Privacy Policy

This notice covers the aiSocial website, website enquiries and related business communications. The controller is Qudrah Information Technology Co. (Arabic legal name: شركة قدرة لتقنية المعلومات شركة شخص واحد), Unified National Number 7025825725, based in Riyadh, Saudi Arabia. Contact grow@aisocial.me or +966 57 380 7247 for privacy questions or rights requests.

For a client-operated website, admissions assistant or other commissioned solution, the client's own privacy notice and the agreed data-processing terms apply. aiSocial's role depends on that arrangement; this notice does not replace a school, listed company's or other client's notice.

When you enquire, we collect your name, business name and the email address or telephone/WhatsApp contact you provide. Service interest, an additional telephone number and a project brief are optional. We receive this information through our contact forms, email, telephone or WhatsApp. A business name, your name and at least one contact method are required for an online enquiry; without a way to contact you, we cannot respond.

Normal website operation can involve technical information such as your IP address, browser/device details, pages requested and access times. Our site includes website analytics, externally hosted fonts, images and a background video. Those providers receive the technical information necessary to deliver their resources. If you sign in to an authorised client or administrative area, account identifiers, contact details and authentication records are also processed.

Please do not put national identity numbers, payment-card details, health information, children's records or other sensitive personal data into the public enquiry form. Share another person's information only where you are authorised to do so.

We use enquiry information to respond to the request you initiate, discuss relevant services, prepare a proposal and manage related project communications. The form explains this use before submission; selecting Send Message is your affirmative consent to that limited processing, not consent to unrelated advertising. You can withdraw consent through the privacy contact below.

Where applicable, processing may instead be necessary to carry out an agreement to which you are a party or to meet a legal obligation. Website security and service administration may rely on legitimate interests only where the PDPL's conditions are met, the processing is necessary and proportionate, and your rights are not prejudiced; sensitive data is not processed on that ground.

We do not use an enquiry as permission for unrelated direct marketing. Any consent-based marketing requires a separate lawful choice and a way to stop those messages. A new incompatible purpose requires a separate legal basis and notice. Withdrawing enquiry consent does not undo lawful past processing or remove records that must be retained under another lawful ground.

Website enquiries are recorded in our enquiry database and CRM, and routed to the team for a response. The website uses Manus for hosting and operational notifications, and Resend for confirmation and internal notification emails. These systems can receive the enquiry details required for their functions. Website measurement uses an Umami integration. External resource delivery includes Google Fonts and an Amazon CloudFront-hosted video; these resource providers receive connection information rather than being intended recipients of your project brief.

Authorised team members and service providers may access data for these stated purposes. Disclosures to authorities or professional advisers must have a lawful basis and be limited to what is necessary. We do not sell website enquiry data. WhatsApp, social networks and other third-party sites apply their own notices when you choose to use them.

The public site is not a payment-card collection form. Where a project involves a separate payment provider, its payment notice and the relevant contract apply.

Hosting, email, analytics, external resources and authorised team access may involve processing outside Saudi Arabia. Our presence in Saudi Arabia, India and the United Kingdom does not by itself authorise a transfer. Provider and access locations depend on the service configuration; contact grow@aisocial.me for information about the arrangement relevant to your data.

Any transfer or disclosure outside the Kingdom must meet Article 29 of the PDPL and the applicable transfer regulations, including a permitted purpose, data minimisation, adequate protection or a legally permitted safeguard or exception, and required assessments. This notice is not blanket consent to an unrestricted international transfer and does not claim Saudi-only hosting.

Retention is determined by the purpose: the time needed to resolve an enquiry or deliver a project, applicable contractual and statutory record-keeping duties, and a genuine need to establish or defend legal claims. Data that is no longer needed for a lawful purpose must be deleted or irreversibly anonymised without undue delay. A deletion request is assessed against these obligations; lawful retained records must be limited to their retention purpose.

The same requirements extend to copies and backups, with deletion handled under applicable regulatory requirements and the relevant storage arrangements. If we cannot erase a record because a legal obligation requires retention, we explain the applicable reason where permitted.

Access controls, authentication and secure transmission support protection of the website's data. Appropriate technical and organisational safeguards, processor oversight and any legally required breach notifications remain our responsibility. No internet service can promise absolute security.

Subject to the PDPL and its lawful restrictions, you can ask to be informed about processing, access your personal data, obtain a readable copy, correct or complete it, and request its destruction. You can withdraw consent where it is the processing basis. You may also complain to the competent authority, the Saudi Data & AI Authority (SDAIA).

Email grow@aisocial.me with Privacy Request in the subject, describe the request and provide enough information to locate the relevant records. We may proportionately verify identity to protect your data. Do not send sensitive identity documents unless a secure, necessary verification method is agreed.

Requests must be acted on without delay and within 30 days. Where the Implementing Regulation permits an extension for disproportionate effort or multiple requests, it can be no more than a further 30 days, and we must notify you in advance with reasons. Any lawful restriction or refusal must be explained as required. You do not need to accept marketing or purchase a service to exercise these rights.

Authentication areas use a session cookie, and the site stores language or theme preferences in local browser storage. Website analytics helps us understand page use. We do not describe analytics as anonymous merely because it is configured through an analytics tool; its actual data use must follow the applicable lawful basis and notice requirements.

You can manage cookies and site storage in your browser. Blocking necessary storage can affect sign-in or preferences. This website does not currently provide a granular cookie-preference centre. Any non-essential tracking that requires consent must not run before valid consent; this policy is not a substitute for the required technical controls.

The update date identifies the version of this notice. Material changes to purposes or processing are to be communicated as required by law. A notice change does not retrospectively authorise a different purpose or replace consent that is legally required.