Privacy Policy

Edrak is a software platform built to help organizations use AI in a controlled, enterprise-oriented environment.

If you have questions about this Privacy Policy or our privacy practices, you can contact us at:

This Privacy Policy applies when you:

• visit our website
• create or use an Edrak account
• use our platform and features
• contact us for support, sales, onboarding, or other inquiries
• interact with us in connection with demos, enterprise review, procurement, or contracting

This Privacy Policy should be read together with our:

• Terms of Use
• Cookie Policy
• Acceptable Use Policy
• Enterprise Terms, where applicable

Where Edrak processes customer data on behalf of an enterprise customer under a separate agreement, that processing may also be governed by a data processing addendum or other contractual terms.

Depending on how you use Edrak, we may process the following categories of personal data.

We use personal data to run, support, secure, and administer the service.

That includes using personal data to:

• provide, operate, and maintain Edrak
• authenticate users and manage accounts
• route requests to supported AI providers selected through the platform
• deliver outputs and requested functionality
• provide customer support and service communications
• manage onboarding, subscriptions, billing, and related commercial matters
• detect, prevent, and investigate abuse, misuse, fraud, or unauthorized access
• maintain platform security, integrity, and availability
• comply with legal, regulatory, contractual, and enforcement obligations
• investigate suspected violations of our terms or policies

On the points that matter most, our position is simple.

Edrak does not:

• claim ownership over customer data, prompts, or outputs
• use customer data or outputs to train or fine-tune Edrak models
• use customer data or outputs to train or fine-tune third-party AI models
• sell customer data
• use customer data for advertising

We do not share personal data casually. We share it only where needed to operate the service, support customers, comply with law, or protect the platform.

Where applicable law requires a legal basis for processing, Edrak may process personal data on grounds such as:

• performance of a contract
• compliance with legal obligations
• legitimate interests in operating, securing, and supporting the platform
• consent, where required by law

Where consent is required, it may be withdrawn, subject to applicable law.

We may use cookies and similar technologies to:

• operate and secure our website and services
• remember settings and preferences
• understand usage and performance
• support analytics and service functionality

For more detail, please see our Cookie Policy.

We keep personal data only for as long as reasonably needed for the purposes described in this Privacy Policy.

That may include retaining data to:

• provide and support the services
• maintain platform security and integrity
• comply with legal or regulatory obligations
• resolve disputes
• enforce contractual arrangements
• complete backup and deletion cycles

In general:

• data may be retained during the subscription term as needed to provide the service
• after termination, data may be retained for a limited period to support retrieval, export, or operational transition
• after that, data is deleted or anonymized, unless longer retention is required for legal, regulatory, billing, fraud-prevention, security, dispute, or backup reasons

Edrak applies commercially reasonable administrative, technical, and physical safeguards designed to protect personal data against unauthorized access, use, disclosure, alteration, or destruction.

Depending on the service, those safeguards may include:

• encryption in transit
• encryption at rest
• role-based access controls
• workspace-level segregation
• logging and monitoring
• controlled access based on business need
• secure API-based integrations with supported providers

Unless otherwise agreed, Edrak's default hosting position is Saudi Arabia, subject to operational availability.

Depending on the services used and the configuration selected, personal data may also be processed in other jurisdictions, including where necessary to support hosting, support operations, or selected third-party AI providers.

Where relevant, Edrak seeks to apply contractual, technical, or organizational measures appropriate to the nature of the transfer and the applicable legal requirements.

Depending on the laws that apply to you, you may have rights regarding your personal data, including the right to:

• access personal data
• correct inaccurate personal data
• request deletion of personal data
• object to or restrict certain processing
• withdraw consent where processing is based on consent
• request a copy of certain personal data, where applicable

We may need to verify your identity before acting on a request. We may also decline or limit requests where permitted by law, including where the request would interfere with legal obligations, security requirements, contractual duties, or the rights of others.

If you use Edrak through your employer or another organization, you may need to direct certain requests to that organization first, depending on the nature of the processing relationship.

Customers should use judgment before submitting sensitive personal data, confidential business information, or regulated data to the platform.

Where customers choose to use Edrak in workflows involving sensitive, regulated, or high-risk data, they remain responsible for ensuring that such use complies with applicable laws, regulations, and internal policies.

If you use Edrak through an employer, school, or other organization:

• your organization may control your access to the platform
• your organization may configure workspace settings, retention choices, and administrative controls
• Edrak may process relevant data under that organization's instructions and contractual arrangement
• your organization may be responsible for responding to certain privacy requests relating to business data processed on its behalf

We may update this Privacy Policy from time to time to reflect changes in law, regulation, product functionality, security practices, or our business operations.

When we do, we will post the updated version on this page and update the effective date above. Where required by law, we will provide additional notice.