PDPL and Data Protection

1. The Law and Its Regulator

The Personal Data Protection Law ("PDPL") and its Implementing Regulations govern personal data in the Kingdom of Saudi Arabia, supervised by the Saudi Data & AI Authority (SDAIA). Rushd is operated by O A I Company For Artificial Intelligence (commercial registration no. 7053520024), registered in Al Khobar, Kingdom of Saudi Arabia, trading as "O AI"; this page records how we apply the PDPL to the Platform.

The Privacy Policy explains what data we handle and why. This page concentrates on our obligations toward the law firms that use Rushd.

2. Who Controls What

O AI is the controller for Firm account data, billing records, and anything sent to us directly. For the client and case data a Firm places in Rushd, the Firm is the controller and O AI is its processor, acting on the Firm's instructions. Section 2 of the Privacy Policy sets out which data falls where and how individuals should route rights requests.

3. What We Undertake as Processor

For each Firm's client and case data, we make these commitments:

We process the data only on the Firm's documented instructions — those given through the Platform's features and settings, or in writing.

Everyone at O AI who can reach customer data is bound by confidentiality, and that access is limited and logged.

We protect the data with the measures described on the Security page and help the Firm meet its own security obligations.

If a breach affects the Firm's data, we tell the Firm without undue delay and give it the information it needs for its own notifications.

When a data subject sends the Firm a rights request, we help the Firm answer it — through the Platform's tools or on request.

At the end of the relationship we delete the Firm's data, or return it first: on written request before deletion, we provide an export in a common machine-readable format. The deletion timeline after suspension — 30 days — is stated in the Subscription & Billing terms and in the Privacy Policy's retention section.

We give advance notice by email before adding any sub-processor that will handle Firm data.

4. Sub-processors

These providers currently process data for us: a cloud hosting provider (hosting, in Saudi Arabia), an AI model provider (AI processing), a Saudi-based payment processor (payment processing, in Saudi Arabia), a third-party transactional email service (processing in the United States), and Expo together with Apple's and Google's push services (mobile notifications, outside the Kingdom). Each works under a contract limiting its processing to our documented purposes.

5. Data Residency and Cross-Border Transfers

Production compute, the database, and file storage run on Saudi-based cloud infrastructure, inside the Kingdom of Saudi Arabia. Three flows involve processing outside the Kingdom: AI requests handled by our AI provider; transactional email dispatched by a third-party email service from the United States; and mobile push notifications relayed by Expo and delivered by Apple's and Google's push services, which receive only the device token and the notification text. Each transfer carries only the minimum data required and is subject to contractual data-protection commitments consistent with the PDPL's transfer rules.

6. Breach Notification

Where the PDPL requires it, we notify SDAIA of a personal data breach within 72 hours. Affected Firms — and, where we are the controller, affected individuals — are informed without undue delay.

7. Rights Requests and Complaints

Rights under the PDPL — to be informed, to access, to obtain a copy in a readable format, to correct, to delete, and to withdraw consent — are described in the Privacy Policy. Requests about data we control go to info@oai.sa; we verify identity and respond within 30 days. Requests about data a Firm submitted go to that Firm, with our assistance. Complaints may be raised with SDAIA.

8. Data Protection Contact

Data-protection questions from Firms, individuals, or authorities go to info@oai.sa, which reaches the people responsible for privacy and security at O AI.

9. Changes to This Page

Material changes are announced by email or inside the Platform, normally 30 days before they take effect; continued use after the effective date is acceptance. This page is published in Arabic and English; where the versions differ, the Arabic text prevails.