Customer Data and AI Models

1. The principle

Your content is yours. We process it to deliver the feature you asked for, and for nothing else.

Customer data is not used to train general-purpose AI models. This is not a preference we apply case by case — it is a contractual requirement we impose on every AI provider we engage, and a condition of that engagement.

2. What is sent to an AI provider

Only what the request needs. When you use an AI feature we transmit the prompt you wrote and any material you attached to it — a reference image, a product description, a brand tone note, a draft you asked to rewrite.

• Always sent — The prompt text and any file you explicitly attach to that request.
• Sometimes sent — Brand context you have saved (tone of voice, audience notes) when the feature is designed to use it, so the output matches your brand.
• Never sent — Your password, session tokens, access tokens for connected advertising or social accounts, billing details, payment card data, or the personal data of your own customers held elsewhere in your workspace.

3. What providers may and may not do

Our AI providers act as processors on our instructions. Under our agreements with them they may process your submission only to generate and return the requested output.

They may not use it to train, fine-tune or improve general-purpose models. They may not disclose it to third parties except as required by law. They may not retain it beyond the period needed to deliver the result and meet their own abuse-monitoring obligations.

4. How long it is kept

Within SAIMA, your prompts and generated outputs are stored in your workspace until you delete them or your account is closed, because you need to find, reuse and edit what you produced.

At the provider, submissions are held only for the short period their own operations require and are then discarded. Where a provider offers a zero-retention or no-training configuration, we select it.

Deleting a generated asset in your workspace removes it from the platform. The Data Retention policy sets out the full timetable, including backups.

5. Where processing happens

AI processing is performed by providers whose infrastructure may be located outside the Kingdom of Saudi Arabia. Where personal data is transferred outside the Kingdom, we do so on the bases permitted by the Personal Data Protection Law and its implementing regulations, and under contractual safeguards with the receiving party.

Because infrastructure arrangements change, we do not fix specific locations in this policy. Enterprise customers who require processing-location commitments can obtain the current position in writing before contracting.

6. Your controls

AI features are opt-in by action: nothing is sent to a provider unless you trigger a generation. If you never use an AI feature, none of your content reaches an AI provider.

Do not paste into a prompt any personal data of your own customers, credentials, or confidential material belonging to a third party. If your work requires processing such material, contact us before doing so and we will tell you whether the platform is an appropriate place for it.

7. Questions

For questions about AI data handling, or to request the current provider position for a procurement review, contact privacy@saimahub.ai.