Privacy Policy

1Introduction and scope

Mojeep is a Saudi Arabia-based software-as-a-service (SaaS) platform that provides businesses with an AI agent to answer customer enquiries across social channels and automate information from conversations. This policy explains how personal data is collected, used, shared, and protected in accordance with the Saudi PDPL and its implementing regulations.

• Applies to data processed through the website, dashboard, mobile apps, and APIs.
• Covers business customers, their account users, and end users who contact the AI agent.
• Third-party websites and services are governed by their own privacy policies.

2Mojeep’s legal role and contact details

Mojeep acts as a processor for end-user data received through social channels on behalf of the business customer, the controller, under documented instructions in a data processing agreement. Mojeep acts as a controller for business account and authorized employee data, including billing, login, and administrative usage records.

• Data controller entity: [Name of the company that owns Mojeep].
• Data protection contact: [Name/title].
• National address: [Full national address], Kingdom of Saudi Arabia.

3Data we collect

• Business and dashboard user details: trade name, commercial registration and tax numbers, and employee names, emails, phone numbers, roles, and permissions.
• Billing and payment data; card details are processed through a payment provider and are not stored in full on our servers. This also includes customer-uploaded knowledge-base content.
• End-user data: display name, account identifier and avatar, contact details voluntarily provided, message text, and attached media.
• Conversation metadata: timestamp, channel, response status, IP address, browser and device details, login and usage logs, and cookies.
• AI-derived information: intent, priority, general sentiment, and conversation summaries to route conversations and improve responses—not to make significant individual decisions without human review.
• Mojeep does not intentionally or systematically collect sensitive data. Where processing is needed, the business customer must obtain separate explicit consent and notify Mojeep so additional safeguards can be enabled.

4Legal bases and purposes

Processing is limited to the purposes specified when data is collected. Mojeep will not reuse data for marketing without separate additional consent.

5How the AI agent uses your data

The agent analyzes a message and matches it to the business customer’s knowledge base to generate a reply, or hands the conversation to an employee when it cannot handle the enquiry or the user asks for a person. Models may be hosted in Saudi Arabia or by specialist providers subject to this policy.

• The agent does not independently make automated decisions with significant legal effects or impacts on user rights without human intervention. Users may request human review, object, and ask for a general explanation.
• Conversation content is not used to train general models serving other customers unless it has been de-identified so the individual cannot reasonably be re-identified. Customers can disable this or request exclusion from training and improvement.
• Non-anonymized conversation data is used only within the same business customer account to improve its responses and is not shared with other customers.
• Model providers are bound by data-processing agreements that prohibit using the data to train their models. Hosting and processing in Saudi Arabia are prioritized where technically and commercially possible.
• The agent’s accuracy is periodically reviewed for bias and systematic errors. Authorized business staff can review conversations and intervene at any time.

6Sharing data with third parties

Mojeep uses service providers to operate the platform under data-processing agreements. We do not sell or trade personal data for marketing.

• A business customer can access conversations on its own account as controller; other customers cannot access data that does not belong to them.
• Data may be disclosed in response to a court order or official request from a competent government authority, limited to what is necessary.
• In a merger, acquisition, or asset sale, data may transfer to the new entity after customer notice and assurance of equivalent policy protections.

7International data transfers

Data is primarily stored on infrastructure in Saudi Arabia. Data is transferred or made available outside the Kingdom only as permitted by the PDPL and its regulations, where contractually necessary and no local alternative is available, with adequate protection, approved contractual mechanisms, required permits, and data minimization. Mojeep maintains a record of international transfers and provides details to customers on request.

8Storage, retention, and deletion

When a retention period ends or the processing purpose ceases, whichever occurs first, data is securely and permanently deleted or de-identified, subject to legal obligations.

9Technical and organizational security

• Data in transit is encrypted with TLS 1.2 or later; sensitive stored data is encrypted using AES-256 or equivalent.
• Access is role-based and limited to business need. Two-factor authentication is enabled for employees and dashboard administrators, and access or changes to sensitive data are audited.
• SDAIA and affected data subjects, through the business customer, are notified of reportable incidents within the required timelines and procedures.
• Penetration tests are conducted at least annually, along with regular security reviews and risk assessments.

10Data subject rights and requests

Rights include knowing the legal basis and purpose of processing; accessing data and receiving a readable copy; correcting or completing it; requesting deletion when retention is no longer justified; withdrawing consent without affecting prior lawful processing; and requesting human review of impactful automated replies or classifications.

• End users may contact the business customer as controller or email [email protected] for referral to the relevant customer. Business customers can submit requests in the dashboard or by email.
• Complete requests are answered within 30 days. Complex cases may take up to 90 days, with notice explaining the extension.

11Cookies and similar technologies

Cookies can be managed through browser settings or the website privacy-preference controls. Disabling essential cookies may affect site performance.

12Children’s privacy

Mojeep is a business-to-business service and does not directly target children or people under 18. Minors may nevertheless interact with an AI agent through a customer’s public channel without Mojeep’s direct knowledge.

• Business customers must observe legal requirements for protecting minors in light of their activity and audience.
• If Mojeep learns that it collected a minor’s data without required parental consent, it will take steps to delete it promptly.

13Changes to this policy

Mojeep may update this policy to reflect changes in practices or applicable law. Customers will be notified of material changes by registered email or dashboard notice at least 15 days before they take effect, unless the law requires otherwise.

14Contact and complaints

If a data subject believes that processing violates the PDPL, they may submit a complaint to the Saudi Data and AI Authority (SDAIA). Contact us first to try to resolve the concern informally, unless the nature of the complaint requires otherwise.

• National address: [To be completed], Kingdom of Saudi Arabia.

15Technical appendix and approval

Signature and approval: [To be completed following formal approval by the company legal department].