Privacy Policy

At Karam, we are committed to protecting the privacy of the users of our website and platform. This policy explains the types of data we collect, how we use it, your rights regarding it, and how we protect it, in accordance with the Saudi Personal Data Protection Law (PDPL).

Data controller: Karam, Commercial Registration No. 1009089390, Riyadh, Kingdom of Saudi Arabia.
Data Protection Officer (DPO): [email protected].

1. Data we collect

We may collect different types of data depending on how you interact with the website or the platform, such as:

a. Data you provide directly

• Your name, email address, mobile number and similar identifying data, when you book a call or fill in a contact form.
• Company name, sector, size of operations and any other business information, when you subscribe to or try the platform.
• Any information you choose to send us by email, WhatsApp or other communication channels.

b. Data we collect automatically

• Technical data such as IP address, browser type, operating system, pages visited, visit duration and similar.
• Cookies and similar identifiers, to improve the website experience and measure performance.

c. Data within the platform

If you are a Karam customer, we process the conversations and data you connect to the platform (such as document files, store systems and customer records) to run the AI in accordance with the service agreement concluded with you.

The list of approved sub-processors is available on request to platform customers via [email protected].

2. How we use your data

• To operate the platform and provide the agreed services.
• To contact you about your inquiries, requests or account updates.
• To improve platform performance and measure the effectiveness of the AI.
• To comply with statutory and legal obligations in the Kingdom.

We use your data only for the purposes listed above. We do not trade it, and we do not use it for any marketing without your explicit consent.

3. Data protection and retention

We apply appropriate technical and administrative security controls to protect your data from unauthorized access, modification or disclosure, in line with applicable industry best practices. These controls may evolve from time to time to suit the nature of the service and changing risks.

We use reliable cloud infrastructure that is subject to approved security controls. Some processing may take place through service providers outside the Kingdom of Saudi Arabia, in accordance with the Personal Data Protection Law and the related international transfer regulations.

We follow the principle of minimum retention set out in the Personal Data Protection Law: we do not keep personal data longer than required by the purposes of its processing or by the statutory obligations that apply to us.

• Visit and analytics data: kept for as long as needed for analysis and improvement, then deleted or aggregated anonymously.
• Account and conversation data: processed throughout your subscription, and deleted when the purpose of processing or the subscription ends.
• Billing and financial transaction data: kept for the period required by the tax and accounting regulations in force in the Kingdom.

You have the right to request deletion or export of your data via [email protected], subject to the nature of the data and existing statutory and contractual obligations.

4. Your rights under the Personal Data Protection Law

You have the following rights, to the extent permitted by the law:

• To access the data we hold about you.
• To correct any inaccurate data.
• To request deletion of your data, in the cases the law permits.
• To withdraw your consent to processing, subject to existing obligations.
• To refer any complaint about your rights to the Saudi Data and AI Authority (SDAIA).

We may ask to verify your identity before responding to any request related to these rights. To exercise any of them, contact us at [email protected].

5. Cookies

We may use several types of cookies, including operational, analytics and others, depending on the needs of the service. You can disable cookies in your browser settings, but this may affect some website functions. We may publish a separate cookie policy with more detail when needed.

6. Service providers and sub-processors

We rely on technical service providers to operate the platform, such as cloud hosting, analytics tools and AI models. We choose them carefully and enter into data processing agreements with them that comply with the Personal Data Protection Law.

We may also disclose your data in limited cases:

• On an official request from a competent regulatory authority, or to fulfill a legal obligation.
• To protect the legal rights of Karam or the safety of users.
• In a merger, acquisition or restructuring, with the receiving party committed to the same level of protection.

Running some features may require transferring data to providers outside the Kingdom, within the international transfer rules of the Personal Data Protection Law.

7. Updates to this policy

We may update this policy from time to time. We will publish the updated version on this page with the date of the last update. Continuing to use the website after an update means you accept the changes.

8. Contact

For any question about privacy or data processing:

• Email: [email protected]
• Location: Riyadh, Kingdom of Saudi Arabia