TrueAi Company is a Saudi company providing software platforms and services to organisations operating in the Kingdom of Saudi Arabia. TrueAi Company is registered with the Ministry of Commerce under Commercial Registration number 7052036550, with headquarters in Khobar, Eastern Province, Kingdom of Saudi Arabia. TrueAi is registered with the National Data Governance Platform under registration number 3260005673.

This Privacy Statement applies to the processing activities for which TrueAi acts as data controller on its own behalf. This Statement does not cover TrueAi's processing of personal data on behalf of its clients during paid engagements. For such activities TrueAi acts solely as a data processor and the relevant engagement contract governs the processing.

If you are looking to understand more about how we use your information, or to exercise your rights, you may reach us at privacy@trueai.com.sa.

This Statement sets out how TrueAi processes personal data in connection with the TrueAi website at trueai.com.sa, the engagement application process, recruitment activities, and direct correspondence with TrueAi. It explains what personal data we collect, why we collect it, how we use it, with whom we disclose it, and what rights you have over it.

This Statement does not apply to personal data we process on behalf of our clients. When we provide our services to clients, we act as a data processor. The client is the controller of the personal data we process during the engagement, and the engagement contract sets out the terms of that processing. If you are seeking to understand how a TrueAi client processes personal data, or if you wish to exercise your rights in relation to data held by a TrueAi client, the relevant client is the appropriate point of contact.

This Statement also does not apply to third-party websites or services linked from the TrueAi website. We are not responsible for the privacy practices of third parties.

We may make updates to this Statement from time to time. When we do so, we will post those changes here. The date at the bottom of this Statement indicates when it was most recently updated.

TrueAi collects personal data through three main sources: personal data you provide to us directly, personal data we collect automatically when you interact with the website, and personal data we obtain from limited third-party sources such as publicly available information.

The categories of personal data we collect are set out below.

Contact data. Name, email address, telephone number, country of residence. We collect this information when you submit an engagement application, when you apply for employment, when you correspond with us by email, or when you provide it directly through any other channel.

Professional data. Company or institution name, job title, industry, professional history, areas of expertise, educational background, certifications. We collect this information when you submit an engagement application or when you apply for employment. For employment applications, the personal data contained in your CV is included in this category.

Engagement inquiry data. The free-text description of the engagement you are proposing, submitted through the engagement application form on the website. This may include information about your organisation, the question you wish TrueAi to investigate, the data you intend to provide, and the operational context of the engagement.

Technical data. IP address, browser type, device type, operating system, pages visited on the TrueAi website, referring URL, timestamps. This information is collected automatically through server logs when you visit the website. With your explicit consent, aggregate visitor measurement is also collected through Cloudflare Web Analytics, which uses a cookie-less beacon.

Communication data. Messages, correspondence, and other data created when you communicate with TrueAi by email, through the engagement application form, or through any other channel. This includes the content of your communications and the metadata associated with them, including dates, times, and recipients.

We use the personal data we collect for the following purposes.

To respond to engagement inquiries. We use contact data, professional data, and engagement inquiry data to evaluate engagement applications and to respond to applicants. This includes determining whether an inquiry fits TrueAi's engagement model, preparing for the engagement if accepted, and communicating the outcome of the application.

To process employment applications. We use contact data and professional data, including the contents of CVs and cover notes, to evaluate candidates for employment at TrueAi. This includes screening applications, scheduling interviews, and communicating outcomes.

To operate the website. We use technical data to operate and maintain the TrueAi website, including ensuring the site functions correctly, investigating technical issues, and protecting the site from misuse.

To communicate with you. We use contact data and communication data to respond to your inquiries, to provide information you have requested, and to maintain professional correspondence.

To comply with legal obligations. We use personal data where necessary to comply with legal obligations under Saudi law, including responses to lawful requests from regulatory authorities, compliance with retention obligations, and the establishment, exercise, or defence of legal claims.

To protect TrueAi and others. We use personal data where necessary to protect the rights, property, and safety of TrueAi, our personnel, our clients, and others, including to investigate and respond to suspected violations of our policies or applicable law.

Under the Personal Data Protection Law, TrueAi processes personal data on one or more of the following legal bases.

The data subject's consent. Where you submit information voluntarily through the engagement application form, the employment application process, or direct correspondence, your submission constitutes consent to the processing described in this Statement.

Performance of a contract. Where processing is necessary to perform a contract with you or to take steps at your request prior to entering into a contract, including evaluating an engagement application.

Compliance with a legal obligation. Where processing is necessary to comply with a legal obligation to which TrueAi is subject under Saudi law.

Legitimate interest. Where processing is necessary for the legitimate interests of TrueAi, provided those interests are not overridden by the rights of the data subject. We rely on legitimate interest for operating the website, protecting TrueAi and others, and limited internal purposes.

TrueAi discloses personal data only in the following circumstances.

Service providers. We disclose personal data as needed to service providers who perform services on TrueAi's behalf, including hosting providers, email providers, and infrastructure providers. These parties are bound by contractual obligations to keep personal data confidential and to use it only for the purposes of providing services to TrueAi. Our principal service providers are identified later in this Statement.

Regulatory authorities and law enforcement. We disclose personal data where required to comply with a lawful request from a competent authority, including the Saudi Data and Artificial Intelligence Authority, the National Cybersecurity Authority, courts, prosecutors, or other governmental bodies acting within their lawful jurisdiction.

Legal claims and protection. We disclose personal data where necessary to establish, exercise, or defend a legal claim, or to protect the rights, property, or safety of TrueAi, our personnel, our clients, or others.

Business transfers. We may disclose personal data in connection with a corporate transaction such as a merger, acquisition, financing, or sale of assets, subject to confidentiality obligations and applicable data protection law.

TrueAi does not sell personal data. TrueAi does not share personal data with advertising networks or third-party advertising platforms. TrueAi does not engage in targeted advertising.

The principal service providers TrueAi uses to operate the website and conduct business are as follows.

Hosting. The TrueAi website is delivered through Cloudflare, and its backend services run on Huawei Cloud infrastructure located within Saudi Arabia. Personal data submitted through the website is stored on infrastructure located in Saudi Arabia.

Email. Email correspondence with TrueAi is handled through Proton Mail, an encrypted email service operated by Proton AG. Email content is stored on Proton infrastructure located in Switzerland.

Application data storage. Personal data submitted through the engagement application form and the employment application process is stored in encrypted form on infrastructure located within Saudi Arabia.

The Personal Data Protection Law and the Regulation on Personal Data Transfer outside the Kingdom govern the transfer of personal data outside Saudi Arabia. Where TrueAi transfers personal data outside the Kingdom, the transfer is made in accordance with the requirements of those regulations.

Email correspondence with TrueAi is transmitted through Proton Mail and stored on infrastructure located in Switzerland. Switzerland is generally recognised as providing an adequate level of data protection.

Other personal data processed by TrueAi is stored within Saudi Arabia and is not transferred outside the Kingdom in the ordinary course of business. Where a transfer outside the Kingdom is required for a specific purpose, TrueAi will ensure the transfer is conducted in compliance with the Personal Data Protection Law and its implementing regulations.

We retain personal data only for as long as necessary for the purposes for which it was collected, or as required to comply with legal obligations, resolve disputes, and enforce agreements.

Engagement inquiry data. Personal data submitted through the engagement application form is retained for twelve months from submission for unsuccessful inquiries. For applications that result in an engagement, personal data is transferred into the engagement record and is retained for the duration of the engagement and any applicable post-engagement period defined in the engagement contract.

Employment application data. Personal data submitted through the careers page is retained for twelve months from the date of application for unsuccessful candidates. With your consent, we may retain your application materials for a longer period in our candidate pool for future opportunities.

Correspondence. Email correspondence and other communications are retained for the duration of the relevant matter and for a reasonable period afterwards consistent with TrueAi's record-keeping practices.

Technical data. Server logs and other technical data are retained for a limited period sufficient to operate and secure the website, typically not exceeding ninety days.

After the applicable retention period, personal data is deleted or anonymised, except where longer retention is required by law or necessary for the establishment, exercise, or defence of legal claims.

The Personal Data Protection Law grants data subjects the following rights in relation to personal data processed by TrueAi.

The right to be informed about the processing of your personal data, including the legal basis, purposes, and recipients.

The right to access personal data we hold about you and to obtain a copy.

The right to request correction of personal data that is inaccurate, incomplete, or out of date.

The right to request deletion of personal data, where the personal data is no longer necessary for the purposes for which it was collected, where you withdraw consent, or where other grounds for deletion apply under the Personal Data Protection Law.

The right to withdraw consent at any time, where processing is based on consent. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

These rights are not absolute. In some circumstances, TrueAi may be permitted or required to retain or continue processing personal data notwithstanding a request from the data subject, including where required by law, where necessary for the establishment, exercise, or defence of legal claims, or where the rights of other individuals must be balanced against the request.

To exercise any of the rights set out above, please contact TrueAi at privacy@trueai.com.sa. Your request should include sufficient information to allow us to verify your identity and to identify the personal data to which your request relates.

We will respond to your request within thirty days of receipt, in accordance with the Personal Data Protection Law. In some circumstances, this period may be extended where the complexity of the request requires additional time. You will be informed of any such extension.

If you believe TrueAi has not adequately addressed your request, or if you believe TrueAi is processing your personal data in breach of the Personal Data Protection Law, you have the right to lodge a complaint with the Saudi Data and Artificial Intelligence Authority.

The TrueAi website does not set tracking cookies. The only browser storage we use is a session-scoped flag that suppresses the loading splash within a browser session; it clears when you close the browser and is strictly necessary for the interface, which under PDPL means no consent is required.

TrueAi uses Cloudflare Web Analytics for aggregate visitor measurement, including page views, country-level geography, and browser type. The beacon is cookie-less, does not identify individuals, and does not contain a cross-site identifier. The beacon loads only after you have accepted consent. You may withdraw consent at any time through the Cookies link in the footer.

TrueAi does not use advertising cookies, third-party tracking pixels, social-media re-targeting, or any cross-site identifier.

The TrueAi website and services are not directed at individuals under the age of eighteen. TrueAi does not knowingly collect personal data from individuals under eighteen. If you believe a minor has provided personal data to TrueAi, please contact us at privacy@trueai.com.sa and we will take steps to delete it.

TrueAi implements technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration, or destruction. These measures include encryption of data at rest and in transit, access controls, audit logging, and restricted internal access on a need-to-know basis. No system of electronic storage or transmission is completely secure, and TrueAi cannot guarantee absolute security.

This Statement may be updated periodically to reflect changes in TrueAi's practices or in applicable law. The most recent version of this Statement is always available at trueai.com.sa. Material changes will be communicated through the website or through other appropriate means.

To exercise your rights, to ask questions about this Statement, or to raise any other matter relating to TrueAi's processing of your personal data, please contact:

TrueAi Company

Attention: Data Protection

Khobar, Kingdom of Saudi Arabia

Email: privacy@trueai.com.sa