We treat your data like we treat our code, with care, and in the open.

The controller of your personal data is Makhabir Al-Muntajat Al-Raqamiya Company for Telecommunications and Information Technology (شركة مخابر المنتجات الرقمية للاتصالات وتقنية المعلومات), trading as Projex Labs, a one-person limited liability company registered in the Kingdom of Saudi Arabia under Unified National Number 7053866732.

• Address: Building 6268, Al Olaya Street, Al Olaya District, Secondary No. 3953, Riyadh 12211, Kingdom of Saudi Arabia (National Address: RHOB6268).
• Privacy requests, including account deletion: privacy@projexlabs.com
• General contact: hi@projexlabs.com

We are the controller for personal data we process for our own purposes: your account, sign-in, billing, support, security, communications with you, and our websites.

We are a processor for personal data inside content our business customers put into the Services, for example the conversations between a business's customers and an AI agent it runs on Cohort, the records and files that agent collects, code and project data in Trellis, and data passing through accounts a business connects to Skyline. In those cases the business customer decides why and how the data is processed, and its own privacy notice applies. We process that data only on its instructions, under a data processing agreement. If you are the end user of one of our customers, please contact that customer first. We will help them respond to you.

2.1 Our websites

When you email us or use an email-me link, we receive your name (if provided), your email address and your message. We set a single language-preference cookie (pxl_lang) on your device to remember whether you prefer the English or Arabic edition. Our hosting infrastructure generates standard server request logs (IP address, user agent, requested URL, timestamp), kept only for security and diagnostics. Some pages load web fonts from Google Fonts, which means Google receives your IP address and browser information. We do not use marketing cookies, advertising pixels, session replay, heatmaps or third-party analytics.

2.2 Your account

Sign-in. You sign in with an account you already have at Google, Apple, Microsoft or GitHub. We do not ask for or store a password. The provider shares with us your name, your email address, a unique account identifier and, where available, your profile picture and whether your email address is verified. If you choose Apple's "Hide My Email", we receive a private relay address and use it like any other email address. We use sign-in data only to create and secure your account and to communicate with you. We do not use it for advertising and we do not sell it.

Payment cards. Card numbers are collected and stored by our payment provider, not by us. We receive and keep only limited details such as the card brand, the last four digits, the expiry date and the payment status.

2.3 What our products handle

• Cohort: the conversations and records your AI agents handle, the files and images they read, and the sealed records they produce.
• OmniDeck: your chats, files and memory, and your voice. Voice audio is transcribed as it is received and is not stored; the transcripts are kept as described in section 5.
• Trellis: code, tasks, documents and project data you store, and the actions of the AI agents you authorise.
• Skyline: the connections you make to third-party accounts and the data those services return for the actions you or your AI assistant ask for. This can include messages, contacts, files or other records in that account. We use it only to carry out the action you asked for.
• Projex Academy: your enrolments, progress, submissions and grades.

2.4 Data we collect automatically

This storage is strictly necessary or holds settings you chose, so it does not require your consent. If we ever introduce optional storage, such as analytics, we will ask for your consent first.

2.5 Sensitive data

We do not ask you for sensitive personal data such as health information, and you should not give it to us unless the Service is configured for it. Some business customers use Cohort to collect health information from their own patients or clients. In that case we process it as their processor, access is limited to the minimum necessary staff, and we apply the additional safeguards Saudi law requires for sensitive data.

AI training. We do not use your content, your outputs, or the content our business customers process through the Services to train or improve AI models.

Automated decisions. We do not make decisions about you that produce legal or similarly significant effects based only on automated processing. Automated checks are used to prevent trial abuse and to enforce plan limits. If you think one of them has affected you wrongly, contact us and a person will review it.

Many Services work by sending your content to AI models to generate a response.

• Who receives it. The content is processed by AI model inference providers that we use as subprocessors. We describe them by category; business customers can obtain their names under confidentiality on request. The content is sent only to produce the response for you.
• Where. The providers may process it outside the Kingdom of Saudi Arabia, as described in section 7.
• Your own AI. Where you choose to connect your own AI model provider or assistant, the content you send goes to that provider under your own agreement with it.
• Notice. This notice tells you that AI features send your content to these providers.
• Your choice. Where a law or an app store requires it, we ask for your permission before that happens. You can choose not to use AI features, but many Services cannot work without them.

We keep personal data only as long as needed for the purpose it was collected for, then delete it or make it anonymous.

5.1 We may keep personal data longer where the law requires it, to establish or defend legal claims, or to prevent fraud and abuse. Where a business customer has set a different retention period for content it controls, that period applies.

5.2 Under Saudi law, records of processing activities are kept for the period of processing and five years after it ends.

We do not sell personal data and we do not share it for targeted advertising. We share it only as follows.

1. Service providers (subprocessors) that host, operate and support the Services on our behalf under contracts that require them to protect the data and use it only on our instructions:

We give business customers at least 30 days' notice of a new subprocessor, as set out in our data processing agreement.

1. Sign-in providers you choose to use (Google, Apple, Microsoft, GitHub). They are independent controllers for the data they hold about you on their own platforms, and we receive only the limited details described in section 2.2.
2. Business customers. If you use a Service through an organisation's account, that organisation can see and manage your account and content within it.
3. Services you connect. When you connect a third-party service, we exchange data with it as you direct.
4. Legal and safety. We disclose data where required by law or by a competent authority, or where necessary to protect the rights, safety or property of our users, the public or Projex Labs.
5. Business transfers. If we are involved in a merger, acquisition or sale of assets, personal data may be transferred to the successor, which will be bound by this notice or give you notice of any change.

Our primary infrastructure, including the databases that hold account data and content, is hosted with Oracle Cloud Infrastructure in its Riyadh region, inside the Kingdom of Saudi Arabia. We also keep backup copies on servers we operate ourselves in Riyadh.

Some providers process personal data outside the Kingdom: content delivery networks, AI model providers, email delivery, sign-in providers and web font providers. When we transfer personal data outside the Kingdom, we do so in accordance with the PDPL and its Regulation on Personal Data Transfer outside the Kingdom. That means we transfer only what the purpose needs, carry out the risk assessments the Regulation requires, and rely on a transfer mechanism it recognises, such as an adequacy decision or the Standard Contractual Clauses issued by SDAIA. For transfers of personal data of people in the European Economic Area or the United Kingdom, we use the European Commission's Standard Contractual Clauses or the UK equivalent where they are required. You can ask us for more information about the safeguards we use.

We never transfer personal data for advertising, profiling or secondary purposes.

Subject to the conditions and exceptions in the law, you have the right to:

1. be informed about how your personal data is processed, which this notice does;
2. access your personal data and obtain a copy in a readable format;
3. correct inaccurate or incomplete data;
4. delete your data when it is no longer needed or when you withdraw consent;
5. withdraw your consent at any time where we rely on consent, without affecting processing that has already taken place;
6. object to or restrict certain processing, and to data portability, where those rights apply to you under the law of your country; and
7. not be subject to a decision based solely on automated processing that produces legal effects.

How to exercise your rights. Use the controls in the product where they exist, or email privacy@projexlabs.com. We may ask you to verify your identity before we act on a request. We will respond within 30 days. If we need longer, we will tell you why, and the extension will not exceed a further 30 days. Exercising your rights is free, unless a request is manifestly unfounded or excessive.

Deleting your account. You can request deletion of your account and its data at any time at projexlabs.com/legal/delete-account or by emailing privacy@projexlabs.com. We will confirm when the deletion is complete.

• Deleting your account does not delete data that a business customer controls in its own account. Ask that customer.
• If you subscribe through an app store, cancel your subscription there as well.

If you believe we have violated your rights under the PDPL, you can file a complaint with the Saudi Data and AI Authority (SDAIA) through sdaia.gov.sa or the National Data Management Office (NDMO). If you live in the European Economic Area or the United Kingdom, you may complain to your local supervisory authority. You keep all rights under Saudi law to seek judicial redress. We also welcome complaints directly at privacy@projexlabs.com. We would rather hear about it and fix it than have it go to the authority first.

We use administrative, technical and physical safeguards designed to protect personal data, including encryption in transit, encryption of sensitive credentials at rest, access controls limited to staff who need them, one-way hashing of API keys, audit logs, and separation of each customer account's data. We align our broader security posture with the National Cybersecurity Authority (NCA) Essential Cybersecurity Controls (ECC) and Cloud Cybersecurity Controls (CCC) where applicable.

No method of transmission or storage is completely secure. If a personal data breach occurs, we will notify SDAIA within 72 hours of becoming aware of it, and business customers without undue delay, and affected individuals without undue delay where the breach may harm them, as the law requires.

The Services are not intended for anyone under 18, and we do not knowingly collect personal data from children. If you believe a child has given us personal data, contact privacy@projexlabs.com and we will delete it.

We send service messages that are necessary for your account, such as security alerts, receipts and important changes; you cannot opt out of these while your account is open. We send marketing messages only with your consent. Each one identifies us and contains a free way to unsubscribe, which we honour promptly.

We may update this notice to reflect changes to the law, our practices or the Services. If we make a material change (new data collection, new purposes, new recipients, new international transfers), we will notify you by email or in the Services at least 30 days before it takes effect. Where a change affects how we use data we received from a sign-in provider, or the law requires consent, we will ask for your consent before applying it. The date at the top shows when this notice was last updated.

Privacy requests and questions: privacy@projexlabs.com, with the subject "Privacy request" and your preferred language (EN/AR). We respond within 30 days.

Post: Makhabir Al-Muntajat Al-Raqamiya Company for Telecommunications and Information Technology (Projex Labs), Building 6268, Al Olaya Street, Al Olaya District, Secondary No. 3953, Riyadh 12211, Kingdom of Saudi Arabia.