Privacy Policy for Etlaq Platform

1. Who We Are and Scope

Etlaq operates a Saudi-focused AI product-building platform from Dhahran, Saudi Arabia. References to "Etlaq", "we", "us", or "our" mean the Etlaq Platform team responsible for operating the service.

This policy applies to visitors, registered users, guest users, customers, and people who contact us. If you build or publish an application using Etlaq that collects personal data from your own end users, you are responsible for providing your own privacy notice and obtaining any required consent from those end users.

2. Personal Data We Collect

We collect only data that is reasonably needed for the purposes described in this policy. Depending on how you use Etlaq, this may include:

• Account and identity data: name, email address, phone number, authentication method, user ID, account type, legal consent version, and account status.
• Contact and support data: messages, support requests, abuse reports, security reports, attachments you choose to send, and related communication history.
• Project and generated-app data: prompts, instructions, text, code, files, images, configuration, project titles, deployment information, logs, generated outputs, and app settings you create or upload.
• Billing data: plan, credits, invoices, transaction records, payment status, billing metadata, and limited payment identifiers. Full card details are processed by our payment provider and are not stored by Etlaq.
• Device and usage data: IP address, approximate location derived from IP, browser, operating system, device identifiers, session identifiers, pages viewed, features used, errors, performance events, and security logs.
• Integration data: information needed to connect services you authorize, such as GitHub import or sync details, analytics connections, deployment providers, model providers, or other app connectors.
• Cookie and preference data: language, theme, session state, security tokens, cookie-consent choices, and optional analytics preferences.

3. Data We Ask You Not to Submit

Etlaq is not designed for processing highly sensitive personal data unless we expressly agree in writing. Please do not submit health records, biometric data, national ID copies, financial account credentials, children’s data, confidential third-party data, or production secrets unless you have a lawful basis and appropriate authority to do so.

If you enter third-party personal data into prompts, files, or generated applications, you are responsible for ensuring that your collection and use of that data complies with applicable law.

4. Purposes and Legal Bases

We process personal data for the following purposes:

• To create and secure accounts, authenticate users, prevent abuse, and maintain service integrity.
• To provide the AI builder, generate code and apps, run builds, store project files, deploy previews, and support collaboration or version history.
• To process subscriptions, credits, invoices, refunds where applicable, fraud checks, and payment confirmations.
• To provide customer support, respond to legal, privacy, security, partnership, and abuse inquiries, and maintain communication records.
• To measure product reliability, diagnose errors, improve performance, and understand feature usage when analytics are enabled.
• To enforce our Terms of Use, investigate prohibited activity, protect users and the platform, and comply with Saudi legal obligations.

5. AI Processing and Generated Applications

Etlaq uses AI systems and infrastructure providers to turn your prompts, files, and instructions into application code and related outputs. Your project content may be processed by model, sandbox, storage, deployment, and infrastructure providers as needed to deliver the service.

You should review generated outputs before launch. AI-generated code or content may be incomplete, insecure, inaccurate, or unsuitable for regulated use without human review. You remain responsible for the applications you publish and the data they collect from your own users.

6. Sharing and Service Providers

We do not sell personal data. We share personal data only when needed to operate Etlaq, comply with law, protect the service, or complete a transaction you request.

• Payment providers, including Moyasar, to tokenize cards, process Mada, card, and Apple Pay transactions, verify payment status, and manage billing records.
• Analytics providers, including PostHog and Google Analytics, only where analytics are configured and consent is granted where required.
• Cloud, hosting, database, storage, sandbox, deployment, and monitoring providers used to run the platform and generated-app workflows.
• AI model and tool providers used to generate, analyze, or modify project outputs at your request.
• Integration providers you authorize, such as GitHub or deployment services, according to the permissions you grant.
• Professional advisers, auditors, or authorities when required to comply with law, resolve disputes, investigate abuse, or protect rights and safety.
• Successors in a merger, acquisition, financing, reorganization, or asset transfer, subject to appropriate confidentiality and data-protection commitments.

7. International Transfers

Etlaq is built for users in Saudi Arabia, but some service providers may process or store data outside the Kingdom. Where a transfer outside Saudi Arabia is necessary, we use it only for legitimate service purposes and apply contractual, technical, and organizational safeguards intended to meet the PDPL and its Implementing Regulations.

If a feature requires a third-party provider outside Saudi Arabia, using that feature may involve transmitting the data needed for that feature to the provider you choose or authorize.

8. Retention

We keep personal data only as long as needed for the purposes in this policy, unless a longer period is required or permitted by law. Our retention approach is:

• Account data is kept while your account is active and for a reasonable period after closure for security, audit, dispute, and legal purposes.
• Project content is kept while your project or account remains active, until you delete it, or until we remove it under our retention, abuse, or legal processes.
• Payment, tax, invoice, and transaction records are kept for the periods required by accounting, tax, anti-fraud, and payment laws.
• Operational logs, security logs, analytics records, and backups are kept only as long as needed for security, reliability, investigation, and recovery, then deleted or de-identified where feasible.
• Cookie-consent records are normally stored for up to 12 months unless you reset or update your preference sooner.

9. Security

We use reasonable technical and organizational safeguards, including access controls, encryption in transit, role-based access, monitoring, logging, backups, and vendor review. No online service can guarantee absolute security, and you are responsible for using strong credentials, protecting access tokens, and reviewing what you publish.

10. Your PDPL Rights

Subject to the PDPL and other applicable laws, you may have the right to be informed about processing, access your personal data, request a copy in a readable format where technically feasible, request correction or completion, request destruction of data that is no longer needed, withdraw consent where processing is based on consent, and object or restrict processing where the law allows.

To exercise these rights, contact studio@etlaq.sa. We may ask for information needed to verify your identity and protect your account before fulfilling a request.

11. Complaints

If you believe your personal data has been handled incorrectly, please contact us first at studio@etlaq.sa so we can investigate and respond. If you are not satisfied, you may submit a complaint to the competent Saudi data protection authority, currently the Saudi Data & AI Authority (SDAIA), or any successor authority designated under the PDPL.

12. Children

Etlaq is not intended for children under 18. We do not knowingly collect children’s personal data. If you believe a child has provided personal data to Etlaq without appropriate authority, contact us so we can review and take appropriate action.

13. Third-Party Links and Customer Apps

Etlaq may link to third-party services, and users may publish applications built with Etlaq. Third-party services and customer-built applications are governed by their own terms and privacy practices. Review those policies before submitting personal data to them.

14. Changes

We may update this policy when our services, providers, legal obligations, or operational practices change. The latest version will be posted on this page. For material changes, we will provide reasonable notice through the platform, email, or another appropriate channel.

15. Contact

Privacy requests and questions: studio@etlaq.sa. Location: Dhahran, Kingdom of Saudi Arabia.

Third-Party Integrations You Connect (ChatGPT)

You may choose to connect Etlaq to ChatGPT. The connection is made with OAuth: you sign in to Etlaq, review the permissions being requested, and approve them. Your Etlaq password is never shared with OpenAI.

When you use the integration, Etlaq receives only what is needed to carry out the action you asked for: your Etlaq user identity, the project you named, and, where you ask for a build, the description you provided. Etlaq does not receive your ChatGPT conversation history.

In the other direction, Etlaq returns to ChatGPT only the data covered by the permissions you approved, such as project names, deployment status, published URLs and build results. Once returned, that data is handled by OpenAI under its own privacy policy, which is outside our control.

Access tokens issued to ChatGPT are short-lived, limited to the permissions you approved, and can be revoked. Disconnecting the integration in ChatGPT revokes them, after which further requests are refused. Disconnecting does not delete anything in your Etlaq account.

We log integration requests for security and troubleshooting, including the action taken, the project involved and a request identifier. Access tokens, authorization headers and other secrets are never written to logs.