Privacy

Who is responsible for your data

Jazerah Al Ibdaa is the controller of the personal data of visitors to this site and of the people who hold an account on the platform: it decides why and how that data is used. It is run by one operator in Jeddah, Saudi Arabia, who is named with the registration at the end of this notice. For the customers of a business that uses the platform, that business is the controller and Jazerah Al Ibdaa is its processor: it handles their messages on the business's instructions. If you wrote to a business and want to know what it holds about you, ask that business first.

Public site

You can browse the public site without creating an account. The public AI demonstration and its contact form were withdrawn on 11 October 2026, and the site no longer collects conversations or contact requests from visitors. What they collected before that date is described under “The former public demonstration” below.

Workspace accounts

A hosted workspace may contain account details such as name, business details, email address, password hash, multi-factor authentication records, invitations, and security events. Passwords are not stored in readable form. We use these details to provide sign-in, workspace security, support, and requested account operations. An email address is required to open an account; the rest is given as the account is used. If you sign up with a partner's referral code, your business is recorded as brought by that partner, with the trial and the price the code gave it, so that we can pay the partner a commission from your payments. The partner is not told who you are and receives none of your data.

Business records

When a business uses the workspace, it may store client profiles and contact details, conversations and messages, documents and revisions, approved knowledge, assistant rules and profiles, bookings, tickets, notifications, and action or audit records. The business chooses what to enter and remains responsible for its instructions, permissions, notices to its customers, and lawful use of those records.

AI processing

Relevant uploaded documents and chat or business context may be sent to DeepSeek to extract information, draft replies, assess instructions, or select permitted actions. DeepSeek processes this data in China, outside Saudi Arabia. Before a message is sent, phone numbers, email addresses, and bank, card and identity numbers found in it are masked. Masking reduces exposure but cannot guarantee that all identifying information is removed. Only upload information you are authorised to process. AI output may be inaccurate; businesses control available capabilities and whether actions need human approval. Replies are written and sent automatically. The assistant makes no decision with legal effect about a person, a business's staff can take over any conversation, and a customer can ask for a person.

WhatsApp, Instagram and other integrations

A business may connect messaging or other integrations. If WhatsApp or Instagram is enabled, the relevant business account identifiers, access tokens, phone numbers or Instagram account identifiers, message content, and attachments may be processed by the configured channel providers to deliver the requested service; they are not used for advertising by us. The integration is optional, and disconnecting it does not by itself delete historical records. Provider availability and configuration can change, so the workspace and this notice should be checked before activation.

Hosting, email, and infrastructure

The platform and its database run on Oracle Cloud Infrastructure in Jeddah, Saudi Arabia. Oracle Email Delivery sends account messages such as verification and password-reset links. Business mailboxes use Google Workspace. Hosting in Saudi Arabia does not prevent cross-border processing by AI, email recipients, or optional messaging providers. See the service-provider page for more information.

Cookies and analytics

The site sets only the cookies it needs to work, listed here. Visits to the public pages -- not the dashboard -- are counted with Cloudflare Web Analytics, without cookies: Cloudflare, in the United States, receives the address of the page, the page you came from, the browser and device type, and the country worked out from your connection, and uses no cookies or fingerprinting to follow you. The site loads no advertising or tracking tools, so there is no cookie banner to answer. A browser that used the former public demonstration may still hold its returning-visitor reference. The reference itself holds no name, contact details, or message content, it expires within 180 days of the visit, and nothing uses it any more.

• __Host-session: keeps you signed in. It is set when you sign in and has no date of its own: the sign-in ends when you sign out, after 24 hours without use, or after 30 days at most.
• __Host-csrf: protects the sign-in and account forms from requests made by another site. It is set when one of those pages is opened.
• jz_locale: remembers Arabic or English. Kept for 365 days.
• jz_ref: keeps a partner's referral code when you open a link such as ?ref=CODE, so the sign-up form can fill it in. It holds the code and nothing about you, only the sign-up page reads it, and it is kept for 30 days.
• jai-theme: remembers light or dark. Kept for one year.
• Browser storage: light or dark, and, after sign-in, how far you are through the setup guide.

The former public demonstration

Until 11 October 2026 this site offered a public AI demonstration and a contact form. We still hold what visitors sent to them: the conversation, any contact request, and a visitor record that the returning-visitor reference pointed to. If you shared a phone number, it is stored in that visitor record, and visits made with the same number from different devices were joined into a single record of you as a person. A conversation is deleted 180 days after the visit. A contact request, and the conversation it came from, is kept until you ask us to delete it, and the visitor record is deleted once nothing refers to it. You can ask us to delete any of this using the contact details below.

Your choices and rights

You may request access to a readable copy of your personal data, correction or completion, or deletion, and withdraw consent where consent is the basis for processing. We may need to verify your identity and consider other people's rights and applicable legal retention requirements. For records held by a business using Jazerah, contact that business first; we assist with platform-related requests. We answer within 30 days; if a request needs longer we tell you, and never more than 30 days more. An account holder can also act directly: a workspace's owner can close and delete the workspace in its settings, and a business can correct or erase one customer's records from the conversation screen or from the client's profile under Clients. Contact Jazerah using the details below. If a request is not resolved, you may complain to the Saudi Data and Artificial Intelligence Authority (SDAIA) within 90 days, through its platform at dgp.sdaia.gov.sa.

Retention and deletion

These are the periods the system enforces. A record's end date is written on it when it is saved, and a job that runs every night deletes it. Disconnecting an integration does not by itself delete stored messages or business records. Contact us to request deletion of those records or to ask which retention period applies.

• A customer's messages, the conversation and the contact record, tickets and notifications: 180 days. A message counts from when it was sent or received; a conversation from that person's last message; a contact from that person's last message, or from the business's last save of that client under Clients or the assistant's last change to it, if that is later. A client the business added by hand before 21 October 2026 who has not written or been saved since has no end date yet, and is kept until the business deletes it.
• A booking: 180 days after the appointment.
• A whole workspace: when its owner closes it, 30 days in which the closure can be undone, then its records and its search index are destroyed, apart from the payment and security records below.
• One customer of a business: erased at once when the business deletes that person's data from the conversation screen or from the client's profile under Clients.
• Sign-in accounts: kept while in use. Closing a workspace does not by itself delete each member's sign-in account; ask us and we delete it.
• Payment records: kept after an account closes, because financial records must be kept. They hold no card number, name or address.
• Security and audit records: kept while they are needed for security and for legal claims. They hold no message content.
• Backups: a copy of the database made on the host is deleted after 14 days. Three encrypted backups are kept off the host, and a deleted record leaves them as each is replaced.

Why we process information

We use information to provide the requested service and account operations, fulfil applicable contractual and legal obligations, protect the platform, and respond to enquiries. Where processing relies on consent, you can withdraw it. A business using the workspace determines the purposes and instructions for its customer records and must have an appropriate lawful basis; Jazerah determines the processing needed for its own website and platform accounts.

• Opening and securing an account (email, name, password hash, two-step sign-in records, sign-in and security events): the contract with the account holder.
• Taking payment (payment reference, amount, date and status; never a card number): the contract, and the legal duty to keep financial records.
• Security and audit records (an account reference and an internet address beside each sensitive action): our legitimate interest in keeping the platform secure, and legal duties about security records.
• Answering an enquiry sent by email, phone or WhatsApp: your request.
• The former public demonstration: consent for a contact request, and our legitimate interest for the conversation itself.
• A business's customer records: the legal basis is the business's own, as their controller.

Security

Passwords are stored only as Argon2id hashes. Two-step sign-in is available, and a business can require it. Each business's records are separated in the database so that one business cannot read another's, and connection tokens are stored encrypted. The site is served only over an encrypted connection. No system is beyond failure: if a breach is likely to harm you, we tell SDAIA within 72 hours of learning of it and tell you without undue delay, and we tell the business concerned when the data is its customers'.

Children

The platform is a tool for businesses and is not directed to anyone under 18. We do not knowingly open an account for a minor. A parent or guardian who believes we hold a minor's data can contact us and we will delete it.

Changes to this notice

We change this notice when what we do changes, and the changes are listed here.

• 11 October 2026: the public demonstration and its contact form were withdrawn.
• 11 October 2026: the notice was rewritten to name the controller, the legal basis for each purpose, the retention periods, the country each provider is in, and the cookies.
• 18 October 2026: visits to the public pages are now counted with Cloudflare Web Analytics, without cookies.
• 21 October 2026: a client's record also counts its 180 days from the business's last save of it, with the exception for older clients given under “Retention and deletion”, and the notice names the client's profile under Clients as a second place a business deletes one customer's data.
• 26 October 2026: a partner's referral link sets the jz_ref cookie, which keeps the code for 30 days, and a business that signs up with a code is recorded with the partner, so the partner can be paid a commission; the partner receives no data about you.
• 26 October 2026: a business can connect Instagram as well as WhatsApp; the Instagram Direct Messages its customers send it are handled as WhatsApp messages are, through Meta, and the Meta entry on the service-provider page names Instagram.

Last updated

26 October 2026.