JAIJazerah Al IbdaaSmart AI Systems

Terms

Subprocessors

Every third party that receives personal data when you use this service, what it receives, where it is, and why. We update this page in the same change that connects a new provider -- a list updated afterwards is wrong in between, and in between is when it matters.

DeepSeek - generating replies

Receives the message text and recent conversation so the assistant can answer. Hosted in China. Before anything is sent we replace the identifiers people actually type -- phone numbers, national ID and Iqama numbers, IBANs, email addresses and card-length numbers -- with placeholders, and put the real values back into the reply afterwards. The model never receives them. Every call is recorded with the provider and country that handled it.

Twilio - WhatsApp messages

Carries messages to and from WhatsApp, so it receives the phone number and the message. United States, with global infrastructure. It is the channel you chose to write on; there is no way to deliver a WhatsApp message without it.

Meta - WhatsApp itself

WhatsApp is Meta's, so Meta receives the phone number, the WhatsApp profile name and the message on every WhatsApp conversation -- including today, through Twilio, which resells Meta's own API. United States, processing globally. A business can now connect its WhatsApp account to us directly instead, which takes Twilio out of the middle rather than adding anyone: the account and the number stay the business's own, and we send using that business's credential, never a shared one.

Telegram - Telegram messages

Carries messages to and from Telegram: the chat identifier and the message. Only for businesses that connect it.

Railway - hosting

Runs the service and its database, so it holds everything we store. United States. The database is encrypted at rest, and any provider credentials a business stores are separately encrypted with a key held outside the database -- a copy of the database alone does not reveal them.

Cloudflare - protection in front of the site

Sits in front of the website, so every visit passes through it before reaching us. It receives your IP address, the page you asked for, and your browser's headers -- not the contents of your conversation. A global network; visits from Saudi Arabia are normally served from inside the region. It is there to encrypt the connection and to absorb attacks before they reach the service. Switched on 29 August 2026.

Google Analytics - website measurement

Measures traffic on the public marketing pages only: IP address, device and page. United States. It does not load until you consent, the consent request covers Saudi Arabia and the Gulf, and it is absent entirely from the customer dashboard.

Not currently receiving anything

Our software can also work with Anthropic and with OpenAI-compatible services, and can use a hosted Qdrant search index. None of these is switched on, so none of them receives anything today. If that changes, this page changes in the same release.

Chosen but not connected yet

We have chosen Resend to send account email and Paddle to take payment, and neither is connected: no message has been sent through Resend and no payment has been taken. We have not chosen a second WhatsApp provider. Each moves into the list above in the release that connects it. When payments do begin, card details go straight to Paddle and never reach us -- there is no place in our database that could hold one.

What leaves Saudi Arabia

Three things, all deliberate. Replies are generated in China, which is why we remove identifying details before sending and why every one of those calls is logged. The service is hosted in the United States. And every visit passes through Cloudflare's global network, which sees your IP address before we do -- visits from Saudi Arabia are normally handled inside the region, but the network is worldwide. Moving hosting to a Saudi region is possible: nothing in our software is tied to the current host.

Asking what happened to your data

Because every model call records which provider and which country handled it, we can tell you exactly which third parties saw a given conversation. Those records deliberately contain no message text. Contact us using the details on the privacy page.

Contacting us about your data

Jazerah Al Ibdaa, Jeddah, Saudi Arabia. To ask what we hold about you, to have it corrected, or to have it deleted, reach us on either channel below. We answer within 30 days, as the Saudi Personal Data Protection Law requires.

← Jazerah Al Ibdaa