Privacy Policy

Avangate Hospitality Services FZE (the "Company," "we," "us"), operating saudi-law.ai (the "Service"), is the data controller for personal information processed through the Service.

Contact our Data Protection Officer at: dpo@saudi-law.ai.

Information you provide: name, email, phone (Pro signup), password (hashed with Argon2 — never plaintext), preferences (region, language), the text of the questions you ask, Vault uploads (Pro), and payment information collected by Stripe (we do not see or store full card details).

Information collected automatically: usage data, IP address, browser type, and cookies.

Information we do NOT collect: sensitive personal data (race, religion, health) unless you voluntarily share it; children's data; full credit card numbers.

• Contract performance — providing the Service and subscriptions
• Legitimate interest — service improvement, security, and anonymized analytics
• Consent — marketing and lead routing to partner lawyers
• Legal obligation — compliance with regulatory requirements

With partners (law firms) — only when you explicitly request it. With service providers (Anthropic, Voyage AI, Supabase, Vercel, Stripe, Twilio, Sendy, Sentry) acting as data processors on our instructions. With authorities when legally required.

We do not sell personal data, do not use it for advertising targeting, and do not share question content except as described.

• Access — receive a copy of your personal data
• Rectification — correct inaccurate data
• Erasure — request deletion ("right to be forgotten")
• Portability — receive your data in machine-readable format
• Restrict processing — limit how we use your data
• Object — opt out of processing based on legitimate interest
• Withdraw consent — where processing is based on consent
• Lodge a complaint with SDAIA (Saudi Arabia's data protection authority)

To exercise these rights, contact dpo@saudi-law.ai. We respond within 30 days.

• TLS encryption in transit (HTTPS everywhere)
• AES-256-GCM encryption at rest for Vault contents
• Argon2 password hashing
• Row-level security on all personal data tables
• Multi-factor authentication for admin accounts

If a data breach affects your personal data, we will notify you within 72 hours, as required by the PDPL.

Account data is kept while the account is active + 30 days after deletion. Payment records are kept for 7 years (Saudi Arabia corporate records standard). Backups are kept 7-14 days on a rolling basis.

The Service is not directed at users under 18. We do not knowingly collect personal data from children. If you become aware that a child has provided personal data, contact dpo@saudi-law.ai for immediate deletion.