Privacy Policy

If you upload a document: the file itself, and the commercial fields read from it — item description, unit rate, unit, quantity, scope, document date and the supplying company. We also record the file name, size, type and the time of upload.

If you hold an account: your email address, a hashed password (never the password itself) and, if you set one, a display name.

If you submit a price or comment: what you wrote and which account wrote it.

You can upload without an account. An anonymous upload is not linked to any user, and we do not attempt to identify who sent it.

The original file is stored only long enough to read it. 3 hours after upload it is permanently deleted from storage by an automatic job — not archived, not moved, not retained for backup.

What remains afterwards is the structured commercial data extracted from it, plus a record that a document of that name and type was processed. The file is never published, never shown to other users, and never available for download outside the administrator interface during that window.

Only the market data: the item, the rate, the unit, the scope, the emirate and the date of the observation. These appear as one anonymous observation among others on a rate page.

We extract commercial fields, not people. Names, phone numbers, email addresses, project references and delivery addresses printed on a document are not extracted into the published catalogue.

The supplying company's name is published only if the uploader chooses to show it. If it is hidden, it is used internally — to detect duplicate evidence, to measure how many independent sources support a figure, and to weigh trust — and is never shown on a public page, in search or through the API.

Running the service requires a small number of providers, each of which may process the data described above on our behalf:

• Google — the AI model that reads the document. Document content is sent to it for extraction.
• Supabase — database and file storage. Data is held on infrastructure located in India.
• Vercel — hosting and delivery of the website.
• Cloudflare — the anti-abuse check shown on anonymous uploads.
• Inngest — schedules the background processing and deletion jobs.
• Resend — sends account emails such as verification and password reset.

Because storage is located in India, uploading means your data is transferred outside the UAE.

Uploaded files: 3 hours, then deleted.

Extracted market data: kept indefinitely. A price database is only meaningful if the evidence behind a figure remains; observations older than twelve months stop influencing the current market figure but stay visible as history.

Account data: kept while the account exists.

Deleting your account removes your identity from the service: your email address and display name are erased and your stored credentials are destroyed. You can no longer sign in, and nothing on the site identifies you.

Market observations you contributed remain, unattributed. They are evidence other people's figures are calculated from, and removing them would silently change prices that others have already relied on.

You can ask what we hold about you, ask for it to be corrected, or ask us to remove a document you uploaded in error — including before the 3-hour window elapses.

Write to admin@sibris.ae.

Terms of Use sets out the rules for uploading documents and posting comments. Methodology explains how a market figure is calculated.