Privacy, in full transparency.

Data controller

SAEI is the Data Controller for your personal data in its relationship with you as a customer or a visitor. A designated Data Protection Officer (DPO) handles privacy enquiries — contact: privacy@automize.sa.

The data we collect

• Contact data (name, email, mobile, business name) — when you get in touch or register.
• Anonymised usage data (pages visited, browser type) — for analytics only.
• Operational data (conversations, campaigns, contacts) — data necessary to deliver the service under the contract.
• Billing data (legal name, tax number, billing address) — as required by the Zakat, Tax and Customs Authority.

Lawful basis for processing

• Performance of your subscription contract — for all operational data.
• Explicit consent — for optional marketing communications.
• A specified legitimate interest — for improving the service and detecting fraud.
• Legal obligation — for retaining tax records and invoices.

How we use data

We use data solely to deliver the service, improve it, issue invoices and communicate with our customers. We do not sell data to any third party. We do not share your data with external advertising or marketing parties under any circumstances.

Google API Services User Data Policy

When you connect your account to Google services — such as Google Calendar, Gmail or Drive — we receive only the permissions you grant, and we use that information solely to operate the feature you asked for. Saei's use and transfer of information received from Google APIs to any other app will adhere to Google API Services User Data Policy, including the Limited Use requirements. The policy referred to is published at developers.google.com/terms/api-services-user-data-policy.

AI and Google user data

Saei does not use data received from Google Workspace APIs — such as Gmail, Google Calendar, Drive or Sheets — to develop, improve or train generalized artificial intelligence or machine learning models, and does not transfer that data to any third party that does. When an AI feature you enable processes such data, we send it only to AI services that are configured not to retain it or train on it.

Your rights under the PDPL

• The right to be informed: to know that your data is processed and for what purposes.
• The right of access: to obtain a copy of your data in a readable format.
• The right to rectification: to have inaccurate or incomplete data corrected.
• The right to erasure: to have your data deleted once it is no longer needed.
• The right to restrict or object to processing on legitimate grounds.
• The right to port your data to another provider in a machine-readable format.
• The right to withdraw consent at any time, without affecting the lawfulness of processing carried out before.
• The right to lodge a complaint with the Saudi Data and AI Authority (SDAIA) at sdaia.gov.sa.

How to exercise your rights

To exercise any of the rights above, send a request through the Data Subject Request (DSR) form on the "Contact us" page, or write to privacy@automize.sa. We will respond within 30 days as the PDPL requires, and we may ask you to verify your identity before we act on the request.

Retention periods

• Operational data (conversations, campaigns): for as long as you are an active customer, then deleted within 90 days of the subscription ending.
• Billing data and tax invoices: 10 years, as the Zakat authority requires.
• Sign-in and security audit logs: 18 months.
• Anonymised analytics data: not linked to an identity, and may be retained in fully anonymised form.

Transfers outside the Kingdom

Your operational data is held in data centres inside the Kingdom of Saudi Arabia. Some component services (Meta infrastructure, email, the Cloudflare CDN) may process data abroad under approved contractual safeguards (Standard Contractual Clauses) and security guarantees equivalent to the PDPL standard. Any transfer follows an impact assessment and observes SDAIA Resolution No. 102.

Data breach notification

If a breach affects your personal data, we will notify SDAIA within 72 hours of discovering the incident, and notify you directly if the breach poses a high risk to your rights or freedoms. Notifications cover: the nature of the breach, the data affected, the steps taken, and what you should do.

Children's data

The service is intended for businesses. We do not knowingly collect data from children under 18. If we discover that we have collected a minor’s data without parental consent, we delete it immediately.

Marketing consent

We do not send you marketing communications without your explicit consent. You can withdraw that consent at any time through the "unsubscribe" link in every message, from your account settings, or by writing to privacy@automize.sa.

Technical security

• Full encryption in transit over TLS 1.3 for every connection.
• Encryption at rest (AES-256) for stored data.
• Strict access controls with tiered permissions and two-factor authentication for staff.
• Regular security reviews and annual penetration testing.
• A complete audit trail for every access to sensitive data.

Permitted use

The platform is for registered, legally licensed Saudi businesses. You must obtain your contacts’ consent before sending any WhatsApp message — this is a legal requirement, not a suggestion.

Prohibited use

• Sending content that infringes others' rights or intellectual property.
• Sending marketing messages to anyone who has not given explicit opt-in consent.
• Attempting to breach or disrupt the platform in any way.
• Using the platform for fraudulent, deceptive or unlawful activity.
• Misusing WhatsApp to send prohibited content (gambling, pharmaceuticals, weapons, or anything contrary to the laws of the Kingdom).
• Sharing sign-in credentials with unauthorised parties.

Customer responsibility

The customer (a joint controller in PDPL terms) is responsible for: the content of their messages, obtaining contacts’ consent, honouring unsubscribes, observing the permitted sending hours, and not sending content that breaches the law. SAEI provides the technical tools and technical safeguards, but responsibility for legal compliance rests first and foremost with the customer.

Disclaimer and limitation of liability

The service is provided "as is" with the highest guarantees available in this market. Our maximum contractual liability does not exceed the total you paid in the 12 months preceding any claim. We are not liable for indirect, incidental or consequential losses.

Termination

Either party may end the contractual relationship on 30 days’ written notice. On termination: your data is exported to you in a portable format within 30 days, and is subsequently deleted in line with the retention policy. Serious breaches may result in immediate termination.

Governing law and dispute resolution

These terms are governed by the laws of the Kingdom of Saudi Arabia. Any dispute is first resolved amicably; failing that, jurisdiction lies with the competent Saudi courts in Riyadh.

Governing language

This English text is a translation provided for convenience. The Arabic version of these policies is the authoritative one, and in the event of any discrepancy between the two, the Arabic prevails.

The cookies we use

• Session cookies only, to keep you signed in inside the dashboard.
• A language preference cookie (your Arabic/English choice).
• Cookieless analytics (PostHog, with privacy built in) to measure page usage anonymously.
• No tracking cookies, no advertising cookies, no third-party cookies on the marketing pages.

Controlling cookies

You can disable cookies in your browser settings — this may affect some dashboard features, but it does not affect your browsing of the marketing site.

In short

• Your subscription renews automatically and the new period is charged to your saved card unless you cancel before the renewal date.
• You can cancel at any time from inside the platform, with no fee, and it takes effect at the end of the paid period.
• A pro-rata refund on the annual and two-year plans within the first 14 days, on request.

The full terms

Read the cancellation and refund policy at /refund-policy — that page is the reference, and this is a summary of it.