Draft for legal review. This text describes what Populator collects and does today. It must be reviewed against the Saudi Personal Data Protection Law (PDPL) and its regulations by DNA's legal counsel before launch. Bracketed items are to be confirmed.

Privacy Policy

Last updated: 6 October 2026 (draft)

1. Who is responsible

DNA, [registered legal name], operates Populator and is the controller of the personal data described here. Contact: [privacy contact to be confirmed].

2. What we collect

Account data: your name, email address, organization name and a salted hash of your password (we never store the password itself).
Billing data: legal name, VAT number, billing email and address you provide, invoices, and payment references you submit for bank transfers.
Usage data: the areas you analyse, the questions you ask, the analyses and presentations you generate, and metering records (service, tokens used, charges).
Technical data: IP address, browser details, request logs and an audit log of security-relevant actions (sign-in, role changes, billing changes).
Cookies: one session cookie that keeps you signed in and protects forms from forgery. We do not use advertising or third-party tracking cookies.

3. How we use it

To provide and secure the service, meter usage and bill you, support you, prevent abuse, and improve accuracy. We do not sell personal data.

4. AI processing

To write summaries and answer questions we send Google's Gemini service a structured set of figures about the area you selected and your question. We do not send your name, email or organization to it. Your question text may contain whatever you type, so please do not enter personal data of others.

5. Who else receives data

Our hosting and database providers, Google (Gemini AI service), and our email provider, each only as needed to run the service. [Hosting location and any cross-border transfer basis to be confirmed under the PDPL.]

6. Retention

Account and billing records are kept while your account is active and as long as the law requires for invoices and tax. Audit logs are kept for [period to be confirmed]. Backups are retained for [period to be confirmed].

7. Your rights

Subject to the PDPL you may ask to access, correct or delete your personal data, or object to certain processing. Contact us at the address above. We will respond within the period the law requires.

8. Security

Passwords are hashed; traffic is encrypted in transit in production; access is separated by organization; actions are logged; and requests are rate limited. No system is perfectly secure, and we will notify affected users and the authority where the law requires.

9. Changes

We will post updates here and notify account owners of material changes. See also our Terms of Service.