Privacy Policy

This Privacy Policy explains how Alef collects, uses, shares, and protects personal data when you use the Alef platform, our website at alef.ink, and related services (the “Service”). It also explains your rights and how to exercise them.

This policy is designed to comply with the Saudi Personal Data Protection Law (“PDPL”) and its Implementing Regulations, and to reflect good practice for users in the wider GCC and beyond. By using the Service you acknowledge this policy. Where we process data of users in other regions, additional local rights may apply.

The controller responsible for your personal data is alef technology, registered in the Kingdom of Saudi Arabia, with its registered office in Riyadh, KSA.

For any privacy question or request, contact our privacy team at privacy@alef.ink.

Information you provide

• Account & identity - name, work email, password, company name, role, and team-member details.
• Knowledge Base & content - brand profile, services, competitor information, authors and their professional details, tone guidelines, keywords, prompts, and any text you submit.
• Billing - billing name, VAT/business details, and the transaction records needed for invoicing. Card details are handled by our payment processor; we do not store full card numbers.
• Support & communications - messages you send us and onboarding information.

Information we collect automatically

• Usage data - features used, actions taken, articles generated, and timestamps.
• Device & log data - IP address, browser type, device identifiers, and log files.
• Cookies & similar technologies - as described in our Cookie Policy.

Information from connected services (Integrations)

When you connect an Integration, we receive data from it to provide the relevant features:

• Google Search Console - your verified sites and search-performance data such as clicks, impressions, average position, and click-through rate. See the dedicated section below.
• Publishing platforms - WordPress, Shopify, Salla, and Zid: connection credentials/tokens and the content and metadata needed to publish and update articles and product descriptions.

When you connect your Google account, you authorise Alef to access certain Google data through Google’s APIs - primarily Google Search Console (your site list and search-analytics metrics). We request only the scopes needed for the features you use, and you can review and revoke this access at any time in your Google Account security settings.

How we use Google user data. We use it solely to provide and improve the user-facing features you have requested - for example, displaying your search performance, identifying content opportunities, and measuring the impact of content you publish.

Limited Use commitments. Alef’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, we:

• do not use Google user data for serving advertising;
• do not sell Google user data;
• do not transfer Google user data to others except as necessary to provide or improve the features you use, to comply with law, or as part of a merger or acquisition with appropriate notice;
• do not use Google user data to train generalised or third-party AI/ML models;
• limit human access to Google user data, except with your consent for security or to comply with law, or where the data is aggregated and anonymised.

You can disconnect Google at any time within Alef, which stops further access to your Google data.

We use personal data to:

• create and administer your Account and provide the Service;
• generate, optimise, and publish content using your Knowledge Base and inputs;
• display analytics and AI-visibility insights;
• process payments, send invoices, and prevent fraud;
• provide support and respond to your requests;
• secure, maintain, troubleshoot, and improve the Service;
• send service messages and, where permitted, relevant product updates (you can opt out of marketing at any time);
• comply with legal obligations and enforce our terms.

To power features such as the Content Studio, Opportunities, and AEO Insights, we send relevant inputs - for example, your Knowledge Base data and prompts - to trusted third-party AI providers acting as our processors. We do this only to generate output for your Account.

We instruct our AI providers not to use your data to train their general models, in line with the controls described in our AI Policy. We do not use Google user data for any AI/ML model training. For full detail on responsible-AI practices, see the AI Policy.

Under the PDPL and similar laws, we rely on one or more of the following bases:

• Performance of a contract - to provide the Service you subscribe to.
• Consent - for example, for non-essential cookies and marketing; you may withdraw consent at any time.
• Legitimate interests / our legitimate business needs - to secure, operate, and improve the Service, where this does not override your rights.
• Legal obligation - to meet accounting, tax, and regulatory duties.

We do not sell your personal data. We share it only as follows:

• Service providers / processors - hosting and infrastructure, AI providers, payment processing, analytics, email, and customer-support tools, bound by contract to protect your data and use it only on our instructions.
• Integrations you enable - we exchange data with platforms you connect (Google, WordPress, Shopify, Salla, Zid) to deliver the features you use.
• Legal & safety - where required by law, regulation, or valid legal process, or to protect our rights, users, and the Service.
• Business transfers - in a merger, acquisition, or sale of assets, with notice and continued protection of your data.

Some of our providers may process data outside the Kingdom of Saudi Arabia. Where we transfer personal data internationally, we do so in accordance with the PDPL’s requirements for cross-border transfers and apply appropriate safeguards to ensure your data remains protected.

We keep personal data only as long as needed for the purposes described here: for the life of your Account and as required to provide the Service, then for a limited period afterward to meet legal, tax, accounting, and security obligations. When data is no longer needed, we delete or anonymise it. Backups are retained for a short, rolling period and then overwritten.

We apply technical and organisational measures appropriate to the risk - including encryption in transit, access controls, least-privilege practices, and monitoring - to protect personal data against loss, misuse, and unauthorised access. No method of transmission or storage is completely secure, so we cannot guarantee absolute security, but we work to protect your data and will notify you and the relevant authority of a qualifying breach as required by law.

Subject to applicable law, you have the right to:

• be informed about how your personal data is processed;
• access your personal data and obtain a copy;
• request access to your data in a readable format (data portability) where applicable;
• correct inaccurate or incomplete data;
• request deletion of your data where there is no lawful reason to keep it;
• withdraw consent where processing is based on consent;
• object to or restrict certain processing.

To exercise any right, email privacy@alef.ink. We will verify your identity and respond within the period required by law. There is normally no charge.

We use cookies and similar technologies to run the Service, remember your preferences, measure performance, and - with your consent - for marketing. You can review and change your choices at any time. See our Cookie Policy and Cookie Settings.

The Service is for business use and is not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us data, contact us and we will delete it.

The Service and our content may link to third-party sites and tools we do not control. This policy does not cover them; please review their own privacy notices.

We may update this Privacy Policy from time to time. We will post the updated version here and, for material changes, notify you by email or in-product before they take effect. The “Last updated” date above reflects the current version.

Contact our privacy team

Controller: alef technology

Privacy: alef.ai@alef.ink

Data Protection contact: alef.ai@alef.ink

Address: Riyadh, KSA

If you are in Saudi Arabia and are not satisfied with our response, you may lodge a complaint with the Saudi Data & AI Authority (SDAIA), the PDPL supervisory authority.