Privacy Policy

Last updated: 15 May 2026

This Privacy Policy describes how Gala ("we", "our", "us") collects, uses, stores, and protects your personal information when you use the Gala mobile applications and related services (collectively, the "Service"). Gala is a wedding planning marketplace operating in the Kingdom of Bahrain.

We are committed to handling your personal data in accordance with the Bahrain Personal Data Protection Law (Law No. 30 of 2018) ("PDPL") and Google Play developer requirements.

1. Who we are

The data controller is the operator of Gala, based in the Kingdom of Bahrain. If you have any questions or wish to exercise your rights under this policy, contact us at moohammedmohsen@gmail.com.

2. Information we collect

We collect only the information needed to provide and improve the Service.

Information you give us directly

• Account information: your phone number, name, and (optionally) email address, used to sign you in via one-time SMS code and identify you in the app.
• Wedding profile: the bride and groom's names, wedding date, event type (wedding, engagement, milcha, etc.), wedding hashtag, target budget, and other planning details you enter.
• Guest list: names, phone numbers, and email addresses you add for your guests, plus their RSVP status.
• Family members: phone numbers and names of family members you invite to collaborate on your wedding planning.
• Booking and payment records: the services you book, deposit amounts, and payment confirmations (we do not store credit card numbers — payments flow through external systems such as BenefitPay or bank transfer).
• Photos and uploads: images you upload to your moodboard, inspiration board, or wedding albums.
• Communications: messages you exchange with vendors through our in-app chat, and any support requests you send to us.
• Reviews and ratings: reviews you leave for vendors after a completed booking.

Information collected automatically

• Device information: device model, operating system version, app version, and a unique device identifier — used to deliver push notifications and diagnose technical issues.
• Usage data: screens you view, features you use, and timestamps of interactions — used to improve the Service.
• Push notification token: a token issued by Apple or Google so we can send you booking confirmations, vendor replies, and reminders.

What we do not collect

• We do not collect precise location data (GPS).
• We do not collect contacts from your phone's address book.
• We do not collect microphone, camera, or photo library data beyond the specific files you choose to upload.
• We do not use third-party advertising trackers or behavioural advertising networks.

3. How we use your information

We process your personal data for the following purposes:

• To create and manage your Gala account.
• To match you with relevant halls and vendors based on your event type, date, and budget.
• To process bookings, payments, and confirmations between you and vendors.
• To send you booking confirmations, vendor messages, RSVPs, and wedding-day reminders via push notification or SMS.
• To enable in-app chat between brides, family members, and vendors.
• To respond to your support requests and resolve disputes.
• To improve the Service through aggregated, anonymous usage analytics.
• To comply with our legal obligations under Bahraini law.

4. Legal basis for processing (PDPL Article 4)

Under the PDPL, we process your data on the following lawful bases:

• Consent: you actively consent to data processing when you create an account.
• Contract performance: processing is necessary to provide the wedding planning services you request.
• Legitimate interests: for fraud prevention, service improvement, and security — provided these do not override your rights.
• Legal obligation: where we are required to retain records by Bahraini law.

5. Who we share your information with

We share your data only when necessary to provide the Service or comply with the law. We do not sell your data to anyone.

• Vendors and halls: when you book or message a vendor, we share your name, contact details, and booking information with that vendor so they can fulfil the service.
• Family members you invite: the family members you add to your wedding can see your wedding profile, bookings, and guest list.
• Service providers: we use third-party infrastructure providers to host and operate Gala:
  • Railway (cloud hosting, United States) — application servers and database.
  • Expo (United States) — over-the-air updates and push notification delivery.
  • Google Firebase Cloud Messaging and Apple Push Notification Service — push notification routing.
• Legal and safety: we may disclose your information to authorities if required by Bahraini law, court order, or to protect rights, safety, and property.

6. International transfers

Some of our service providers are located outside Bahrain (primarily in the United States). When we transfer your personal data internationally, we ensure appropriate safeguards are in place, including contractual data protection terms and compliance with the PDPL's cross-border transfer requirements.

7. Data retention

• Active accounts: we keep your data for as long as your account is active.
• Closed accounts: if you delete your account, we permanently remove your personal data within 30 days, except where we are required to retain certain records (e.g. financial records under Bahraini commercial law, typically 5 years).
• Booking records: we retain booking and payment records for 5 years after the booking date for legal, tax, and dispute resolution purposes.
• Anonymous analytics: aggregated, anonymised data may be retained indefinitely.

8. Your rights (PDPL Articles 14–22)

Under the Bahrain PDPL, you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Delete your data (subject to legal retention requirements).
• Object to certain types of processing.
• Withdraw consent at any time where processing is based on consent.
• Receive a copy of your data in a portable format.
• Lodge a complaint with the Personal Data Protection Authority of Bahrain.

To exercise any of these rights, email us at moohammedmohsen@gmail.com. We will respond within 30 days.

9. Security

We use industry-standard measures to protect your data, including:

• HTTPS encryption for all communications between the app and our servers.
• Encrypted storage of authentication tokens on your device (Apple Keychain / Android Keystore).
• Password-hashed admin accounts using bcrypt.
• Database access restricted to authorised personnel only.
• Regular security updates to our infrastructure.

However, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security.

10. Children

Gala is not directed to children under 18. We do not knowingly collect personal data from anyone under 18. If you become aware that a child has provided us with personal information, please contact us so we can delete it.

11. Cookies and tracking

The Gala mobile application does not use cookies. We do not engage in cross-site or cross-app tracking, and we do not use third-party advertising trackers.

12. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will:

• Update the "Last updated" date at the top of this page.
• Notify you through the app if the changes are material.
• Where required by the PDPL, request your renewed consent.

13. Contact us

If you have questions, concerns, or requests regarding this Privacy Policy or your personal data:

• Email: moohammedmohsen@gmail.com
• Kingdom of Bahrain

You also have the right to contact Bahrain's Personal Data Protection Authority directly if you believe your rights have been violated.