Wathiq is built for the most sensitive legal work. This policy explains what personal data we handle, how we protect it, and the choices you have — under the Saudi Personal Data Protection Law.
1. Who we are & scope
Wathiq ("we", "us") is a Saudi-headquartered legal-AI platform operated by Fares Ibrahim Alghamdi & Abdulrahman Yasser Osailan Company (a limited liability company, unified national number 7050363576), operating under the Saudi Personal Data Protection Law (PDPL). This Privacy Policy explains how we handle personal data collected through our website at wathiq.ai, our demo and contact forms, and our account onboarding — situations in which we act as the data controller.
For the documents, matters, and queries your firm processes inside the product ("Customer Content"), Wathiq acts as a data processor on your firm's behalf, under your subscription and data-processing terms. Requests about personal data within Customer Content should be directed to your firm, which is the controller for that data.
2. Data we collect
- Information you give us — when you request a demo or contact us: your name, work email, firm name, role, and the contents of your message.
- Account data — name, email, organisation, and role when an account is created for you.
- Work content — documents, matters, notes, and vault files you upload to the product.
- Query text — the prompts and instructions you submit to AI features.
- Audit logs — records of access to sensitive data, kept to secure the platform.
- Device & usage data — IP address, browser type, and session timestamps, collected automatically.
3. How we use data
- To operate the Service and deliver its legal-AI features.
- To respond to demo requests and enquiries, and to communicate with you about your account.
- To authenticate users and enforce role-based access control (RBAC).
- To secure the platform and prevent fraud or misuse.
- To comply with our legal and regulatory obligations.
- To improve platform reliability and model performance — where this relies on your content beyond what is needed to run the Service, we seek your consent.
4. AI usage
To provide AI features (document analysis, legal research, and chat), text you submit is processed by third-party AI providers located outside the Kingdom of Saudi Arabia.
- OpenAI — GPT-series models for text generation and analysis.
- Anthropic — Claude models for advanced legal reasoning.
- Tavily — used only when a query requires a web search.
The platform itself — and your stored documents and data — is hosted on Google Cloud infrastructure inside the Kingdom of Saudi Arabia (the Dammam region). Before text is sent to the AI providers above, Wathiq applies automated pseudonymisation designed to detect and replace direct personal identifiers — such as names, national IDs, IBANs, and contact details — with coded placeholders, so that the personal data leaving the Kingdom is minimised. This is best-effort and may not catch every identifier (for example, in scanned or image-based documents), and these transfers are made with appropriate contractual and technical safeguards. We contractually require these providers not to use your content to train their models. This processing is necessary to deliver the Service; you can withdraw consent for AI processing on any specific matter from the "My data" page in the product, and we stop AI processing for that matter within 24 hours.
5. Sharing & sub-processors
We do not sell your personal data. We share it only with service providers who help us run the Service, under contracts that require them to protect it: our cloud host (Google Cloud, Kingdom of Saudi Arabia — Dammam region); the AI providers named above (OpenAI, Anthropic, and Tavily for web search only); and our email-delivery provider (Resend). Transfers to recipients outside the Kingdom are made with appropriate contractual safeguards and data minimisation. We may also disclose data where required by law or a competent authority, or to protect our rights and the safety of users.
6. Data retention
| Data type | Retention period |
|---|---|
| Demo / contact enquiries | Until handled, then up to 24 months |
| Account data | Duration of the account + 30 days after deletion |
| Matter & document content | As set by your firm (the data controller) — typically up to ~10 years for professional records |
| Audit logs | 7 years (security & accountability) |
| Consent records | 5 years from last interaction |
| Session data & logs | 90 days |
When we no longer need personal data, we delete or de-identify (pseudonymise) it. Where that is not immediately possible (for example, data held in secure backups), we isolate it from further processing until deletion is possible.
7. Security
We apply technical and organisational measures appropriate to the sensitivity of legal data: encryption in transit and at rest, role-based access control, an append-only, tamper-evident audit log, two-factor authentication (available to every user and required for platform administrators, with mandatory two-factor authentication for firm administrators being rolled out), and data residency inside the Kingdom for the core platform. No system is perfectly secure, but we work continuously to protect your data against loss, misuse, and unauthorised access.
8. Your rights under the PDPL
- Access — request a copy of your personal data.
- Rectification — correct inaccurate or incomplete data.
- Erasure — request deletion of your account, subject to legal-hold retention.
- Portability — receive your data in a machine-readable format.
- Withdraw consent — stop optional processing such as AI, analytics, or marketing.
Account holders can exercise these rights from the "My data" page inside the product. We respond within 30 days, in line with the PDPL. You also have the right to lodge a complaint with the competent supervisory authority in the Kingdom.
9. Cookies & website data
Our marketing website uses only essential and functional storage — for example, remembering your language choice on these legal pages. We do not set advertising cookies on the marketing site. The site loads some resources (such as fonts) from third-party providers, which may receive your IP address as part of delivering them. If we introduce analytics or advertising cookies in future, we will update this policy and request consent where the law requires it.
10. Children
The Service is intended for legal professionals and is not directed to anyone under the age of 18. We do not knowingly collect personal data from children.
11. Changes to this policy
We may update this Privacy Policy from time to time. We will post the updated version here and, where a change is significant, take additional steps to notify you.
12. Contact us
For any privacy enquiry, or to exercise your rights, contact our privacy team at info@wathiq.ai. If we do not resolve your complaint within seven business days, or you are not satisfied with the outcome, you may escalate it to the National Data Management Office at pr@ndmo.gov.sa.
The Service is operated by Fares Ibrahim Alghamdi & Abdulrahman Yasser Osailan Company (a limited liability company incorporated in the Kingdom of Saudi Arabia, unified national number 7050363576), headquartered in the Kingdom of Saudi Arabia.