How Venture Insights handles your information.

Document version: privacy.v2.3-ksa-bilingual-2026 · Effective date: 2026-07-23

This notice explains how Venture Insights ("VI", "we") collects, processes and protects personal data when you use our platform. It is issued under the Personal Data Protection Law of the Kingdom of Saudi Arabia (Royal Decree No. M/19 dated 9/2/1443H — the "PDPL") and its implementing regulations.

---

1. Who we are

Venture Insights is the trading brand of Al-Ufuq Al-Riyadiah for Business Services Co. (شركة الأفق الريادية لخدمات الأعمال), a company registered in the Kingdom of Saudi Arabia under Commercial Registration No. 4030527575 (VAT No. 311845887300003), headquartered at Al-Baterji, Jeddah 23521, Kingdom of Saudi Arabia. For privacy enquiries email [info@ventureinsights.com.sa](mailto:info@ventureinsights.com.sa).

We are the data controller under the PDPL with respect to your account data and brief content. Where we use sub-processors (AI services, cloud hosting), we contractually bind them to protections no less stringent than the PDPL.

---

2. What we collect

• Account data — name, email, password hash, organisation affiliation, role.
• Brief content — concept, sector, financial context, market and audience data, supporting assets you upload.
• Engagement metadata — stage transitions, sign-offs, AI consensus outputs, partner bids, awarded matches.
• Operational telemetry — request logs, error reports (via Sentry when enabled) and aggregated usage analytics (via Vercel Analytics).
• Session data — an httpOnly cookie used to manage your platform session.
• Advertising & conversion-measurement data — on our public marketing pages the Meta (Facebook) pixel operates to measure the effectiveness of our advertising and reach relevant audiences. It records a PageView and sets Meta's `_fbp` and `_fbc` cookies. On a conversion event (e.g. requesting a diagnostic) we also send Meta, server-side via its Conversions API, event data together with match keys — your email, phone and name in irreversibly SHA-256-hashed form, plus a hashed identifier, your IP address and browser user-agent. Opt-out routes are in section 11.
• AI-agent channel data — when an AI assistant requests our free Concept Diagnostic on a founder's behalf (via our MCP server or agent API), we collect the founder's name and email, the venture concept text, and optional sector, city and stated intent, plus the name of the assistant used and a hashed (non-reversible) IP. No diagnostic is generated and nothing is charged until the founder personally clicks the one-click confirmation link we email them. Unconfirmed requests expire after 7 days.

---

3. Lawful basis for processing

We rely on the following PDPL bases:

1. Consent — for direct marketing and optional analytics / error-tracking cookies.
2. Performance of a contract — to deliver platform services under your signed NDA and statement of work.
3. Legitimate interest — for platform security, fraud prevention, service development, and measuring the effectiveness of our advertising and reaching relevant audiences, where not overridden by data-subject rights and with an opt-out available (section 11).
4. Legal obligation — for compliance with ZATCA invoicing and AML rules.

---

4. How we use your data

Brief content is processed by VI personnel and by the multi-model consensus engine (Anthropic Claude, OpenAI GPT, xAI Grok per tier) to produce business-development outputs in line with our published methodology. Brief content is never used to train any third-party AI model. Marketplace partners only see briefs dispatched to them, and only the fields required to bid.

---

5. Sub-processors

We use the following sub-processors. All are contractually bound to PDPL-equivalent protections:

An up-to-date list is published when any sub-processor changes. For the full Data Processing Addendum (DPA) see [/dpa](/dpa).

Social media publishing and account-linking capabilities are provided by [Ayrshare](https://www.ayrshare.com/?ref=privacy).

---

6. Data residency & transfers

We are progressively migrating production storage to KSA-resident infrastructure in line with the PDPL and the SDAIA Cloud Computing Special Provisions. AI inference may use providers outside the KSA under contractual safeguards equivalent to PDPL standards, with the minimum amount of personal data transferred.

---

7. Confidentiality

Every engagement is covered by an executed mutual NDA whose terms are surfaced inside the platform before discovery begins. The NDA governs disclosure and treatment of brief content, consensus outputs and any partner-side material. See your signed NDA for the binding text.

---

8. Your rights

Under the PDPL you have the right to:

• Access your personal data.
• Correct inaccurate data.
• Delete personal data (subject to lawful retention periods).
• Restrict or object to certain processing.
• Port your data in a machine-readable format.
• Withdraw consent at any time where processing is consent-based.
• Complain to the Saudi Data & AI Authority (SDAIA).

To exercise any right, email [info@ventureinsights.com.sa](mailto:info@ventureinsights.com.sa) from the address tied to your account. We aim to respond within thirty (30) days.

---

9. Retention

Engagement records are retained for the lifetime of the client relationship plus seven (7) years to support audit, dispute resolution and ZATCA compliance. Audit log entries are retained on the same schedule and are not affected by engagement deletion. Clients may request earlier purge in writing — we will comply unless a legal hold applies.

---

10. Security

Production data sits on managed Postgres with at-rest encryption. API keys are stored AES-256-GCM encrypted with a key held outside the database. Sessions are server-managed with httpOnly cookies. We monitor abnormal access patterns and rate-limit account-level actions.

If a breach is likely to harm data subjects, we notify the affected data subjects and SDAIA within seventy-two (72) hours of discovering the breach, in line with PDPL requirements.

---

11. Cookies

We use the following categories of cookies and similar technologies:

• Essential — for session management, authentication state, language preference and storing your cookie choice itself. Do not require consent.
• Analytics & error tracking (optional) — aggregated analytics (Vercel Analytics) and error tracking (Sentry). Require your explicit consent via the cookie banner; you may withdraw it at any time from your account settings.
• Advertising & conversion measurement — the Meta (Facebook) pixel on our public marketing pages. It operates by default to measure the effectiveness of our advertising and reach relevant audiences, sets the `_fbp` and `_fbc` cookies, and is complemented by the server-side Conversions API described in section 2. You can opt out via your browser's cookie controls, your Meta ad preferences at [facebook.com/adpreferences](https://www.facebook.com/adpreferences), or a browser/extension that blocks these cookies.

---

12. Governing law

This notice is governed by and construed in accordance with the laws of the Kingdom of Saudi Arabia. In the event of conflict, the Arabic version prevails over the English translation.

---

13. Updates

Material changes are communicated via in-app notification and email to account holders at least fourteen (14) days before they take effect.

---

14. Contact

For enquiries or to exercise your rights: Venture Insights (Al-Ufuq Al-Riyadiah for Business Services Co. · CR 4030527575 · VAT 311845887300003) · Al-Baterji, Jeddah 23521, Kingdom of Saudi Arabia · [info@ventureinsights.com.sa](mailto:info@ventureinsights.com.sa)