Privacy Policy

At Karam, we are committed to protecting the privacy of the users of our website and platform. This policy explains the types of data we collect, how we use it, your rights regarding it, and how we protect it, in accordance with the Saudi Personal Data Protection Law (PDPL).

Data controller: Karam, Commercial Registration No. 1009089390, Riyadh, Kingdom of Saudi Arabia.
Data Protection Officer (DPO): admin@karamai.co.

1. Data we collect

We may collect different types of data depending on how you interact with the website or the platform, such as:

a. Data you provide directly

• Your name, email address, mobile number and similar identifying data, when you book a call or fill in a contact form.
• Company name, sector, size of operations and any other business information, when you subscribe to or try the platform.
• Any information you choose to send us by email, WhatsApp or other communication channels.

b. Data we collect automatically

• Technical data such as IP address, browser type, operating system, pages visited, visit duration and similar.
• Cookies and similar identifiers, to improve the website experience and measure performance.
• Advertising and campaign identifiers, such as those that advertising platforms add to links, to understand how you reached us.

c. Data within the platform

If you are a Karam customer, we process the conversations and data you connect to the platform (such as document files, store systems and customer records) to run the AI in accordance with the service agreement concluded with you.

The list of approved sub-processors is available on request to platform customers via admin@karamai.co.

2. How we use your data

• To operate the platform and provide the agreed services.
• To contact you about your inquiries, requests or account updates.
• To improve platform performance and measure the effectiveness of the AI.
• To measure, analyze and improve the effectiveness of our website, services and advertising.
• To comply with statutory and legal obligations in the Kingdom.

We use your data only for the purposes listed above. We do not sell your personal data, and we do not send you marketing communications without your consent where the law requires it.

3. Google account and calendar data

Google sign-in and Google Calendar are separate, optional connections. Signing in with Google does not connect your calendar. Calendar features are available when Bookings is enabled for your workspace.

Data accessed and its purpose

• Google sign-in: we receive your Google account identifier and email address, and your profile name and picture if Google shares them. Karam and our authentication provider, Hexclave, use these details to authenticate you and associate your sign-in with your Karam account.
• Calendar account identity: when you connect Google Calendar, we separately receive and store that Google account's identifier and email address to identify the calendar connection and show you which account is connected. This applies even if you do not use Google sign-in for Karam.
• Calendar selection: we read calendar names, identifiers and access capabilities so you can choose which calendars count as busy and which calendar receives booking events.
• Availability and synchronization: we read busy periods and the event identifiers, times, status, attendee-response and meeting metadata needed to avoid conflicts and check booking event copies. We use calendar access to create, reschedule or cancel the event copies Karam creates for your bookings, and to create Google Meet links when supported.

Storage and sharing

We store calendar access and refresh tokens encrypted in our backend, together with the account and calendar identifiers, connection settings and synchronization records needed to maintain the connection. Requests to Google use encrypted connections.

Google processes the calendar changes and meeting-link requests sent to its APIs. Our hosting and authentication providers process the information needed to operate their parts of these features. If an AI assistant handles a booking, our AI service providers may process the availability and booking results needed to respond to that request. Calendar OAuth credentials are not included in the assistant's booking results.

Human access to Google data is limited to the circumstances allowed by Google's Limited Use requirements, such as your explicit agreement for support, security investigations or legal requirements. You can request details of the service providers involved via admin@karamai.co.

Disconnecting and deleting data

You can disconnect Google Calendar in Settings → Your calendar. Disconnecting clears the credentials and selected calendars from the active connection and stops Karam from using that connection for further calendar access. You can also revoke Google's authorization from your Google Account connections.

Disconnecting does not cancel your Karam bookings or delete events already added to Google Calendar. Booking records and synchronization history may remain under our data protection and retention rules. To request deletion or export of Google-related data held by Karam, contact admin@karamai.co; we may need to verify your identity. Google controls retention of data held in your Google account.

Limits on Google data use

Karam's use and transfer to any other app of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements.

We also follow the Google Workspace user data and developer policy.

We do not sell Google user data, use it for advertising or use it to train or improve general-purpose AI models. These limits also apply to aggregated, anonymized and derived Google data, and take precedence over general product-improvement or model-development provisions elsewhere in this policy or our Terms of Use.

4. Data protection and retention

We apply appropriate technical and administrative security controls to protect your data from unauthorized access, modification or disclosure, in line with applicable industry best practices. These controls may evolve from time to time to suit the nature of the service and changing risks.

We use reliable cloud infrastructure that is subject to approved security controls. Some processing may take place through service providers outside the Kingdom of Saudi Arabia, in accordance with the Personal Data Protection Law and the related international transfer regulations.

We follow the principle of minimum retention set out in the Personal Data Protection Law: we do not keep personal data longer than required by the purposes of its processing or by the statutory obligations that apply to us.

• Visit and analytics data: kept for as long as needed for analysis and improvement, then deleted or aggregated anonymously.
• Account and conversation data: processed throughout your subscription, and deleted when the purpose of processing or the subscription ends.
• Billing and financial transaction data: kept for the period required by the tax and accounting regulations in force in the Kingdom.

You have the right to request deletion or export of your data via admin@karamai.co, subject to the nature of the data and existing statutory and contractual obligations.

5. Your rights under the Personal Data Protection Law

You have the following rights, to the extent permitted by the law:

• To access the data we hold about you.
• To correct any inaccurate data.
• To request deletion of your data, in the cases the law permits.
• To withdraw your consent to processing, subject to existing obligations.
• To refer any complaint about your rights to the Saudi Data and AI Authority (SDAIA).

We may ask to verify your identity before responding to any request related to these rights. To exercise any of them, contact us at admin@karamai.co.

6. Cookies

We may use several types of cookies and similar technologies, including operational, analytics, advertising and measurement ones, some of them provided by third parties, depending on the needs of the service. You can disable cookies in your browser settings, but this may affect some website functions. We may publish a separate cookie policy with more detail when needed.

7. Service providers and sub-processors

We rely on technical service providers to operate the platform, such as cloud hosting, analytics tools and AI models. We choose them carefully and enter into data processing agreements with them that comply with the Personal Data Protection Law.

We may also share limited information, such as technical and device data, advertising identifiers and pseudonymized (for example, hashed) contact details, with advertising and analytics partners, to measure and improve the performance of our advertising. These partners process it under their own terms and applicable law.

We may also disclose your data in limited cases:

• On an official request from a competent regulatory authority, or to fulfill a legal obligation.
• To protect the legal rights of Karam or the safety of users.
• In a merger, acquisition or restructuring, with the receiving party committed to the same level of protection.

Running some features may require transferring data to providers outside the Kingdom, within the international transfer rules of the Personal Data Protection Law.

8. Updates to this policy

We may update this policy from time to time. We will publish the updated version on this page with the date of the last update. Continuing to use the website after an update means you accept the changes.

9. Contact

For any question about privacy or data processing:

• Email: admin@karamai.co
• Location: Riyadh, Kingdom of Saudi Arabia