Privacy Policy

1. Our Commitment to the PDPL

We process personal data in accordance with the principles of the Saudi Personal Data Protection Law: lawfulness and transparency, purpose limitation, data minimization, accuracy, storage limitation, and confidentiality and security. Jodfay Solutions is the "controller" of your data when you use the platform, and a "processor" of your customers' data when we operate a digital employee or agent on your behalf.

2. Data We Collect

We collect the minimum necessary to deliver our services, including:

• Account data: name, email, phone number, account type, and — for businesses — entity name, commercial registration, and VAT number
• Contract and billing data: orders, subscriptions, invoices, and payment history (we do not store card numbers on our systems)
• Operational data: knowledge bases you provide (prices, policies, products) and your digital employees' conversations with your customers
• Technical data: IP address, browser and device type, usage logs, and cookies
• Communication data: your messages through contact forms, support tickets, and chats with the smart advisor

3. Why We Collect Your Data (Processing Purposes)

We use your data exclusively for the following purposes:

• Creating and managing your account and delivering the contracted services
• Setting up digital employees and agents and training them on your business knowledge
• Issuing tax invoices and meeting legal and accounting obligations
• Providing technical support, answering inquiries, and improving service quality
• Sending service notifications, and marketing material with your consent, which you may withdraw at any time
• Protecting the platform against fraud and abuse

4. Legal Basis for Processing

We rely on one or more of the following bases: performance of our contract with you or steps taken at your request before contracting; compliance with a legal obligation (such as tax and commercial laws); our legitimate interest in operating, securing, and improving the platform in a way that does not prejudice your rights; or your explicit consent where required, such as for marketing messages.

5. Data Sharing

We never sell your personal data to anyone. We share it only to the minimum extent necessary and with:

• Trusted service providers acting on our behalf (cloud hosting, payment gateways, email services) under processing agreements requiring equivalent protection standards
• AI model providers to the extent needed to operate the digital employees, contractually bound not to use your data to train their models
• Government and judicial authorities where a binding legal request exists
• Any other party with your explicit prior consent

6. Encryption and Information Security

We apply technical and organizational controls including: encryption in transit (TLS 1.2+) and at rest (AES-256), storage of credentials and keys in an isolated secrets vault, need-to-know internal access with audit logs of every operation, periodic encrypted backups, and regular security reviews of our systems.

Nevertheless, no method of transmission or storage is absolutely secure; if a breach affecting your data occurs, we will notify the competent authority and you as required by law.

7. Data Retention

We retain your data for the duration of the engagement and as long as needed for the purposes it was collected for. After the contractual relationship ends, we retain invoicing and financial records for the periods required by tax and commercial laws (up to 10 years), and we delete or anonymize operational data and knowledge-base content within 90 days of subscription end, after enabling you to export it for 30 days.

8. Your Rights Over Your Data

The PDPL guarantees you rights that we enable free of charge:

• Right to be informed: to know how and why we collect your data
• Right of access: to request a copy of the personal data we hold about you
• Right to correction: to correct inaccurate data or complete incomplete data
• Right to deletion: to request deletion of your data once the processing purpose has ended and no legal ground for retention exists
• Right to withdraw consent: to withdraw consent-based processing at any time
• Right to complain: to lodge a complaint with the competent data protection authority in the Kingdom

9. Cookies

We use cookies essential for the platform to function (such as login, language, and theme preferences), and anonymized analytics cookies to understand and improve platform usage. You can configure your browser to reject non-essential cookies, noting that some features may be affected.

10. Data Transfers Outside the Kingdom

We aim to host data within Saudi Arabia whenever suitable infrastructure is available. Where the nature of the service requires processing some data outside the Kingdom (such as AI model providers), this is done only in compliance with the data transfer controls of the PDPL and its regulations, with contractual safeguards ensuring a level of protection no less than legally required.

11. Changes to This Policy

We may update this policy to reflect changes in our services or legal requirements. The updated version is published on this page with its date, and we notify you of material changes by email or an in-platform notice before they take effect.

12. Contacting the Data Protection Officer

To exercise any of your rights or for any privacy inquiry, contact our data protection officer at info@jodfy.com or through the Contact Us page; we will respond within the statutory periods. Headquarters: Riyadh, Saudi Arabia.