This Privacy Policy explains how Almotabaa Alarabiya Ltd. ("Pright", "we", "us") collects, uses, stores, and shares information when you use the Pright web application, chat-channel capture (WhatsApp, Slack, Discord), and API/MCP integrations (together, "the Service"). It applies to workspace owners, administrators, and team members. Pright serves B2B teams globally; as a Saudi-registered company, we design with the Saudi Personal Data Protection Law (PDPL) in mind, alongside general international data-protection practice — see "Saudi PDPL & international transfers" below.
Account information: name, email address, company/workspace name, and profile details you provide when signing in with Google via our authentication provider. Content you create: interaction logs, entity records (people, companies, assets), tasks, custom attributes, tags, and any text you submit for AI parsing or to Ask Pright. Team & workspace data: invites, roles, workspace names, and member lists. Billing information: plan, seat count, and subscription status — payment card details are handled entirely by our payment processor and never touch our own servers (see "Sub-processors"). Usage & device data: pages visited, feature usage, approximate location derived from IP address, browser/device type, and error diagnostics — collected only where analytics or error monitoring is enabled for your workspace.
We use your data solely to provide, secure, and improve the Pright service: authenticating you, running AI parsing to extract entities/sentiment/tasks from what you log, generating summaries and relationship timelines, powering Ask Pright's agent responses, sending transactional email (welcome, invites, payment confirmations, task reminders), processing billing, and diagnosing errors. We do not sell your data, and we do not use your workspace content to train our own or any third party's AI models.
Pright uses the Anthropic Claude API to parse interaction logs, generate summaries, suggest tasks, and answer questions through Ask Pright. The text you submit — and the minimum workspace context needed to resolve it (e.g. existing entity names, team member names) — is sent to Anthropic's API for processing. Anthropic does not use API content submitted through Pright to train its models, and does not retain it beyond what's needed to serve the request and meet legal/safety obligations, per Anthropic's own commercial API terms. We do not store your content on Anthropic's infrastructure beyond the duration of the API call.
We rely on a small set of specialized infrastructure providers to run the Service, each processing data solely on our instructions and only to the extent needed for their function: Convex (application database — stores your workspace's entities, logs, tasks, and account data), WorkOS (authentication — manages sign-in, sessions, and identity, including the Google OAuth connection), Anthropic (AI processing — see above), Moyasar (payment processing — handles card details directly; we never see or store full card numbers), Resend (transactional email delivery), Vercel (application hosting), and, where enabled for your workspace, PostHog (product analytics) and Sentry (error monitoring). We maintain a Data Processing Agreement with sub-processors that handle personal data on our behalf, and we'll provide our current sub-processor list on request.
Your data is stored on Convex's managed cloud infrastructure. All data is encrypted in transit (TLS) and at rest. Workspace data is logically isolated by tenant — every query is scoped to your workspace, and no other workspace can access your data. Access to production data is restricted to personnel who need it to operate the Service. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security, but we apply industry-standard safeguards throughout.
Your data is retained for as long as your account is active. If you cancel your subscription or close your account, we retain your data for 30 days before permanent deletion, giving you time to export it or reactivate. You can request earlier deletion at any time by emailing hello@pright.so. Billing records are retained longer where required by tax and accounting law. Error-monitoring and analytics data (where enabled) is retained on a rolling basis per our providers' standard retention windows and is not kept indefinitely.
We do not sell your personal data or share it with third parties for their own marketing purposes. We share data only with the sub-processors listed above, each bound by contractual confidentiality and data-protection obligations, and only to the extent necessary to provide the Service. We may disclose data if required by law, regulation, or valid legal process, or to protect the rights, property, or safety of Pright, our users, or the public — and we'll notify affected users where legally permitted to do so. If Pright is involved in a merger, acquisition, or asset sale, your data may be transferred as part of that transaction, subject to the same protections described here.
Where the Saudi Personal Data Protection Law (PDPL) applies to your use of the Service, we process personal data in accordance with its requirements, including the data-subject rights described below. Because our sub-processors operate globally, your data may be transferred to and processed in countries outside Saudi Arabia and the GCC, including the United States and the European Economic Area. Where we transfer personal data internationally, we rely on appropriate safeguards — such as contractual data-protection commitments with our sub-processors — consistent with PDPL's cross-border transfer requirements and other applicable data-protection law.
Subject to applicable law (including PDPL and, where relevant, GDPR-equivalent rights), you have the right to access the personal data we hold about you, correct inaccurate data, request deletion, export your data in a portable format, object to or restrict certain processing, and withdraw consent where processing is based on consent. You can export your interaction logs and entity records directly from workspace settings at any time. Workspace owners and admins can manage team member access and data through team settings. To exercise any of these rights, contact us at hello@pright.so — we aim to respond within 48 hours and to resolve requests within the timeframe required by applicable law.
We use a small number of cookies to run the Service: a session cookie set by our authentication provider (WorkOS) to keep you signed in, a short-lived cookie used only during the Google sign-in redirect to prevent CSRF attacks (expires within 10 minutes), and a cookie that remembers your language preference (Arabic/English). Where analytics is enabled for your workspace, PostHog may set cookies or use similar device-identification techniques to understand feature usage in aggregate — this is used for product improvement, not advertising. We do not use third-party advertising cookies or sell data collected via cookies.
Pright is a business tool intended for users 18 and older. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us at hello@pright.so and we will delete it.
If we become aware of a data breach that poses a risk to your personal data, we will notify affected workspace owners and, where required by applicable law (including PDPL), the relevant regulatory authority, without undue delay and in accordance with legally mandated timeframes.
We may update this Privacy Policy from time to time to reflect changes in our practices, the Service, or applicable law. We will notify you of material changes via email or an in-app notice before they take effect. Continued use of Pright after changes take effect constitutes acceptance of the updated policy.
Pright is operated by Almotabaa Alarabiya Ltd., King Abdulaziz Road, The Space Office #24, Jeddah, Kingdom of Saudi Arabia. For privacy-related questions, data-subject requests, or to reach our data protection point of contact, email hello@pright.so. We aim to respond within 48 hours.