01Who we are
AI Legacy (“we”, “us”) is a software studio based in Riyadh, Saudi Arabia. We build mobile apps, websites and AI automation for businesses. We are the controller of the personal data described in this policy. You can reach us at hello@ailegacyhq.com.
02What we collect
We only collect what we need to reply to you and to run a project with you.
- Contact form: your name, work email, phone or WhatsApp number, company or project name, the service you need, your budget range, your timeline and your project details.
- Calls and WhatsApp: your number, name and the content of messages you send us.
- Project data: files, designs, credentials and other material you share with us during a project.
- Technical data: basic server logs created when you visit the site, such as IP address, browser type and pages requested. These are used for security and to keep the site running.
This website does not use advertising or tracking cookies. If we add analytics in the future, we will update this policy first.
03How we use your data
- To reply to your enquiry and arrange a call.
- To prepare your written plan, quote and timeline.
- To deliver, support and invoice a project you have agreed to.
- To keep the website secure and prevent spam or abuse.
- To meet our legal, tax and accounting obligations in the Kingdom.
04Legal basis
We process your data under the Personal Data Protection Law (PDPL) and its regulations. Our grounds are your consent (for example, when you send the contact form), steps you ask us to take before signing a contract, the performance of a contract with you, our legal obligations, and our legitimate interest in running and protecting our business. You can withdraw consent at any time. This doesn't affect processing that already happened.
06Transfers outside the Kingdom
Some of our providers, including Airtable and our hosting provider, may store or process data outside Saudi Arabia. Where that happens, we transfer only the data needed and rely on the safeguards permitted under the PDPL and its Regulation on Personal Data Transfer outside the Kingdom. For client projects, we host personal data inside the Kingdom by default unless agreed otherwise in writing.
07How long we keep it
- Enquiries that don't become projects: up to 24 months, then deleted.
- Client and project records: for the length of the contract and as long as tax and commercial law requires.
- Server logs: kept for a short period for security, then deleted automatically.
08How we protect it
We use encrypted connections (HTTPS), access controls, and accounts protected by strong passwords and two-factor authentication where available. Only the people who need your data to do their work can see it. No system is perfectly secure. If a breach affects your data, we will notify you and the competent authority as the PDPL requires.
09Your rights
Under the PDPL you have the right to:
- be told how your data is collected and used (this policy);
- access a copy of your personal data;
- ask us to correct or complete it;
- ask us to delete it when we no longer need it;
- withdraw your consent.
To use any of these rights, email hello@ailegacyhq.com. We reply within 30 days. If you are not satisfied with our answer, you can complain to the Saudi Data & AI Authority (SDAIA).
10Children
Our services are for businesses. We don't knowingly collect data from anyone under 18.
11Changes to this policy
We may update this policy as our services or the law change. The date at the top shows the latest version. For material changes, we will make it clear on this page.
12Contact us
Questions about your data? Email us at hello@ailegacyhq.com.