Effective [EFFECTIVE DATE - on counsel sign-off] · Last updated 15 June 2026 · v2026-06-14
This policy explains what personal data we collect, why, how we use and share it, how long we keep it, and the rights you have. It applies to the Young Leaders Society web and mobile applications and related services, for users aged 18+.
Young Leaders Society is owned and operated by Tabby & Co Pvt. Ltd., a company registered in Pakistan with its registered office at [REGISTERED ADDRESS, Islamabad, Pakistan]. Tabby & Co Pvt. Ltd. is the data controller for personal data processed through the platform. For any privacy question or to exercise your rights, contact [PRIVACY CONTACT EMAIL].
Information you provide: name; email; phone/WhatsApp number; city and region; academic institution; organisation/employer; profile photo; social-media handles; areas of interest; and any content you add (contributions, chat messages, feed posts, uploaded media).
Account and authentication: if you sign in with Google, we receive a stable account identifier, your email, your name, and your profile picture.
Membership data: your chapter/zone/national placement, role, and recognition/contribution records.
Technical and usage data: device and browser information, IP address, log data, and interactions with the platform, collected via cookies and similar technologies.
We process personal data to: create and manage your membership account (performance of a contract); operate community features such as the directory, chat, feed, recognition, and public profiles (contract and legitimate interests); communicate with you, including notifications (contract, legitimate interests, or consent where required); maintain safety, security, and integrity (legitimate interests and legal obligation); and comply with applicable law (legal obligation). Where we rely on consent, you may withdraw it at any time. We do not sell your personal data.
We share personal data with service providers who process it on our behalf under appropriate safeguards, which currently include: Supabase (database, authentication, file storage); Google (Sign in with Google); Vercel (application hosting + CDN); n8n (AI assistant chat workflow, and its downstream AI/LLM provider, which process the messages and member context you send in the in-app assistant); [EMAIL / SMTP PROVIDER - confirm]; [ANY ANALYTICS / VIDEO / MESSAGING PROVIDER - add if used]. We may disclose data where required by law or to protect the rights, safety, and security of our members and the organisation. (This list is verified against the actual stack before publishing privacy labels.)
Our service providers may process data on servers located outside Pakistan. Where data is transferred internationally, we take reasonable steps to ensure it is protected consistent with this policy and applicable law.
We keep personal data for as long as your account is active and for a reasonable period afterwards, then delete or anonymise it, except where longer retention is required for security, fraud prevention, dispute resolution, or legal/regulatory obligations. See our Account & Data Deletion Policy for how deletion works.
We use technical and organisational measures - including access controls and row-level security - to protect personal data. No system is perfectly secure; please use a strong, unique password and keep your credentials private.
Subject to applicable law, you may request to access, correct, delete, restrict, or port your personal data, and to object to certain processing or withdraw consent. You can exercise many of these directly in the app (editing your profile, controlling field visibility, deleting your account) or by contacting [PRIVACY CONTACT EMAIL]. If you are in a jurisdiction with a data-protection authority, you may also lodge a complaint with it.
YLS is intended for users aged 18 and over. We do not knowingly collect personal data from anyone under 18; if we learn we have, we will delete it. See our Child Safety Standards.
We process personal data in accordance with applicable Pakistani law, including the Prevention of Electronic Crimes Act, 2016, and we will comply with Pakistan’s Personal Data Protection legislation once enacted. For members outside Pakistan, we apply data-protection practices consistent with international standards (including GDPR-style data-subject rights).
We may update this policy and will post the updated version with a new “last updated” date; for material changes we will notify you and seek renewed acceptance where required.
Tabby & Co Pvt. Ltd., [REGISTERED ADDRESS, Islamabad, Pakistan]. Privacy: [PRIVACY CONTACT EMAIL]. General: [CONTACT EMAIL].