Privacy, in full transparency.

Data controller

SAEI is the Data Controller for your personal data in its relationship with you as a customer or a visitor. A designated Data Protection Officer (DPO) handles privacy enquiries — contact: privacy@automize.sa.

The data we collect

• Contact data (name, email, mobile, business name) — when you get in touch or register.
• Anonymised usage data (pages visited, browser type) — for analytics only.
• Operational data (conversations, campaigns, contacts) — data necessary to deliver the service under the contract.
• Billing data (legal name, tax number, billing address) — as required by the Zakat, Tax and Customs Authority.

Lawful basis for processing

• Performance of your subscription contract — for all operational data.
• Explicit consent — for optional marketing communications.
• A specified legitimate interest — for improving the service and detecting fraud.
• Legal obligation — for retaining tax records and invoices.

How we use data

We use data solely to deliver the service, improve it, issue invoices and communicate with our customers. We do not sell data to any third party. We do not share your data with external advertising or marketing parties under any circumstances.

Your rights under the PDPL

• The right to be informed: to know that your data is processed and for what purposes.
• The right of access: to obtain a copy of your data in a readable format.
• The right to rectification: to have inaccurate or incomplete data corrected.
• The right to erasure: to have your data deleted once it is no longer needed.
• The right to restrict or object to processing on legitimate grounds.
• The right to port your data to another provider in a machine-readable format.
• The right to withdraw consent at any time, without affecting the lawfulness of processing carried out before.
• The right to lodge a complaint with the Saudi Data and AI Authority (SDAIA) at sdaia.gov.sa.

How to exercise your rights

To exercise any of the rights above, send a request through the Data Subject Request (DSR) form on the "Contact us" page, or write to privacy@automize.sa. We will respond within 30 days as the PDPL requires, and we may ask you to verify your identity before we act on the request.

Retention periods

• Operational data (conversations, campaigns): for as long as you are an active customer, then deleted within 90 days of the subscription ending.
• Billing data and tax invoices: 10 years, as the Zakat authority requires.
• Sign-in and security audit logs: 18 months.
• Anonymised analytics data: not linked to an identity, and may be retained in fully anonymised form.

Transfers outside the Kingdom

Your operational data is held in data centres inside the Kingdom of Saudi Arabia. Some component services (Meta infrastructure, email, the Cloudflare CDN) may process data abroad under approved contractual safeguards (Standard Contractual Clauses) and security guarantees equivalent to the PDPL standard. Any transfer follows an impact assessment and observes SDAIA Resolution No. 102.

Data breach notification

If a breach affects your personal data, we will notify SDAIA within 72 hours of discovering the incident, and notify you directly if the breach poses a high risk to your rights or freedoms. Notifications cover: the nature of the breach, the data affected, the steps taken, and what you should do.

Children's data

The service is intended for businesses. We do not knowingly collect data from children under 18. If we discover that we have collected a minor’s data without parental consent, we delete it immediately.

Marketing consent

We do not send you marketing communications without your explicit consent. You can withdraw that consent at any time through the "unsubscribe" link in every message, from your account settings, or by writing to privacy@automize.sa.

Technical security

• Full encryption in transit over TLS 1.3 for every connection.
• Encryption at rest (AES-256) for stored data.
• Strict access controls with tiered permissions and two-factor authentication for staff.
• Regular security reviews and annual penetration testing.
• A complete audit trail for every access to sensitive data.

Permitted use

The platform is for registered, legally licensed Saudi businesses. You must obtain your contacts’ consent before sending any WhatsApp message — this is a legal requirement, not a suggestion.

Prohibited use

• Sending content that infringes others' rights or intellectual property.
• Sending marketing messages to anyone who has not given explicit opt-in consent.
• Attempting to breach or disrupt the platform in any way.
• Using the platform for fraudulent, deceptive or unlawful activity.
• Misusing WhatsApp to send prohibited content (gambling, pharmaceuticals, weapons, or anything contrary to the laws of the Kingdom).
• Sharing sign-in credentials with unauthorised parties.

Customer responsibility

The customer (a joint controller in PDPL terms) is responsible for: the content of their messages, obtaining contacts’ consent, honouring unsubscribes, observing the permitted sending hours, and not sending content that breaches the law. SAEI provides the technical tools and technical safeguards, but responsibility for legal compliance rests first and foremost with the customer.

Disclaimer and limitation of liability

The service is provided "as is" with the highest guarantees available in this market. Our maximum contractual liability does not exceed the total you paid in the 12 months preceding any claim. We are not liable for indirect, incidental or consequential losses.

Termination

Either party may end the contractual relationship on 30 days’ written notice. On termination: your data is exported to you in a portable format within 30 days, and is subsequently deleted in line with the retention policy. Serious breaches may result in immediate termination.

Governing law and dispute resolution

These terms are governed by the laws of the Kingdom of Saudi Arabia. Any dispute is first resolved amicably; failing that, jurisdiction lies with the competent Saudi courts in Riyadh.

Governing language

This English text is a translation provided for convenience. The Arabic version of these policies is the authoritative one, and in the event of any discrepancy between the two, the Arabic prevails.

The cookies we use

• Session cookies only, to keep you signed in inside the dashboard.
• A language preference cookie (your Arabic/English choice).
• Cookieless analytics (PostHog, with privacy built in) to measure page usage anonymously.
• No tracking cookies, no advertising cookies, no third-party cookies on the marketing pages.

Controlling cookies

You can disable cookies in your browser settings — this may affect some dashboard features, but it does not affect your browsing of the marketing site.

Automatic cancellation

• Monthly subscriptions: remain active until the end of the current billing cycle and do not renew automatically after cancellation.
• Annual and two-year subscriptions: a pro-rata refund for unused days, within the first 14 days.
• After 14 days: no automatic refund, but you keep every feature of your plan until the end of the paid term.

Refunding Meta conversation credit

Credit paid to Meta for WhatsApp messages is not refundable by them. You can use it in full before your subscription ends.