Privacy Policyسياسة الخصوصية

Introduction

This Privacy Policy explains how Deerah collects, uses, and protects personal data on this website. It is prepared in line with the Personal Data Protection Law of the Kingdom of Saudi Arabia (the PDPL), issued by Royal Decree No. M/19 of 1443H, as amended, together with its Implementing Regulations. The competent supervisory authority is the Saudi Data and Artificial Intelligence Authority (SDAIA).

Who We Are

The controller of the personal data described in this policy is Deerah Digital Transformation Establishment, trading as Deerah, Commercial Registration No. 7053790809, registered in the Kingdom of Saudi Arabia. Deerah provides AI services to businesses, including AI agents, workflows, and operations automation.

For any question about this policy, contact us at contact@deerah.ai or on +966 59 427 7872.

Personal Data We Collect and Its Sources

We collect very little, and only what you choose to send us. The sources are described below.

Contact form

The website includes a contact form for discovery requests. The form collects the details you enter: your name, business name, phone number, email address, and your message. When you submit it, those details are transmitted to us by email through Web3Forms (operated by Web3Creative), a form delivery service that acts as our processor for this purpose and passes the submission to contact@deerah.ai.

Where that goes, in full. Web3Forms operates outside the Kingdom and, according to its own data processing agreement, stores submissions for up to three years and uses the following sub-processors: Amazon Web Services and Hetzner (hosting), Cloudflare (network), and CleanTalk and Akismet (spam filtering). The two spam-filtering services receive the sender's IP address and email address. We have chosen this service for its simplicity while our website is new, and we are working to move form handling inside the Kingdom. If you would rather not use it, you can contact us directly at contact@deerah.ai or on +966 59 427 7872, and nothing you send that way passes through any form service.

A second button on the form prepares the same enquiry in WhatsApp instead, if you prefer that channel; WhatsApp is operated by Meta, outside the Kingdom, under its own terms. If the delivery service cannot be reached, the form falls back to preparing the message in your own email application, and nothing is sent until you send it yourself.

Direct communication

If you contact us by email or WhatsApp, we receive the contact details and message content you choose to send, and we keep that correspondence. WhatsApp is operated by an independent provider, and its own terms and privacy policy apply to your use of it.

Hosting access logs

The website is served from standard web hosting. As with most web servers, the hosting servers keep ordinary access logs. These may include your IP address, the date and time of each request, the pages requested, and basic browser information. We use these logs only for security and to keep the site running.

Language preference

The website stores exactly one item in your browser's localStorage: your language preference, English or Arabic. This value contains no personal data and never leaves your device. You can remove it at any time by clearing your browser's site data.

The website sets no cookies and runs no analytics or tracking tools.

Purposes and Legal Bases

Under the PDPL, we process personal data for the following purposes and on the following legal bases:

• Responding to enquiries. We use the details you send us through the contact form, by email, or by WhatsApp to reply to you and to discuss the services you asked about. Legal basis: your consent, given when you voluntarily send us your details.
• Security and operation of the website. Hosting access logs help detect abuse and keep the website available. Legal basis: our legitimate interest in operating a secure website, applied in a way that does not prejudice your rights or interests.
• Compliance with the law. We may process or retain personal data where a legal obligation in the Kingdom requires it. Legal basis: compliance with a legal requirement.

We do not use personal data for any other purpose. If that ever changes, we will update this policy and, where the PDPL requires it, seek your consent first.

No Sale of Personal Data

We do not sell personal data. We do not share personal data with third parties for their own marketing. We disclose personal data only to service providers who help us operate, such as our hosting provider and the email and messaging services described above, or where the law requires disclosure.

No Automated Decision-Making

Deerah builds AI services for businesses, but this website makes no automated decisions about you. We do not carry out any automated processing that produces legal effects concerning you or that similarly significantly affects you.

Retention

We keep personal data only for as long as it is needed for the purposes above:

• Enquiries where we hear nothing further: kept for 12 months from our last reply, then deleted.
• Enquiries that led to a meeting but no engagement: kept for 24 months from the last substantive contact, then deleted.
• Clients: kept for the duration of the engagement and afterwards for as long as commercial and tax records must be kept under Saudi law.
• Copies held by the form delivery service: up to three years under that service's own retention period, which is outside our control. Ask us and we will request their deletion.
• Hosting access logs are kept for the short rotation period applied by the hosting provider before they are routinely deleted.
• When personal data is no longer needed, we destroy it, unless a legal requirement obliges us to keep it longer.

Where Personal Data Is Processed

Our mailbox sits on a Saudi data centre, so enquiries come to rest inside the Kingdom. Two things on this website currently involve processing outside it, and we would rather name them than leave you to find out:

• The contact form. Submissions pass through Web3Forms and its sub-processors, as described above, before reaching our mailbox.
• The WhatsApp button. If you choose it, the conversation takes place on WhatsApp, operated by Meta.

You can avoid both by emailing or calling us directly. We are working to move form handling inside the Kingdom, and we will update this policy when that is done. Any transfer of personal data outside the Kingdom is carried out in accordance with the provisions on transfers outside the Kingdom in the PDPL and its Implementing Regulations.

Your Rights Under the PDPL

You have the following rights in relation to your personal data:

• The right to be informed. You may know how and why we process your personal data. This policy is the main way we inform you.
• The right of access. You may request a copy of the personal data we hold about you.
• The right to correction. You may ask us to correct personal data that is inaccurate, incomplete, or out of date.
• The right to destruction. You may ask us to destroy your personal data when it is no longer needed for the purposes for which it was collected, subject to any legal requirement to retain it.
• The right to withdraw consent. Where processing is based on your consent, you may withdraw it at any time. Withdrawal does not affect processing that took place before it.

To exercise any of these rights, email us at contact@deerah.ai. We will verify your identity and respond within the period set by the PDPL and its Implementing Regulations. Exercising your rights is free of charge unless the regulations permit otherwise.

Security

We keep the data we hold to a minimum, and the website collects only what you choose to send us. Access to enquiries is limited to the people who handle them, submissions are transmitted over an encrypted connection, and we use established service providers for delivery. No method of transmission or storage is completely secure, but we take reasonable and appropriate measures, as the PDPL requires, to protect personal data from loss, misuse, and unauthorised access.

Children

This website and our services are directed at businesses, not at children. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us at contact@deerah.ai and we will destroy it.

Changes to This Policy

We may update this policy from time to time, for example when our services or contact channels change. The current version, with its last updated date, will always be published on this page. If a change materially affects how we process your personal data, we will inform you as the PDPL requires.

Contact

• Entity: Deerah Digital Transformation Establishment, trading as Deerah
• Commercial Registration: 7053790809
• Registered in: Kingdom of Saudi Arabia
• Email: contact@deerah.ai
• Phone and WhatsApp: +966 59 427 7872