Privacy Policy

Scope of this policy

This policy explains how we handle personal data on the Mai marketing website: the details you send when you request a call or consultation, the content of any message you send us, and privacy-preserving analytics about how the site is used. It applies to visitors to this website.

Data controller

The controller of the personal data described in this policy is Mai ("Mai", "we", "us"). Our full registered legal name, commercial registration and national address, and, where required for visitors in the European Union, our appointed EU representative, will be confirmed here once our legal entity is registered. For any privacy question or request, contact us at hello@mai.example.

What we collect

When you request a call or consultation, we collect the name, email, and company you choose to share with us. When you send us a message by email, we process the content of that message to respond to your enquiry. As you use the site, and only after you accept analytics, we process limited technical and usage data (see Cookies and analytics below).

Our role: controller and processor

This policy covers the Mai marketing website, where Mai is the controller of the contact and analytics data described here. Separately, when a client engages Mai to qualify their own leads inside the product, Mai acts as a processor on that client's behalf under a separate data processing agreement, and that product data is outside the scope of this website policy.

Purposes and lawful basis

We use your personal data only for the purposes below, each with a single lawful basis:

We do not intentionally collect sensitive personal data through this site. Where we rely on legitimate interest, we have weighed it against your rights and interests.

Consent and how to withdraw it

Analytics run only after you accept, and you can withdraw your consent at any time. Select "Privacy choices" in the site footer to reopen your privacy options and switch analytics off. Withdrawing consent is as easy as giving it and does not affect any processing that already took place before you withdrew.

Who we share data with

We do not sell your personal data. We share it only with the service providers that help us run the site, each under a data processing agreement:

• PostHog, our product analytics provider, hosted in the European Union. It processes your IP address and a pseudonymous device identifier to measure site usage.
• Cloudflare, which hosts and delivers this site through its global content delivery network.
• Our email provider, which handles the messages you send to our contact address.

We may update this list as our providers change, and will keep it current here.

International transfers

Some of these providers process data outside your country. PostHog stores analytics data in the European Union; Cloudflare serves the site from a global network; and email may be processed abroad. Where data leaves the Kingdom of Saudi Arabia or the European Economic Area, we rely on the appropriate safeguard for that transfer, such as Standard Contractual Clauses, an adequacy decision, or the EU-US Data Privacy Framework, as applicable. The exact mechanism for each provider will be confirmed once our legal entity is registered, and a copy of the relevant safeguard is available on request.

Retention

We keep the details of a contact or consultation request for up to 12 months after our last exchange with you. If an engagement begins, we keep the related data for the duration of that engagement and delete or anonymize it within 12 months of its end, or sooner if you ask. Analytics data is retained, in aggregate, for no more than 14 months under our PostHog settings, and is not linked to your name or email. When a retention period ends, we securely destroy the data.

How we protect your data

We apply appropriate technical and organizational measures: encryption in transit, access controls limited to the people who need it, data minimization, an allow-list that keeps names, emails, and message content out of analytics, and human review of outbound messages. No system is perfectly secure, but we work to keep your data safe.

Your rights under the Saudi PDPL

Under the Saudi Personal Data Protection Law (نظام حماية البيانات الشخصية), its Implementing Regulations, and the oversight of the Saudi Data and AI Authority (SDAIA), you may ask us at any time to:

• Be informed of the legal basis and purpose for collecting your personal data
• Access the personal data we hold about you
• Obtain a copy of your personal data in a clear, readable format
• Correct, complete, or update your personal data
• Request the destruction (erasure) of your personal data when it is no longer needed
• Withdraw any consent you previously gave, at any time
• Lodge a complaint with SDAIA, the competent supervisory authority

If you are in the European Union or the United Kingdom, the GDPR grants you the following additional rights, which we also honor for those visitors:

• Restriction of processing in certain circumstances
• Portability of the data you provided to us
• Objection to processing based on our legitimate interest
• Lodging a complaint with your local data protection supervisory authority

To exercise any of these rights, contact us at the address in the Data controller section. We respond within 30 days, which may be extended in limited, complex cases. Exercising your rights is free, and we may ask you to verify your identity first.

Cookies and analytics

We use cookies and similar technologies, including your browser's local storage. One strictly necessary entry records your privacy choice so we do not ask again; it is not used for tracking and needs no consent. Our analytics provider, PostHog, sets its own cookies and local-storage entries and loads only after you accept. If you decline, or withdraw consent later, PostHog is not loaded and nothing is stored for analytics. We do not use advertising or cross-site tracking cookies.

AI and automated processing

Mai is an AI sales assistant. She identifies herself as an AI the first time she contacts a lead, and every message she sends is reviewed and approved by a person before it goes out, so no decision with a legal or similarly significant effect is made about you by automated means alone. We do not use your data to train external AI models. The demo on this site is illustrative and does not represent a live conversation with a real lead, and the site does no automated decision-making about visitors.

Children

This site and the Mai service are directed to businesses and are not intended for anyone under 18. We do not knowingly collect the personal data of minors. If you believe a minor has given us their data, contact us and we will delete it.

Data breaches

If a personal-data breach occurs that is likely to affect you, we will notify the Saudi Data and AI Authority (SDAIA) within 72 hours of becoming aware of it, as required by the PDPL and its Implementing Regulations, and we will inform affected individuals without undue delay where the breach may cause serious harm.

Changes to this policy

We may update this policy as the site and our practices evolve. Material changes will be shown here with a new "Last updated" date, and continued use of the site after a change means you accept the update.

Contact

Questions about this policy, or requests about your data, can be sent to the address in the Data controller section above.

Language

This policy is published in Arabic and English. If there is any discrepancy between the two versions, the Arabic version prevails.