Privacy policy

1. Scope of this policy

This policy applies to:

• Visitors to edarahq.com
• People who contact us or book a demo
• Business customers and the users they authorise to use the workspace
• People who speak or chat with an Edara agent run by one of our customers (see sections 3 and 11)

This policy does not apply to:

• Third-party websites and services that we do not control
• The privacy practices of the businesses that use Edara; each of them is responsible for its own notices to its own customers

2. Information we collect

What we collect depends on how you deal with us.

2.1 Information you give us directly. When you book a demo, open an account or write to us, you may give us your name, work email address, company name, phone or WhatsApp number, what you want the agent to handle, the text of your message, how you heard about us, account sign-in details, billing details, and the content of your support requests.

2.2 Account and usage data. When a customer opens an account, we record account identifiers, the users and roles the customer creates, order and subscription details, activity inside the workspace such as agents created, knowledge uploaded and rules changed, API usage, and the entries of the audit log.

2.3 Data processed for our customers. When a business runs an Edara agent, the agent processes the conversations its customers have with it. This includes call audio recordings, transcripts and summaries, WhatsApp and web chat messages, the phone number and name of the person and any other details they give during the conversation, records the agent reads from or writes to the business's connected systems, and the actions the agent takes. When a real estate developer runs Edara ERP, the system holds the records the developer and its users enter and generate: lead and buyer records, reservation and contract records, payment schedules, instalments and collection records, invoices and credit notes, and inspection and handover records, each tied to a unit and a project. We process all of it only to provide the service to that business and on its instructions. We do not use it for any other purpose unless our agreement with that business says so.

2.4 Information collected automatically. When you visit the website or use the workspace, our hosting and application logs record your IP address, browser and device type, the pages you open, timestamps, the referring address and any errors. We use this to run and secure the website and the service.

2.5 Cookies and similar technologies. The website sets no cookies beyond what is strictly necessary for it to work, runs no analytics tools and no advertising trackers, and therefore shows no cookie banner. When a customer's user signs in to the workspace, a session cookie keeps them signed in. If we add a cookieless measurement tool to the website in future, we will say so on this page first.

2.6 Information from third parties. We may receive personal data from our customers, for example a list of people the agent should call on the customer's behalf; from telephony and messaging providers, such as the caller's number and call metadata; and from identity, hosting and payment providers, to the extent needed to run the service.

3. Our role: controller or processor

Under the Personal Data Protection Law of Saudi Arabia (PDPL), Edara acts in two different roles:

• Edara is the controller for data about website visitors, demo requests, and the accounts and users of our business customers. We decide why and how this data is processed, and this policy describes it.
• Edara is the processor for the customer data described in section 2.3, both the conversation data an agent processes and the records a developer keeps in Edara ERP. The business that runs the agent, or the developer that runs the ERP, is the controller. It decides the purposes and the rules, and we process the data on its documented instructions, under our agreement with it and a data processing agreement.

If you spoke or chatted with an Edara agent and you have a question about your data, the business you contacted is the right first point of contact. Section 11 explains how we help.

4. How we use information

4.1 Service delivery. To provide, run and maintain the website and the service; to set up agents, channels and integrations for a customer; to authenticate users and protect accounts; to process orders and payments.

4.2 Communication. To reply to demo requests and questions; to send service messages such as changes, security notices and invoices; to send marketing messages only with your consent, which you can withdraw at any time by writing to osamah@edarahq.com.

4.3 Product improvement. To understand how the workspace is used, fix errors and improve performance, using account and usage data and aggregated figures. We do not use conversation data processed on a customer's behalf to train models for other customers, and we do not use it to improve the service unless our agreement with that customer allows it.

4.4 Business operations. To manage billing, enforce our agreements and policies, and prevent fraud, abuse and misuse of the service.

4.5 Legal compliance. To comply with the laws that apply to us and to respond to lawful requests from the competent authorities.

5. Legal basis under PDPL

We process personal data in line with the Personal Data Protection Law and its Implementing Regulations, administered by the Saudi Data and Artificial Intelligence Authority (SDAIA). Depending on the case, we rely on:

• Your consent, for example when you agree to receive marketing messages
• Performance of an agreement with you or with your organisation, or acting on a request you made, for example a demo request
• A legal obligation that applies to us, for example keeping accounting records
• A legitimate interest of Edara that does not involve sensitive data and does not outweigh your rights, for example securing the service and preventing abuse

For conversation data, the business that runs the agent determines the legal basis. It is responsible for telling its customers that they are speaking with an automated agent and that calls are recorded, and for obtaining consent where the law requires it, including for outbound calls and marketing messages.

6. How we share information

We do not sell personal data. We share it only in the following cases.

6.1 Service providers and sub-processors. We use providers to host the service, connect phone lines and WhatsApp, convert speech to text and text to speech, run the language models behind the agent, deliver email and process payments. Each is bound by a contract that limits what it may do with the data. The current list of sub-processors, with their locations, is set out in the agreement with each customer and is available on request. We tell customers before we add a new sub-processor.

6.2 Business transfers. If Edara is merged, acquired, financed or sells assets, personal data may be transferred as part of that transaction. We would inform customers and apply this policy to the transferred data.

6.3 Legal and safety. We may disclose personal data when we must do so by law, to respond to a lawful request from a competent authority, to protect the rights, safety or property of Edara, our customers or others, or to investigate fraud or misuse.

6.4 On your instruction. We share data when you or your organisation explicitly instructs us to, for example when a customer connects its CRM or helpdesk to the agent.

6.5 Aggregated data. We may use and share figures that have been aggregated or anonymised so that they cannot reasonably identify anyone.

7. Data retention

• Website contact and demo requests: until you ask us to delete them or we no longer need them, and no longer than 24 months from our last contact with you.
• Account and billing data: for the term of the agreement and afterwards for as long as accounting, tax or other legal obligations require.
• Conversation data: for the retention period the customer sets for its deployment. Recordings, transcripts and messages are deleted when that period ends. At the end of the agreement we return or delete the customer's conversation data within the period stated in the agreement.
• Logs and backups: for a limited period needed for security and recovery, after which they are overwritten.

When a retention period ends we delete the data or make it anonymous, unless a legal obligation requires us to keep it longer.

8. Data security

We apply organisational, administrative and technical measures designed to protect personal data: encryption in transit and at rest, access by role so that each person sees only what their role needs, an audit log of actions in the workspace, restriction of access to the staff who need it, and regular review of our systems. No system is completely secure and we cannot promise absolute security. If a breach occurs that is likely to cause harm, we notify SDAIA and the people affected as the PDPL requires, and we inform the customer concerned so that it can meet its own obligations.

9. Data location and transfers outside the Kingdom

Edara is designed to host conversation data, ERP records and account data in Saudi Arabia. Where a provider we rely on, such as a telephony, messaging or model provider, processes data outside the Kingdom, that is a transfer of personal data outside the Kingdom under the PDPL. We make such a transfer only under the PDPL's transfer rules: where the destination provides an adequate level of protection or where appropriate safeguards are in place, limited to the minimum data needed, and without prejudice to national interests. The agreement with each customer states which sub-processors operate outside the Kingdom.

The website itself is served through a global hosting network, and contact-form messages are delivered by an email provider, so website data and the details you send through the form may be processed outside the Kingdom under the same rules.

10. Your rights

Under the PDPL you have the right to:

• Be informed about how your personal data is processed
• Access your personal data and obtain a copy of it
• Correct, complete or update your data
• Request the destruction of your data when it is no longer needed for the purpose it was collected for
• Withdraw your consent at any time, without affecting processing that took place before you withdrew it

To exercise these rights, write to osamah@edarahq.com. We may ask you to confirm your identity first. We reply within 30 days, and we tell you if we need more time as the law allows. If you are not satisfied with our reply, you may complain to SDAIA through the National Data Governance Platform.

11. If you spoke with an Edara agent

If you called, messaged or chatted with an agent run by a business on Edara, that business is the controller of the conversation. The agent introduces itself as an automated agent at the start of the conversation, and you can ask for a person at any time; the agent then transfers you or takes a message according to the rules that business set.

For questions about your recording, transcript or messages, contact the business first. If you write to us instead, we forward your request to the business and help it respond, unless the law requires us to act on it directly. If you believe an Edara agent is being misused, report it to us.

12. Third-party services and links

The website may link to other websites, and the service may connect to third-party systems that a customer chooses, such as a CRM, a helpdesk, a calendar or a messaging platform. Those systems have their own terms and privacy practices, and we are not responsible for them.

13. Children's privacy

The website and the service are for businesses and are not directed at children. We do not knowingly collect personal data from anyone under 18 through the website. Where a child speaks with an Edara agent run by a business, that business is responsible for the rules that apply to the conversation.

14. Changes to this policy

We may update this policy from time to time. We publish the new version on this page with a new date at the top. Where the change is material, we inform customers by email or inside the workspace before it takes effect.

15. Contact

Controller: Edara, Jeddah, Saudi Arabia.

Privacy questions and requests: osamah@edarahq.com.

This policy is governed by the laws of Saudi Arabia. It is provided in Arabic and English, and the Arabic version prevails if the two differ.