Privacy Policy

1. Who we are

O A I Company For Artificial Intelligence (commercial registration no. 7053520024), registered in Al Khobar, Kingdom of Saudi Arabia, trades under the name "O AI". We operate the website oai.sa and build Rushd, a cloud practice-management platform for Saudi law firms.

For the data this policy describes — website visits, contact-form submissions, and correspondence with the company — O A I Company For Artificial Intelligence is the controller within the meaning of the Personal Data Protection Law (PDPL).

2. Scope

This policy applies to oai.sa and to the email and other correspondence you exchange with us as a company. It does not describe what happens inside Rushd: account and billing data, and the client and case data law firms store on the platform, are covered by the Rushd Privacy Policy and the Rushd PDPL page.

If a law firm entered your personal data into Rushd — because you are that firm's client, for example — the firm is the controller of that data. Direct any request about it to the firm; we assist firms in answering such requests.

oai.sa is a business website and is not directed at anyone under 18. We do not knowingly collect personal data from minors; if we learn that a minor has sent us data, we delete it.

3. Data we collect

The contact form on oai.sa asks for your full name, work email address, company or firm name, and your message. Submitting the form is voluntary; we collect nothing through it unless you send it.

When you email us at info@oai.sa, we receive your address and whatever your message contains.

The website stores a few small items in your browser: your language preference (oai_lang), your theme preference (oai_theme), your answer to the analytics banner (oai_consent), and a short-lived record used to limit repeated contact-form submissions. None of these identifies you to us.

If you allow analytics in the banner, Google Analytics 4 collects usage data about your visit: the pages you open, the time spent on them, the site that referred you, your device and browser type, and an approximate location derived from a truncated IP address. Google assigns your browser a random identifier for this; we never combine it with your name or email. Nothing is collected before you allow it.

You cannot create an account on oai.sa, and we collect no payment data through it.

4. Purposes and legal bases

We use contact-form data and correspondence for one purpose: handling your inquiry. That includes answering it, following it up, and — where it leads to a commercial relationship — preparing the related agreement. The legal basis is the consent you give by choosing to send the message, together with our legitimate interest in responding to it; you may withdraw that consent at any time by asking us to delete the exchange.

The browser-stored items exist so the site appears in your chosen language and theme and so the contact form cannot be flooded; the basis is our legitimate interest in running a working, secure website.

Analytics data is processed to understand which pages are useful and to improve the site. The legal basis is your consent, which you can withdraw at any time as described in the Cookie Policy.

Where a Saudi statute requires us to keep or disclose records, we do so to comply with that legal obligation.

5. Who receives your data

The website runs on cloud infrastructure in the Kingdom of Saudi Arabia, so data you submit passes through and is stored on systems under our control inside the Kingdom.

Email we send you — including replies to contact-form messages — is delivered through a third-party transactional email service that processes data in the United States. Your name, email address, and the content of the exchange are therefore transferred outside the Kingdom for delivery. We transfer only what delivery requires, under contractual commitments consistent with the PDPL's rules on transfers outside the Kingdom.

If you allow analytics, usage data is processed by Google LLC (Google Analytics 4) on Google's servers, which may be located outside the Kingdom, including in the United States. Google acts as our processor for this data under its data-processing terms, and we have configured the service not to share it for Google's own advertising purposes. We do not send Google your name, email address, or the content of your messages.

We do not sell personal data and do not share it with advertisers. Disclosure to public authorities happens only where Saudi law requires it.

6. Retention

Correspondence and contact-form messages are kept while the inquiry is open, and afterwards for as long as commercial and tax regulations require us to keep business records. Then we delete them.

The language and theme preferences stay in your browser until you clear them. The rate-limit record expires on its own shortly after your submission.

Google Analytics keeps event-level analytics data for no longer than fourteen months, after which it is deleted automatically; aggregated reports may persist longer. The consent record stays in your browser until you clear it.

7. Your rights under the PDPL

The PDPL gives you the right to be informed about how your data is processed, to access it, to obtain a copy of it in a readable format, to have it corrected, to have it deleted, and to withdraw any consent you previously gave.

Send requests to info@oai.sa. We verify the requester's identity before acting and respond within 30 days, or, for an unusually complex or voluminous request, within a further 30 days after telling you why.

If our answer does not satisfy you, you may complain to the Saudi Data & AI Authority (SDAIA).

8. Security

Traffic between your browser and oai.sa is encrypted with TLS, and stored data is encrypted at rest on our cloud infrastructure. Within the company, access to correspondence is limited to the staff who need it for their work and is logged.

9. Changes to this policy

If we change this policy in a material way, we give notice on the website or by email, normally 30 days before the change takes effect. Continued use of the website after the effective date is acceptance of the updated policy.

The policy is published in Arabic and English. If the two versions ever diverge, the Arabic text prevails.

10. Contact

Privacy questions and requests: info@oai.sa, or the contact form on oai.sa. We reply in Arabic or English, whichever you use.