Privacy Policy

Website visitors. Pages viewed, approximate location derived from IP address, referring page, browser and device type, and language preference. This is collected through analytics as described in section 5.

Demo and contact requests. Full name and work email, which are required, and company, job title, phone number, area of interest and any message you choose to include. We ask for work rather than personal contact details on purpose.

Platform users. Name, work email, role and department assignment, authentication events including sign in time and source address, multi factor enrolment status, and a record of administrative actions. Where an organization uses single sign on, the identity attributes released by that organization's identity provider.

Platform usage records. Queries submitted, the sources consulted in answering them, and the responses returned, retained so that administrators can review activity and so that the service can be operated and supported.

Customer content. Documents, database records and other material a customer connects to the platform may contain personal data about that customer's own employees, suppliers or counterparties. We process that material only to deliver the service to that customer.

To respond to demo requests and enquiries, and to contact you about the request you submitted.

To provide, operate, secure and support the platform for the customer you belong to.

To authenticate users, enforce access controls, and detect and investigate suspicious activity.

To maintain audit records where a customer or applicable law requires an activity trail.

To measure how the website is used, so that we can improve its content and structure.

To meet our legal, regulatory, tax and accounting obligations.

Our legal basis for processing website and business contact data is our legitimate interest in operating and promoting the service, your consent where consent is required for optional cookies, and the performance of a contract where you are a user of a customer's subscription.

The platform uses AI models to read connected sources and answer questions about them. Three commitments govern how that works:

Customer content is not used to train shared or third party AI models, and is not used to improve models for any other customer.

Each customer organization is provisioned as a separate tenant, and the platform is designed so that queries can only reach sources belonging to that tenant and permitted for that user.

Model inference for the managed cloud service runs on infrastructure operated for nuhaa.ai, and the models are not permitted to retain customer content after a request completes.

Where a customer deploys nuhaa.ai within its own environment, content and inference remain inside that environment and DataPlus has no access to it except where the customer grants access for support purposes.

The platform does not make automated decisions producing legal effects about individuals. Output is decision support material for people to review, as described in the Terms of Service.

Strictly necessary. A small amount of local storage records your language and appearance preference so the site renders as you left it. These are not used for tracking and cannot be switched off without breaking the site.

Analytics. Where enabled, we use Google Analytics, a service provided by Google, to understand which pages are read and which calls to action are used, in aggregate. Analytics cookies are set only after you accept them.

You can clear or block cookies through your browser settings. Blocking strictly necessary storage may cause the site to forget your language and appearance choices.

The platform itself uses session cookies and tokens required for authentication. These are functional and cannot be disabled while signed in.

We do not sell personal data, and we do not share it for advertising purposes.

We share personal data with service providers who process it on our behalf under written terms that restrict their use of it. These currently include:

cloud infrastructure and hosting providers, for running the managed service;

an email delivery provider, for transactional messages and replies to enquiries;

an analytics provider, as described in section 4;

professional advisers, where required for legal, accounting or audit purposes.

A current list of sub processors used in delivering the platform is available to customers on request at info@dataplus.sa.

We may disclose personal data where required by law, by a court, or by a competent authority in the Kingdom of Saudi Arabia, and where necessary to establish, exercise or defend legal claims.

The managed cloud service is operated so that customer content and platform data are held within the Kingdom of Saudi Arabia, unless a customer agrees otherwise in writing.

Where a customer requires data to remain inside its own perimeter, nuhaa.ai is available as an on premises deployment, including in air gapped environments.

Limited business contact data, such as website enquiries, may be processed by service providers outside the Kingdom. Where that happens we apply the transfer safeguards required by applicable law.

Demo and contact enquiries: retained for 24 months from the last contact, then deleted.

Website analytics: retained in aggregate for 14 months.

Platform account records: retained for the duration of the customer's subscription.

Audit and authentication records: retained according to the period the customer configures, and in any case for the period applicable law requires.

Customer content: retained until the customer deletes it or the subscription ends, after which it is deleted in accordance with the Enterprise Agreement.

Backups are held on a rolling schedule and expire on their own cycle, so deleted material may persist in backups for a limited period after deletion from the live service.

We apply technical and organizational measures appropriate to the risk, including encryption of data in transit and at rest, encryption of stored credentials and secrets, role based access control with departmental and ownership scope, multi factor authentication, audit logging of privileged actions, and separation of customer data by tenant.

Access to production systems is limited to personnel who need it, and is logged.

No system can be guaranteed to be completely secure. If a personal data breach occurs that is likely to cause harm, we will notify the affected customer and the competent authority in accordance with applicable law and within the timeframes it prescribes.

Subject to the conditions in the Personal Data Protection Law, you have the right to:

be informed of the legal basis and purpose for collecting your personal data;

request access to your personal data and obtain a copy of it in a readable format;

request correction of data that is inaccurate, incomplete or out of date;

request deletion of your personal data where it is no longer needed for the purpose it was collected for;

withdraw consent where processing relies on consent, without affecting processing already carried out.

To exercise these rights in relation to data we control, write to info@dataplus.sa. We will respond within the period required by applicable law and may need to verify your identity first.

If your personal data sits inside a customer's content on the platform, that customer is the controller. Please direct your request to that organization, and we will support them in responding to it.

If you believe we have not handled your personal data correctly, you may complain to us at info@dataplus.sa or to the competent supervisory authority in the Kingdom of Saudi Arabia.

This section sets out how the rest of this policy maps to the Personal Data Protection Law of the Kingdom of Saudi Arabia and its Implementing Regulations. It is written separately because it is the law most of our customers answer to, and because a policy that only gestures at compliance is of no use to the person who has to demonstrate it.

Who is responsible for what. For this website, and for an enquiry you send us, DataPlus is the controller: we decide why and how the data is processed. For content inside a customer tenancy on the platform, the customer is the controller and DataPlus is the processor, acting on their documented instructions and on nothing else.

Why we are allowed to process it. We rely on your consent, on the necessity of performing a contract with you, on a legitimate interest that does not override your rights, or on an obligation the law places on us. Analytics rests on consent alone: nothing is measured until you accept, and declining costs you no functionality.

What you can ask for. Under the law you may ask to be told that we hold your personal data and why, to access it, to receive a copy of it in a readable format, to have it corrected or completed, and to have it destroyed where we no longer have a basis to keep it. Where processing rests on consent, you may withdraw that consent at any time without affecting what was lawful before.

Data leaving the Kingdom. Platform content stays inside the Kingdom: the models that answer a customer question run on infrastructure in Saudi Arabia, and customer content is not sent to a third party model provider. Website analytics is the exception and we would rather say so plainly than bury it. Google Analytics processes data on infrastructure outside the Kingdom, which is why it is switched off until you accept it and why declining leaves the site fully usable.

Telling you when something goes wrong. If a breach of personal data occurs that is likely to cause harm, we will notify the competent authority within the period the law requires and will inform affected individuals without undue delay.

The regulator, and complaining to it. The Saudi Data and Artificial Intelligence Authority supervises the law. You are entitled to complain to it directly, and you do not have to come to us first, although we would prefer the chance to put something right. To reach us, write to info@dataplus.sa.

The website and the platform are intended for professional use by adults. We do not knowingly collect personal data from anyone under the age of 18. If you believe a child has provided us with personal data, contact info@dataplus.sa and we will delete it.

We update this policy as the service and applicable law develop. The date at the top of this page records the most recent revision.

Where a change materially affects how we handle personal data, we will make that clear on this page and, for platform customers, notify their designated contacts.

For any question about this policy or about how your personal data is handled, contact our privacy contact at info@dataplus.sa, or write to DataPlus, Building 2995, Al Qadisiyah Street, Al Yasmeen District, Unit 8239, Riyadh 13322, Kingdom of Saudi Arabia.

Our designated personal data protection officer is the Privacy Officer of DataPlus, who can be reached at info@dataplus.sa.