Privacy Policy

1. Who we are

O A I Company For Artificial Intelligence (commercial registration no. 7053520024), registered in Al Khobar, Kingdom of Saudi Arabia, trades under the name "O AI". We operate the website oai.sa and build Rushd, a cloud practice-management platform for Saudi law firms.

For the data this policy describes — website visits, contact-form submissions, call-back requests, newsletter subscriptions, and correspondence with the company — O A I Company For Artificial Intelligence is the controller within the meaning of the Personal Data Protection Law (PDPL).

2. Scope

This policy applies to oai.sa, to our newsletter, and to the email and other correspondence you exchange with us as a company. It does not describe what happens inside Rushd: account and billing data, and the client and case data law firms store on the platform, are covered by the Rushd Privacy Policy and the Rushd PDPL page.

If a law firm entered your personal data into Rushd — because you are that firm's client, for example — the firm is the controller of that data. Direct any request about it to the firm; we assist firms in answering such requests.

oai.sa is a business website and is not directed at anyone under 18. We do not knowingly collect personal data from minors; if we learn that a minor has sent us data, we delete it.

3. Data we collect

The contact form on oai.sa asks for your full name, work email address, company or firm name, and your message. Submitting the form is voluntary; we collect nothing through it unless you send it.

The demo request on the Rushd page asks for your full name, work email, mobile number and company or firm name, and is handled in the same way.

The call-back field under the headline on oai.sa asks for one thing: your email address or phone number, so our team can contact you. With it we receive the language of the page you used and the time of your request. Sending it is voluntary; we collect nothing through it unless you send it.

Blue, the guide on the home page, has a Help card: a short form of the contact form that asks for your name, your email address, optionally your mobile number, and a description of what you need. It is sent to our team the same way as the contact form, with the same confirmation email to you. Sending it is voluntary; we collect nothing through it unless you send it.

The newsletter sign-up form asks for your email address and for your agreement, which you give by ticking a box yourself. Subscribing is voluntary; section 7 describes everything we keep about a subscription.

When you email us at info@oai.sa, we receive your address and whatever your message contains.

Like any website, oai.sa receives the technical details every web request carries, such as your IP address and browser type; our hosting records them in its request logs, which are kept for 30 days and used only to keep the site running and secure.

The website stores a few small items in your browser: your language preference (oai_lang), your theme preference (oai_theme), your answer to the analytics banner (oai_consent), your choice of monthly or annual prices on the Rushd page (oai_billing), records used to limit repeated submissions of the contact form, the Rushd demo request, Blue's Help card and the call-back field, Blue's note for the current tab only (oai_blue), your best results once you finish one of its games (oai.blue.best), a flag set only by a link our staff use on their own browsers, which keeps their visits out of the analytics figures (oai_internal), notes for the newsletter's confirmation and unsubscribe pages, for the current tab only (oai_newsletter_confirm, oai_newsletter_unsubscribe), a mark that you folded the newsletter card in the home page footer, for the current tab only (oai.newsletter.folded), a mark that you signed up from that card on this device (oai.newsletter.joined), and, after a Rushd payment, that payment's reference and status for the current tab only (oai_rushd_payment). None of these identifies you to us, except that the newsletter pages' notes hold the code from the link in your email; the Cookie Policy lists each one.

If you allow analytics in the banner, Google Analytics 4 collects usage data about your visit: the pages you open, the time spent on them, the site that referred you, your device and browser type, and an approximate location derived from a truncated IP address. Google assigns your browser a random identifier for this; we never combine it with your name or email. With analytics allowed, the home page also keeps a note for the current visit (oai_journey_depth) so each part of the page is counted once. Nothing is collected before you allow it.

oai.sa has no accounts of its own. Signing a law firm up for Rushd at oai.sa/rushd/register opens an account on the Rushd platform: what is entered there is covered by the Rushd Privacy Policy, and card details go to our payment processor's hosted payment form, never to our servers.

4. Purposes and legal bases

We use contact-form, Help-card and demo-request data, call-back requests and correspondence for one purpose: handling your inquiry. That includes answering it, following it up, and — where it leads to a commercial relationship — preparing the related agreement. The legal basis is the consent you give by choosing to send the message, together with our legitimate interest in responding to it; you may withdraw that consent at any time by asking us to delete the exchange.

Apart from oai_journey_depth, which is set only with your analytics consent, the browser-stored items exist so the site appears in your chosen language and theme, keeps your choice of monthly or annual prices, so Blue carries on in this tab where you left it and remembers your best game results, so the newsletter's confirmation and unsubscribe pages carry on after a reload and the newsletter card in the home page footer stays folded once you fold it or sign up from it, so the contact form, the Help card, the demo request and the call-back field cannot be flooded, and so our own team's visits are left out of the analytics figures (oai_internal); the basis is our legitimate interest in running a working, secure website with accurate figures. The same interest is the basis for the request logs described in section 3.

Analytics data is processed to understand which pages are useful and to improve the site. The legal basis is your consent, which you can withdraw at any time as described in the Cookie Policy.

Where a Saudi statute requires us to keep or disclose records, we do so to comply with that legal obligation.

The purposes and legal bases for the newsletter are set out in section 7.

5. Who receives your data

When you send a message through the contact form or Blue's Help card, a demo request on the Rushd page, or a request through the call-back field, the website receives it and forwards it by email, through our email service provider, to our team inbox (info@oai.sa), which is hosted by our email hosting provider; for the contact form, the Help card and the demo request it also emails you a confirmation. The website itself does not save these submissions in a database: they are kept as emails in that inbox for the periods in section 6.

Email our systems send — such as the copy of your message that reaches our team inbox and the confirmation to you — is delivered through Resend (Plus Five Five, Inc.), our email service provider. Resend acts as our processor, and it is also an independent controller of its own service records, such as where each email was sent. It stores and processes data in the United States. Your name, email address, any mobile number you give, and the content of the exchange are therefore transferred outside the Kingdom for delivery. We transfer only what delivery requires, and, as our processor, Resend processes it under its data processing addendum, which forms part of its terms of service with O AI.

If you subscribe to the newsletter, your subscription is kept in our own database, and the newsletter and the confirmation email that comes before it are sent through Resend in the United States, as section 7 describes.

Call-back requests reach our team as an email, so the email address or phone number you enter also passes through that email service in the United States for delivery. If you give a phone number, we may reply by phone or on WhatsApp; a WhatsApp reply is carried by that service under its own terms.

If you allow analytics, usage data is processed by Google LLC (Google Analytics 4) on Google's servers, which may be located outside the Kingdom, including in the United States. Google acts as our processor for this data under its data-processing terms, and we have configured the service not to share it for Google's own advertising purposes. We do not send Google your name, email address, or the content of your messages.

We do not sell personal data and do not share it with advertisers. Disclosure to public authorities happens only where Saudi law requires it.

6. Retention

Correspondence, contact-form, Help-card and demo-request messages, and call-back requests are kept while the inquiry is open, and afterwards for as long as commercial and tax regulations require us to keep business records. Then we delete them.

To stop the same call-back request being sent twice, our server keeps a one-way keyed fingerprint (a hash) of the email address or phone number — not the address or number itself — for 24 hours, after which it is no longer used and is discarded; our server logs keep only a short reference derived from it.

The language and theme preferences, the monthly-or-annual pricing choice, the staff flag (oai_internal), Blue's best game results (oai.blue.best) and the newsletter card's sign-up mark (oai.newsletter.joined) stay in your browser until you clear them; Blue's note for the tab (oai_blue), the newsletter pages' notes (oai_newsletter_confirm, oai_newsletter_unsubscribe) and the newsletter card's fold mark (oai.newsletter.folded) are deleted when you close the tab. The rate-limit records hold only the times of your submissions, and each submission stops counting one hour after it was sent.

Google Analytics keeps event-level analytics data for no longer than fourteen months, after which it is deleted automatically; aggregated reports may persist longer. The consent record stays in your browser until you clear it.

Section 7 sets out how long we keep newsletter data.

7. The newsletter

If you subscribe, O AI's newsletter brings you new guides and news about O AI, Rushd and Dalni, at most twice a month. Subscribing is optional, and you receive the newsletter only if you ask for it. Each subscriber receives it in one language, English or Arabic: the language of the page where they signed up or, for an address we added as described below, the language recorded with it. To change the language, unsubscribe, then sign up again on a page in the other language.

To subscribe, you enter your email address in a sign-up form on oai.sa and tick a box to agree; the box is never ticked in advance. We then email you a confirmation link, which works for 7 days. You are added only after you open that link and press "Confirm subscription". If you do not confirm, you are not added. Your email address and your tick are needed to subscribe; if you do not give them, the only result is that you do not receive the newsletter. With each sign-up we also record, automatically, the page and form you used, and the IP fingerprint and the browser and device label described below.

We may also add an address that you gave to O AI directly, for example when you registered for an O AI event. We do this only if you chose there, separately from anything else, to receive this newsletter, and we keep a record of that choice. Normally, we email you first, and we add you only if you confirm. In some cases we add the address without that email, but only when we hold proof of the words you agreed to, and of when and where you agreed. We never use lists that others gave us, or lists that were bought, collected from the internet or taken from business cards.

When you sign up through a form, we keep the exact sentence you agreed to and its version, the date and time, and where you signed up: the page on oai.sa and which form you used (in an article, on the blog page, in the site footer or in the home page footer). When we add addresses as described above, we keep, for each batch we add, a note of the date and the way the people in it agreed, and of where we hold the proof; if a person then confirms, we also keep the words of our confirmation email that they agreed to. We also keep the date and time you confirmed (or, if we added you without a confirmation email, when we added you), the date and time of any unsubscribe, and how you unsubscribed.

When you sign up, confirm, or unsubscribe through our own link, we keep two things about that request. The first is a one-way keyed fingerprint (a hash) of your IP address, made on our server with a secret key. The second is a short label for your browser and device type, such as "Chrome on macOS", not the full browser details. Our newsletter records never hold your IP address itself. Like any web request, your sign-up reaches our servers with your IP address: our server uses it to limit repeated sign-ups, and our hosting's request logs record it, as section 3 describes.

Resend, our email service provider, sends us notices about your address: when an email to it bounces permanently, when one is reported as spam, when you unsubscribe through a Resend link or page, and when your contact at Resend is deleted. We use these notices only to keep your subscription status right, for example to stop sending, and to record how your subscription ended. We delete the notices themselves 30 days after we process them.

We do not track whether you open the newsletter or which links you click. The newsletter has no tracking pixel, and its images load only from our own servers. Loading them is an ordinary web request that our hosting's request logs record, and we do not use those logs to see who opened the newsletter. Links to oai.sa in the newsletter carry a short label (utm_source, utm_medium and utm_campaign) that tells our website statistics, if you allow analytics, which issue the visit came from; they carry nothing that identifies you. The links in the confirmation email are different: they carry a code tied to your sign-up, which is how they confirm or cancel it.

We use newsletter data only for the three purposes below, and we never sell it or share it with advertisers. First, to send you the newsletter you asked for, in your language. The legal basis is your consent. You can withdraw it at any time by unsubscribing; this does not affect the lawfulness of the processing before you withdrew it.

Second, to keep proof of your agreement and of when and how you gave it, and of how and when your subscription ended, and to make sure we do not write to you again after it ends unless you sign up again. The legal basis is our obligation to keep proof of a recipient's consent to receive advertising or awareness material, under Article 28 of the PDPL's Implementing Regulation, together with our legitimate interest in answering any complaint or claim about the emails we sent you, and in never writing to you again without a new sign-up. The same legitimate interest is the legal basis for keeping the fingerprints (hashes) of addresses, as described below.

Third, to stop misuse of the sign-up form, such as someone signing up other people's addresses, and to stop sending to addresses that bounce or whose owners report our emails as spam. This is why we keep the IP fingerprint and the browser and device label, which also form part of the proof of your consent, and why our sign-up forms send an address at most three confirmation emails in the 24 hours after the first one. The legal basis is our legitimate interest in keeping the form and our email secure.

The newsletter and the confirmation email come from "O AI" at no-reply@newsletter.oai.sa, and replies go to info@oai.sa. Every newsletter names O A I Company For Artificial Intelligence, its commercial registration number and its address in Al Khobar, and carries an unsubscribe link.

We send the newsletter and the confirmation email through Resend (Plus Five Five, Inc.), our email service provider. Resend acts as our processor for the emails and the contact details we give it. Under its terms, it is also an independent controller of its own service records, such as the data that shows where each email came from and where it went, and its activity logs. It uses them, under its own privacy policy, to run, improve and secure its service, to prevent misuse and to meet its legal duties. Resend stores and processes this data in the United States, so it is transferred outside the Kingdom. Once you confirm, Resend holds your email address, your language and whether you are subscribed. It also receives the content of each newsletter. Before you confirm, it receives only your address and the confirmation email, with your personal link. Resend uses sub-processors, which it lists on its website; at the date of this policy, it lists all of them in the United States.

We make this transfer for one purpose: to provide the service you asked for, by delivering the newsletter and the emails about your subscription. As our processor, Resend processes the data under its data processing addendum, which forms part of its terms of service with O AI. That addendum binds Resend to process the data in line with our instructions, to keep it confidential and secure, and to return or delete it when the service ends. Resend says it keeps the content and delivery records of each confirmation email for 30 days, and its backups for 7 days. Resend keeps each newsletter issue, which is the same for every reader, and the records of its delivery in our account. It publishes no fixed period for newsletter issues and their records. Its addendum requires it to delete our data within 90 days after our account is closed.

If you do not confirm, we delete your address and the record of your sign-up 30 days after your last sign-up request (if you were subscribed before, we delete only the record of the new sign-up, and keep the records of your earlier subscription for the three years described below); for an address we added, the 30 days start when its confirmation email is due. If the confirmation email bounced permanently, was reported as spam, or you used its unsubscribe link, we keep only a one-way keyed fingerprint (a hash) of your address, so that we never add it ourselves and, after a bounce or a spam report, never send it another confirmation email.

If you confirm, your subscription continues until you unsubscribe, an email to you bounces permanently or is reported as spam, or we stop the newsletter. We then keep your address, the record of your consent and the record of how and when your subscription ended for three years, as proof. We chose three years because, under Article 143 of the Civil Transactions Law, a claim for compensation arising from a harmful act is not heard once three years have passed from the date the injured person learned of the harm and of the person responsible for it. Once the end of your subscription has reached Resend, we delete your contact there, so during those three years these records stay only in our own database. After that we delete them. If we still send the newsletter then, we keep only a one-way keyed fingerprint (a hash) of your address, so that we never add it again by mistake. If an email to you bounced permanently or was reported as spam, Resend also keeps your address on its suppression list, so that it never sends to it again.

If you ask us to delete your data, we delete your subscription and all its records, including the record of your consent, and we delete your contact at Resend. Records of emails already sent to you stay at Resend for the periods described above, and Resend's own service records follow its privacy policy. We keep only a one-way keyed fingerprint (a hash) of your address, so that we never add it again ourselves; you can still sign up again yourself.

A fingerprint cannot be turned back into your address; with our secret key we can only check whether a given address matches it. We keep these fingerprints for as long as we send the newsletter, and delete them when we stop it. Deleted data also disappears from our automated database backups as those backups expire on a rolling basis.

You can unsubscribe at any time, free of charge: with the unsubscribe link at the bottom of every newsletter, which opens a page run by Resend; with the unsubscribe link in the confirmation email, which opens a page on oai.sa; or by writing to info@oai.sa. If you write to us, we stop sending you the newsletter as soon as we receive your message, and in any case within 24 hours of receiving it. Reporting a newsletter as spam also stops it. Unsubscribing stops the newsletter only: emails about an account you hold with us, such as Rushd verification codes or Dalni sign-in codes, still arrive.

Section 8 describes your rights under the PDPL. For the newsletter, you can ask us at info@oai.sa for a copy of what we hold about your subscription, to correct it or to delete it, and you can complain to the Saudi Data & AI Authority (SDAIA).

8. Your rights under the PDPL

The PDPL gives you the right to be informed about how your data is processed, to access it, to obtain a copy of it in a readable format, to have it corrected, to have it deleted, and to withdraw any consent you previously gave.

Send requests to info@oai.sa. We verify the requester's identity before acting and respond within 30 days, or, for an unusually complex or voluminous request, within a further 30 days after telling you why.

If our answer does not satisfy you, you may complain to the Saudi Data & AI Authority (SDAIA).

9. Security

Traffic between your browser and oai.sa is encrypted with TLS. Within the company, access to correspondence is limited to the staff who need it for their work and is logged.

10. Changes to this policy

If we change this policy in a material way, we give notice on the website or by email, normally 30 days before the change takes effect. Continued use of the website after the effective date is acceptance of the updated policy.

The policy is published in Arabic and English. If the two versions ever diverge, the Arabic text prevails.

11. Contact

Privacy questions and requests: info@oai.sa, or the contact form on oai.sa. We reply in Arabic or English, whichever you use.