Privacy Notice

This draft describes the inspected pilot. AI Market processes account email, password hashes, role and session records; project and proposal content; submissions, reviews and dispute evidence; and administrative audit records. Do not submit national identity documents, card data, passwords or unnecessary sensitive client data in project text. Payment identity checks should occur through the selected provider’s approved channels.

Data is used to create and secure accounts, operate agreed marketplace workflows, handle reports and meet applicable obligations. Each purpose needs a documented lawful basis before live launch; consent must be specific where relied upon and must not be bundled with unrelated marketing. The controller’s verified legal name and privacy contact remain launch prerequisites.

Current core hosting is Railway in Amsterdam. Backups use Cloudflare R2, whose exact physical location and transfer terms require confirmation. Sentry receives minimized error diagnostics. Proposed payment, domain email and Saudi hosting providers are not yet activated. No claim is made that all processing remains in Saudi Arabia.

Account and transaction records are retained only for documented operational or legal purposes. Session expiry is seven days. Daily backups have a reported 30-day retention rule. Production log retention, tax-record periods, dispute holds and account-deletion schedules require final verification. A lawful preservation obligation may limit immediate deletion; restricted backups expire under their retention process.

Subject to Saudi PDPL and applicable exceptions, individuals may request information, access, a readable copy, correction, destruction and withdrawal of consent where consent is the basis. The final privacy channel must verify identity proportionately and track requests and deadlines. Requests and objections must not require disclosure of a password. Security incidents are assessed for required regulator and affected-person notifications.