AI
Login

Legal documents

Privacy Policy

Last updated: 2026-06-15

This policy explains how the AI Architectural Prompt Studio platform handles your personal data in accordance with the Saudi Personal Data Protection Law (PDPL).

1. Who we are

The AI Architectural Prompt Studio platform ("Platform") is operated by a legal entity registered in the Kingdom of Saudi Arabia, referred to below as The Address For Engineering Consultancy ("we", "us", "our"). We are the data controller under the Saudi Personal Data Protection Law ("PDPL").

This policy explains how we collect your personal data, why we collect it, who we share it with, and your rights.

2. Personal data we collect

We collect the following categories of personal data:

  • Account data: full name, email address, preferred language, account creation date.
  • Authentication data: hashed password and session data for login purposes.
  • Subscription and payment references: plan tier, billing date, and transaction identifiers issued by our payment provider Moyasar. We do not store card numbers or CVV codes.
  • Prompt inputs, generated outputs, and history: inputs you submit to the Studio, generated prompt text, and your usage history inside the Platform.
  • Technical logs: low-resolution IP address for security and rate-limiting purposes, browser type, request timestamps.
  • Security and anti-abuse signals: Cloudflare Turnstile verification result at signup, and rate-limit signals for abuse detection.
  • Monitoring events: error events via Sentry for technical troubleshooting and stability improvement, with no intentional personal data in the event payload.

3. Purposes of processing

We process your personal data for the following purposes:

  • Operating the Platform and providing the service to you (account creation, login, prompt generation, history).
  • Managing subscriptions and payments together with our payment provider Moyasar.
  • Sending account-related transactional emails: registration confirmation, password reset, quota alerts, and subscription renewal reminders.
  • Protecting the Platform from abuse and fraud, including CAPTCHA verification and rate limiting.
  • Monitoring service quality and technical stability via Sentry.
  • Complying with applicable legal and regulatory obligations.

4. Legal basis for processing

We process your personal data on one or more of the following bases, in accordance with PDPL and other applicable laws:

  • Your explicit consent given when you create an account or purchase a plan.
  • Performance of the contract entered into with you (the Terms of Use).
  • Our legitimate interest in operating and securing the Platform.
  • Compliance with a legal obligation that applies to us.

5. Service providers with whom we share data

We rely on specialized technical service providers to operate the Platform. Each processes personal data for specific purposes only, under data-processing arrangements that require appropriate protection:

  • Supabase — database and authentication hosting (personal data: account, authentication, subscription, prompts, history).
  • Moyasar — payment processing (transaction references only; we do not receive or store card numbers).
  • Sentry — technical error monitoring (application context only, no intentional personal data).
  • Vercel — application hosting and CDN delivery.
  • Cloudflare — Turnstile (verifies that the requester is not automated) at signup.
  • Resend — transactional email delivery (account, password reset, quota, renewal).

6. Sentry error monitoring disclosure

We use Sentry to monitor technical errors in the Platform to improve stability. Sentry is configured to avoid capturing any intentional personal data (the sendDefaultPii option is disabled). Error messages with technical context (URL path, browser type) may be captured for troubleshooting purposes.

The content of your prompt inputs and generated prompts is not intentionally forwarded to Sentry.

7. Cookies and similar technologies

The Platform uses essential cookies only, for authentication and session purposes. The Platform does not currently use marketing analytics cookies or non-essential tracking. If any optional analytics is enabled in the future, a cookie notice and consent mechanism will be added before activation.

8. Data retention

We retain your personal data for as long as necessary to provide the service, comply with legal obligations, and resolve disputes and enforce our agreements. Approximate boundaries:

  • Account data: for the lifetime of the active account, and for a reasonable period after closure for financial recordkeeping and compliance.
  • Prompt-generation history: for the lifetime of the account, unless the user requests deletion.
  • Financial transaction records: per retention periods required by Saudi tax and accounting laws.
  • Security and anti-abuse signals: for a short period proportionate to the detection purpose, capped at seven (7) days for rate-limit signals.

9. Data deletion requests

You may request deletion of your account and personal data by contacting support at prompts@theaddress.com.sa. We will review and act on the request within a reasonable timeframe, except for data we are required to retain under legal obligations (such as financial transaction records).

10. Your rights

Under PDPL and other applicable laws, you have the following rights:

  • The right to know how your personal data is processed.
  • The right to access your personal data and obtain a copy.
  • The right to correct inaccurate or incomplete data.
  • The right to request deletion or destruction where applicable.
  • The right to withdraw your consent where consent is the legal basis for processing.
  • The right to lodge a complaint with the competent personal-data-protection authority in the Kingdom of Saudi Arabia.

11. Security

We apply reasonable technical and organizational measures to protect your personal data, including: encryption in transit (TLS), role-based access control, session timeouts, error monitoring, and protection against malicious automation (Cloudflare Turnstile).

12. International processing and hosting

Some data-processing services (such as Vercel, Sentry, and Cloudflare) may be hosted on internationally distributed infrastructure. When personal data is transferred outside the Kingdom of Saudi Arabia, we comply with the relevant PDPL data-transfer requirements.

13. Updates to this policy

We may update this policy from time to time. The updated version will be published on this page with a new "Last updated" date. We will make reasonable effort to notify you of material changes via the email address registered to your account.

14. Contact

For any question or to exercise the rights listed above, you may contact us at:

Email: prompts@theaddress.com.sa

Legal entity: The Address For Engineering Consultancy — Commercial Registration: 7006709658 — Registered Address: Jeddah, KSA.