Privacy Policy

Thank you for choosing our AI-powered UI/UX design platform.

Because your privacy is extremely important to us, Shamel is committed to protecting and respecting your privacy. This Privacy Policy describes how we collect and process your personal data through the Platform.

This Privacy Policy explains how Shamel collects, uses, discloses, and protects personal and other data when you register for or use our AI-powered UI/UX, software, and product generation platform.

By registering, accessing, or using the Platform, you agree to this Privacy Policy. If you do not agree, do not register or use the Platform.

Controller: SDAIA.

Address:

Privacy contact: ---------

Data Protection Officer: --------

Account - your user account registered on the Platform.

API - Application Programming Interface; a set of rules and protocols that allows Shamel to communicate and exchange data without human intervention.

Applicable legislation - the Kingdom of Saudi Arabia legislation framework.

Copyright - a legal right that allows the creator of an original work, such as a blog post, photo, video, or code, to decide if and how that work may be used by others, subject to certain limitations and exceptions.

Deadline - a time limit that Shamel places for provision of a certain request or service.

Derived Data / Model Data - aggregated, anonymized, processed, or transformed data derived from User Content or usage logs used for analytics, model improvement, or product development.

Disclaimer - a statement that limits someone's legal responsibilities.

Government User - any government entity that enters into a contract, Service Order, or MSA for Platform services.

Indemnify or indemnity - the contractual obligation to compensate losses suffered by another individual or organization from legal proceedings such as lawsuits.

Intellectual property rights - rights over creations of a person's mind, such as inventions, literary and artistic works, designs, symbols, names, and images used in commerce.

Liability - losses from any type of legal claim, whether the claim is based on contract, tort including negligence, or another reason, and whether or not those losses could have been reasonably anticipated or foreseen.

Organization - a legal entity, such as a corporation, non-profit, or school, but not an individual person.

Outputs - results generated by the Platform, including designs, flows, mockups, code snippets, copy, or other deliverables created or produced by the Platform's AI or tools.

Parties - Shamel and you.

Personal Data - information about a particular person, including information that identifies or can reasonably be used to identify an individual.

Platform, Company, Controller, we, our, or us - Shamel, an AI-powered UI/UX, software, and product generation platform operated by SDAIA.

Third-Party - any natural or legal person or entity other than you and Shamel, unless a specific context gives the term another meaning.

Trademark Symbols - names and images used in commerce that are capable of distinguishing the goods or services of one individual or organization from those of another.

User Content or your content - things that you create, upload, submit, store, send, receive, or share using the Platform, including design assets, prompts, project files, images, text, metadata, Docs, Sheets, Slides, and Outputs.

Warranty - an assurance that a product or service will perform to a certain standard.

You or User - the individual or legal entity that registers for or uses the Platform.

Shamel is a product generation platform operated by Saudi Data & AI Authority - SDAIA.

All terms and notions defined above are general notions implemented throughout Shamel's Services, except where a certain service has specific definitions. In case of discrepancy, the specific definitions shall prevail. Words used in the singular have the same meaning in the plural.

We can collect data when you visit, register for, or use our Platform, when you update or change your personal information, purchase, or when we give you a privacy notice in other situations.

Personal information may include name, username, email address, phone number, job title, address, postal code, or other user-supplied profile details.

Security information may include passwords, passkeys, and security questions.

Contact information may include your contacts and phonebook where applicable.

Payment information, where purchases are enabled, may include credit cards or other payment method details saved to the account, billing address, invoices, and transaction history. Payment details may be processed by third-party payment processors.

User Content may include files, images, screenshots, design assets, prototypes, text, and any material you upload, submit, or create with the Platform.

Uploaded content may include design systems, UI/UX assets, documents, project files, user prompts, and AI instructions.

Usage, telemetry, and logs may include IP address, device and browser characteristics, session and usage logs, timestamps, referrer, API usage, feature usage, crash reports, and performance metrics.

Communications may include support requests, chat logs, feedback, and other communications with us.

Cookies and tracking data may include cookies, local storage, web beacons, and similar technologies for analytics, preferences, and security.

Generated technical outputs may include AI-generated source code, application structures, UI/UX layouts, development configurations, technical prompts and workflows, product generation history, and exports.

Derived and aggregated data may include anonymized or aggregated metrics derived from the above for analytics and product improvement.

We use personal data to provide and operate the Platform, including creating and maintaining accounts, authenticating users, processing transactions, hosting and delivering content, and providing customer support.

We use personal data to provide AI-driven services, including processing User Content to generate designs, flows, software products, application code, and content as requested by the user, and to support related optimization and product delivery workflows.

We use personal data to improve and develop our products, including analyzing usage, fixing bugs, testing features, and developing new services. Where contractually permitted, we may also use data to train, test, and improve our AI models.

We use personal data for security, fraud prevention, and legal compliance, including detecting and preventing abuse, enforcing our Terms of Service, complying with legal obligations, and responding to lawful requests.

We use personal data for communications and marketing, including sending account-related notices and, where consented or permitted by law, promotional materials. You may opt out of marketing communications.

User prompts, uploaded assets, and interactions may be processed by AI systems solely for delivering requested services, improving system functionality, and enhancing model performance where permitted by agreement.

We may also process personal data for legal purposes whenever Shamel is required to do so by legislation in force or by a competent public authority.

Unless otherwise stated in this policy, processing of data within the Platform is performed based on user consent, contractual necessity, legitimate business interests, and compliance with applicable laws and regulations.

By accessing or using the Platform, you acknowledge that we collect certain data automatically. If you choose not to consent to the conditions of this Privacy Policy, you may not be able to use essential features of our Platform.

Automatically collected data may include your preferences for marketing, advertising, and communication with us.

Automatically collected data may include data received from devices you use when you use the Platform, register an account, update or add information to your account, participate in online discussions or conversations, or communicate with us.

Automatically collected data may include the ID or unique identification number of your device, device type, operating system type, or similar data.

Automatically collected data may include geographic location data derived from your IP address or other device data.

Automatically collected data may include website viewing statistics, traffic to and from certain websites, links, URL references, IP addresses, browsing history, login information for our Platform or partners, and search terms or filters used.

All personal data and system data are hosted and stored within the Kingdom of Saudi Arabia.

Appropriate technical and organizational safeguards are implemented to protect data security.

Shamel implements safeguards intended to protect confidential information, reduce harmful AI outputs, and ensure compliance with Saudi regulations and organizational requirements.

We may disclose data with authorized service providers, infrastructure and hosting providers, government authorities where legally required, enterprise customers under contractual agreements, or when required to comply with legal obligations, court orders, or lawful requests by public authorities.

Where permissible, we will attempt to notify you of such requests unless prohibited by law.

Users accessing the Platform from outside Saudi Arabia acknowledge that their data will be transferred to and processed within Saudi Arabia.

The Platform is not intended for users under 18 years old.

We may update this Privacy Policy periodically. Continued use of the Platform constitutes acceptance of updated versions.

Notice: We do not sell personal data.

We retain personal data for as long as necessary to provide services, comply with legal obligations, resolve disputes, and enforce agreements.

Users may request deletion subject to applicable legal and contractual obligations.

Account data - we retain account information for as long as your account is active and for a reasonable period thereafter to comply with legal obligations and allow account restoration.

User Content - unless otherwise agreed, we retain User Content for the period necessary to provide the Service and as set out in our retention schedule, typically for the duration of the account plus the timeframe required by KSA legislation, backups, and compliance.

Backups and logs - backups and system logs may remain in immutable backups for a limited period even after deletion requests. Deletion from backups occurs on a standard backup cycle.

Retention periods may vary by applicable KSA legislation and contractual commitments.

We implement administrative, technical, and physical measures intended to protect personal data, including encryption in transit through TLS and encryption at rest where applicable.

Security measures may include access controls and role-based permissions, authentication mechanisms, infrastructure monitoring, security audits and logging, secure development practices, vulnerability management, regular security testing, and incident response and breach notification processes.

No security system is perfect, and we cannot guarantee absolute security. If a breach occurs that affects personal data in a manner that law requires notification, we will notify affected users and regulators as required by law.

Depending on KSA legislation for our Platform, you may have rights including access, correction, deletion, portability, restriction, objection, withdrawal of consent where processing is based on consent, and opt-out of targeted advertising and certain sales where applicable.

To exercise your rights, contact --------------@-----com or use controls in your account settings. We may need to verify your identity and respond consistent with local data protection laws.

Regardless of the above, users are prohibited from processing or uploading illegal content, unauthorized confidential data, and sensitive regulated data unless contractually permitted and securely handled.