This policy explains how Hujah (hujahai.com) collects, processes and protects personal data, in accordance with the Saudi Personal Data Protection Law issued by Royal Decree No. (M/19) dated 9/2/1443H and its implementing regulations. By using the platform or joining the waitlist, you acknowledge that you have read this policy.
1. Controller and contact
The controller of your data is [legal name, registration number and address of the entity operating Hujah], referred to as "Hujah" or "we".
Questions and data-subject requests: hello@hujahai.com.
2. Data we collect
Account data: name, email, job title, firm or organisation, and mobile number and city where provided.
Waitlist data: name, email, firm, role, city, mobile (optional), plan of interest, and visit source (e.g. utm campaign parameters).
Content you submit: questions, uploaded documents and files, document text sent from the Word add-in or Chrome extension, and the resulting outputs.
Usage and device data: technical logs (IP address, browser type, timestamps) and the usage counters needed to apply plan limits.
Payment data: card details are processed directly by Stripe; we never see or store full card numbers.
3. Purposes and legal bases
Providing the service and performing our contract with you: creating your account, answering questions, running tools and storing files in your vault under the retention option you choose.
Billing and subscription management, and meeting legal and accounting obligations.
Protecting the platform, preventing abuse and enforcing usage limits.
Contacting you about your account or waitlist request, and sending marketing messages with your consent, which you may withdraw at any time.
Improving the platform using aggregated usage metrics that do not include the content of your documents or questions.
4. Client content and professional confidentiality
We do not use your questions, documents or outputs to train any AI model, and we send AI requests only to providers with a Zero Data Retention policy that do not use data for training.
Before any text is sent to a model provider (questions, document text sent from the add-ins, tool inputs, and excerpts retrieved from your vault), we automatically mask personal data on our servers: national ID and Iqama numbers, CR numbers, IBANs, phone numbers and emails are replaced with placeholders, and a model running on our servers detects names, organisations and places. We then check the masked text a second time and do not send it if we suspect personal data is left, unless you review and confirm, and that confirmation is logged. The real values are then restored into the answer on our servers for members of your firm only. Public statutory text is not masked.
Masking is automated and not perfect: it may miss some personal data or mask something that isn't personal. That is why we show you how many items were masked and of which types, and let you review and correct what was masked in your vault files.
Pseudonymised vault storage: uploaded files are read in memory and only their masked text is stored. The real values are stored separately, encrypted with a key specific to your firm, and never sent to model providers. We keep the original file only if your firm opts in with explicit consent; it is then stored encrypted in Europe.
Zero-retention mode: when enabled for your firm, files are parsed in memory and discarded when the session ends, and their contents are not stored in conversation history.
Our team accesses your content only as needed for support at your request or for security purposes, and such access is recorded in the audit log.
6. Hosting location and transfers outside the Kingdom
The platform is currently hosted outside the Kingdom, in Europe: servers, database and stored files. This means your personal data — including account data, the masked text of your files and the encrypted real values — is transferred to and processed outside the Kingdom.
Masked text is also processed by model providers via OpenRouter, whose servers may be outside Europe and the Kingdom.
For these transfers we comply with Article 29 of the Personal Data Protection Law and the Regulation on Personal Data Transfer outside the Kingdom, including limiting data to the minimum necessary (including masking personal data before it is sent to model providers), encrypting data in transit and at rest, and contracting with processors under appropriate safeguards. [The legal basis for the transfer and the safeguards relied on to be specified after legal review.]
We are working to move hosting to an in-Kingdom cloud region when one becomes available to us, and will update this policy then. Enterprise customers may request a dedicated deployment, including in-Kingdom when available.
7. Retention and destruction
Account data is kept for the life of the account and thereafter for as long as the law requires (e.g. accounting obligations), then destroyed or anonymised.
Vault files (their masked text, encrypted values, and original if you opted to keep it) remain until you delete them or the account is closed; deleting a file deletes its related index and values. In zero-retention mode files are not stored at all.
Model providers do not retain what is sent to them, under the Zero Data Retention policy we restrict requests to.
Waitlist data is kept until you ask us to delete it, or for no more than 24 months after our last contact.
8. Your rights
Under the Law you have the right to be informed how your data is processed (including its transfer outside the Kingdom and who processes it); to access it and obtain a copy in a clear, readable format; to request its correction, completion or update; to request its destruction once no longer needed; and to withdraw consent where processing relies on consent.
To exercise any of these rights, email hello@hujahai.com and we will respond within the statutory period.
You may lodge a complaint with the Saudi Data & AI Authority (SDAIA) as the competent authority.
9. Security
We apply appropriate organisational and technical measures, including masking personal data before it is sent to model providers, encryption in transit and at rest, encryption of real values with a per-firm key, per-firm data isolation, access controls and an audit log.
In the event of a breach, we notify the competent authority within the periods set by the regulations and notify you without delay where the incident may harm you.
11. Age
The platform is intended for professionals, and we do not knowingly collect data from anyone under 18.
12. Changes
We may update this policy from time to time. We will publish the updated version here with its date and notify you of material changes by email or in the app.