standard Contractual Clauses, or the UK International Data Transfer Agreement).

You may request a copy or summary of the relevant safeguards used for your Personal Information. For security and confidentiality, we may redact commercially sensitive terms.

We process Personal Information in accordance with Jordan’s Personal Data Protection Law No. 24 of 2023 (PDPL) and, where applicable, the EU/UK GDPR and other regional regulations. We will align with adequacy lists and guidance issued by the Jordanian Ministry of Digital Economy and Entrepreneurship or other competent authorities.

1. DATA RETENTION

We apply the principles of purpose limitation and storage limitation. We keep Personal Information only for as long as necessary to fulfill the purposes described in this Policy (e.g., providing the Services, complying with law, resolving disputes, enforcing agreements) and then delete or anonymize it (anonymization means irreversibly removing identifiers so the data is no longer Personal Information).

We set retention by considering: (i) the type and sensitivity of the data; (ii) the purposes of processing; (iii) legal, tax, audit, and regulatory requirements; (iv) applicable statutes of limitation and our need to establish, exercise, or defend legal claims; (v) your expectations and settings (including consent duration for consent-based processing, which we record and do not extend without new consent); and (vi) where the data resides (active systems vs. backups/logs). Encrypted backups are overwritten on rolling schedules, subject to legal holds.

We may retain aggregated/de-identified information that no longer identifies you. Where Personal Information was used to improve features or models, we retain only non-personal (de-identified) data after deletion; new training runs exclude your identifiable data.

We require our Service Providers (processors) to delete or return Personal Information at the end of their engagement or after the applicable retention period, to align their retention with our instructions and legal obligations, and to certify deletion upon completion unless law requires further retention.

You can request deletion in-app or by contacting us (see Contact). We will erase or restrict your Personal Information unless retention is required by a valid legal basis (e.g., legal obligation, establishment/exercise/defense of legal claims, fraud prevention, or compliance record-keeping). Where we rely on such an exception, we will minimize and restrict access to retained data. A summary of our retention criteria/schedules is available upon request.

1. YOUR RIGHTS

You have rights over your Personal Information. Many settings are available any time in Settings → Privacy / Edit Profile. For other requests, contact us at support@thecoolist.io

How to exercise your rights.

Send us: (i) your name; (ii) the email used on your account; (iii) the right you wish to exercise; (iv) your country of residence; and (v) enough detail to help us locate your data. We may take reasonable steps to verify your identity (e.g., email confirmation, device checks, limited ID match). We use verification information only to process your request and retain it no longer than necessary.

Your rights (subject to applicable law):

• Right to be informed. Receive clear information about our processing, including purposes, legal bases, categories, recipients, cross-border transfers/safeguards, and retention.
• Access. Obtain confirmation whether we process your data and receive a copy, along with required information about our processing.
• Rectification. Correct inaccurate or incomplete data.
• Erasure. Request deletion where the law allows (e.g., data no longer needed; consent withdrawn where no other legal basis; unlawful processing). We will erase or restrict unless an exception applies.
• Restriction. Request that we limit processing in certain cases (e.g., while accuracy or an objection is assessed).
• Objection. Object to processing based on our legitimate interests; we will stop unless we demonstrate compelling legitimate grounds. Direct marketing: you may object at any time, and we will stop.
• Portability. Receive Personal Information you provided to us in a structured, commonly used, machine-readable format and (where technically feasible) have it transmitted to another controller where processing is based on consent or contract and carried out by automated means.
• Withdraw consent. Where we rely on consent (e.g., personalized ads, certain analytics), you may withdraw it at any time in settings; this does not affect processing that occurred before withdrawal.
• Information about sources. Where we did not obtain data from you directly, request information about the source of the data, to the extent permitted by law.
• Transfer safeguards. Request a copy or summary of the safeguards used for cross-border transfers (e.g., SCCs/UK IDTA or PDPL-compliant mechanisms). Commercial terms may be redacted.
• Automated decision-making. We do not make decisions solely by automated means that produce legal or similarly significant effects about you. If this changes, you will have the right to request human review, to express your point of view, and to contest the decision.

Cookies, SDKs, and ads controls.

• Consent manager (where provided): Accept, reject, or adjust non-essential Cookies/SDKs by category at any time. Choices apply per browser and device and may reset if you clear cookies or change devices.
• Device settings: Manage app permissions (camera, photos, microphone, Bluetooth, motion sensors, location) and push notifications in your OS settings.
• Ad preferences: Personalized ads run only with your consent where required; withdrawing consent stops data collection/sharing for that purpose. You may still see non-personalized (contextual) ads. Mobile controls: iOS (“Allow Apps to Request to Track”), Android (Ads settings → Reset/opt-out of Ad ID).
• Browser signals: “Do Not Track” is not standardized. Where Global Privacy Control (GPC) is recognized by law, we treat it as an opt-out of targeted advertising for that browser.

Timing, verification, and limits.

We aim to respond within 30 days of receipt and verification. For complex or multiple requests, we may extend once (up to an additional 30 days); we will notify you of the extension and reasons. Requests are free of charge, except we may refuse or charge a reasonable fee where a request is manifestly unfounded or excessive. We may deny or limit a request where doing so would infringe the rights and freedoms of others, reveal trade secrets or intellectual property, conflict with legal obligations, or impair fraud prevention/security. If we decline or limit a request, we will provide a brief explanation and how to challenge the decision.

SSO unlinking.

If you used single sign-on (e.g., Google, Apple), you may unlink it with the provider to stop further sharing. Some usernames/IDs may not be retrievable afterward. We will delete SSO-derived data we no longer need or have a basis to retain.

Complaints.

You may lodge a complaint with a competent data-protection authority in your place of residence or where an alleged infringement occurred. We would appreciate the chance to address your concerns first, please contact us at support@thecoolist.io

1. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time to reflect legal, technical, or business developments. If we make material changes, we will provide appropriate notice (e.g., in-app or browser banner, email, or a prominent notice on the Platform) and update the “Last Updated” date at the top of this Policy.

Where the change would alter the nature, type, purposes, or duration of processing in a way that requires consent (e.g., new categories of data, new Profiling, extended retention, or new cross-border transfers), we will request and document your new consent before applying those changes to you. If you do not provide consent, we will not apply the changed processing to your data unless another lawful basis applies.

Unless stated otherwise in our notice, updates become effective when posted. Your continued use of the Services after the effective date constitutes acceptance of the updated Policy (without prejudice to any consent required by law).

We will not reduce your rights under this Policy retroactively or in a manner that conflicts with applicable law. If you disagree with an update, you may stop using the Services and request account deletion and data erasure as described in Section VII (Your Rights).

This Privacy Policy forms part of, and should be read together with, our Terms and Conditions. If there is a conflict between this Policy and the Terms regarding privacy or data protection, this Policy controls.

1. GOVERNING LAW

This Privacy Policy, and any dispute or claim arising out of or in connection with it or the Services, is governed by the laws of the Hashemite Kingdom of Jordan.

The courts of Amman (Palace of Justice) shall have jurisdiction to settle any such dispute or claim.

If any provision in this Section is found unenforceable, the remainder will continue in full force and effect.

1. CONTACT

If you wish to access, correct, update, delete, or exercise any rights in relation to your Personal Information, or if you have questions about this Privacy Policy or our privacy practices, please contact us:

• Email (privacy): support@thecoolist.io
• Data Protection Officer / Privacy Contact (if appointed): [support@thecoolist.io]

We aim to respond within 90 days and may extend once where permitted due to complexity or volume. Please do not include sensitive information in unencrypted emails.

Submitting a rights request (helps us verify your identity): include (i) your full name, (ii) the email associated with your account, (iii) the country of residence, and (iv) the right you wish to exercise (e.g., access, deletion, objection).