Privacy Policy

Who we are

NASAQ CX (Arabic: Nasaq) is an AI that communicates with customers on behalf of businesses, currently in a trial phase and reviewing requests to join. The operator of the platform, and the party responsible for the data in the join-request form, is Abdullah Mahmoud Ismail Aljahdali. Contact: support@nasaqcx.com.

Join-request data

We collect the business name, type of activity, email address, contact number and your consent to have the request reviewed. We also store a request reference, the time it was submitted and its review status. We use this data to assess fit, to contact you about the request, and to prevent duplicates and abuse, based on your consent. Submitting a request does not create an account; if the request is accepted it is turned into a trial request or an invitation under the activation procedure. Join-request data is not sent to the AI provider merely because a request was submitted.

Service data

When the service is activated we may process contact details, the text of conversations, delivery status, and the information needed to carry out a request, such as a name, a service and an appointment. Do not send passwords, payment card details or sensitive documents. The business decides the purposes for which its own customers' data is processed, and the legal basis that fits them.

Processors and transfer of data outside the Kingdom

We may use a hosting provider, messaging-channel providers and an AI provider, OpenAI. When the AI is used, the parts of the conversation content and context needed to handle the request are sent to OpenAI, and this data may be processed in the United States, outside Saudi Arabia.

Transfers of data are subject to the Personal Data Protection Law, its Implementing Regulations and the Regulation on Transfer of Personal Data outside the Kingdom. These require the purpose and legal basis to be identified, the data transferred to be limited to what is necessary, an appropriate level of protection and safeguards to be applied, and the risk of the transfer to be assessed where applicable. The disclosure in this policy does not on its own replace meeting these requirements. Processing of customer data outside the Kingdom is not enabled before the applicable controls are met.

Data retention

Personal data from a join request is deleted from the operational record 90 days after submission, in the next maintenance cycle, or when the request is deleted from the owner dashboard. Limited audit traces that do not include the name or contact details are kept to prevent duplicates and to prove the action was taken. If the request is accepted and a pending account is created, the resulting account data is governed by the purpose of providing the service, the duration of the relationship and legal requirements.

Operational conversation data is generally retained for up to 90 days, subject to legal, dispute-related or contractual exceptions. Backups are encrypted and follow a separate rotation cycle; their use is restricted to recovery and security.

Your rights and contact

You may ask to be informed, to access and obtain a copy of your data, to have it corrected or destroyed, and to withdraw consent where consent is the basis for processing, by writing to support@nasaqcx.com. We verify the identity of the requester in an appropriate way before acting, subject to legal exceptions. For your conversation data with a business, contact that business first; you can also write to us for help. You have the right to lodge a complaint with the authority responsible for personal data protection.

Security

We use encrypted connections, access controls, separation of each business's data, and encrypted backups. Access to join requests is limited to authorized administrators.

Terms

Use of the platform is also subject to the Terms of Use (Arabic).