Effective date: 21 February 2026At Edrak, we believe privacy should be clear.If you use our platform, you should be able to understand what data we process, why we process it, when it may be shared, and what choices you have. This Privacy Policy explains how Edrak collects, uses, discloses, and protects personal data when you use our websites, platform, and related services.Edrak provides a controlled platform that helps organizations access and use supported AI models in a more secure and governed way. This Privacy Policy applies to personal data processed in connection with those services, unless separate enterprise terms, data processing terms, or other contractual arrangements apply.If you use Edrak through your employer or another organization, some data may also be processed under that organization's instructions and its agreement with Edrak.
Who we areEdrak is a software platform built to help organizations use AI in a controlled, enterprise-oriented environment.If you have questions about this Privacy Policy or our privacy practices, you can contact us at:privacy@edrak.com
Scope of this Privacy PolicyThis Privacy Policy applies when you:
visit our website
create or use an Edrak account
use our platform and features
contact us for support, sales, onboarding, or other inquiries
interact with us in connection with demos, enterprise review, procurement, or contracting
This Privacy Policy should be read together with our:
Terms of Use
Cookie Policy
Acceptable Use Policy
Enterprise Terms, where applicable
Where Edrak processes customer data on behalf of an enterprise customer under a separate agreement, that processing may also be governed by a data processing addendum or other contractual terms.
The personal data we processDepending on how you use Edrak, we may process the following categories of personal data.Account and profile informationThis may include:
name
work email address
phone number
company name
job title
account credentials
subscription or billing-related details
Prompts, files, and other submitted contentWhen you use the platform, we may process data included in:
prompts
messages
uploaded files
knowledge base content
feedback
other content submitted through the service
This content may include personal data, depending on what is submitted to the platform.Usage and workspace dataWe may process information about how the platform is used, including:
activity within the workspace
feature usage
user actions
configuration settings
administrative events
service interactions needed to operate, support, and secure the platform
Technical and device informationThis may include:
IP address
browser type
device information
operating system
timestamps
log data
diagnostic information
security event information
CommunicationsIf you contact us, we may process:
the contents of your message
support requests
attachments
sales or onboarding communications
other information you choose to share with us
How we use personal dataWe use personal data to run, support, secure, and administer the service.That includes using personal data to:
provide, operate, and maintain Edrak
authenticate users and manage accounts
route requests to supported AI providers selected through the platform
deliver outputs and requested functionality
provide customer support and service communications
manage onboarding, subscriptions, billing, and related commercial matters
detect, prevent, and investigate abuse, misuse, fraud, or unauthorized access
maintain platform security, integrity, and availability
comply with legal, regulatory, contractual, and enforcement obligations
investigate suspected violations of our terms or policies
What we do not do with customer dataOn the points that matter most, our position is simple.Edrak does not:
claim ownership over customer data, prompts, or outputs
use customer data or outputs to train or fine-tune Edrak models
use customer data or outputs to train or fine-tune third-party AI models
sell customer data
use customer data for advertising
When we share personal dataWe do not share personal data casually. We share it only where needed to operate the service, support customers, comply with law, or protect the platform.Third-party AI providersEdrak supports access to selected third-party AI providers.Where a customer chooses to use those providers through Edrak:
relevant data may be transmitted to the selected provider only to deliver the requested functionality
those providers may be subject to their own terms, policies, and technical limitations
Edrak does not control third-party systems and is not responsible for their independent acts or omissions, to the extent permitted by law
Service providers and subprocessorsWe may also share personal data with service providers and subprocessors that help us host, operate, secure, support, and administer the platform.Where we use subprocessors, we expect them to be bound by written obligations appropriate to the services they provide, including obligations relating to confidentiality, security, and data protection.Legal and protection-related disclosuresWe may disclose personal data where necessary to:
comply with applicable law, regulation, court order, or governmental request
enforce our terms and policies
protect the rights, security, or property of Edrak, our customers, or others
investigate fraud, misuse, or security issues
Legal bases for processingWhere applicable law requires a legal basis for processing, Edrak may process personal data on grounds such as:
performance of a contract
compliance with legal obligations
legitimate interests in operating, securing, and supporting the platform
consent, where required by law
Where consent is required, it may be withdrawn, subject to applicable law.
Cookies and similar technologiesWe may use cookies and similar technologies to:
operate and secure our website and services
remember settings and preferences
understand usage and performance
support analytics and service functionality
For more detail, please see our Cookie Policy.
Data retentionWe keep personal data only for as long as reasonably needed for the purposes described in this Privacy Policy.That may include retaining data to:
provide and support the services
maintain platform security and integrity
comply with legal or regulatory obligations
resolve disputes
enforce contractual arrangements
complete backup and deletion cycles
In general:
data may be retained during the subscription term as needed to provide the service
after termination, data may be retained for a limited period to support retrieval, export, or operational transition
after that, data is deleted or anonymized, unless longer retention is required for legal, regulatory, billing, fraud-prevention, security, dispute, or backup reasons
SecurityEdrak applies commercially reasonable administrative, technical, and physical safeguards designed to protect personal data against unauthorized access, use, disclosure, alteration, or destruction.Depending on the service, those safeguards may include:
encryption in transit
encryption at rest
role-based access controls
workspace-level segregation
logging and monitoring
controlled access based on business need
secure API-based integrations with supported providers
Data residency and international transfersUnless otherwise agreed, Edrak's default hosting position is Saudi Arabia, subject to operational availability.Depending on the services used and the configuration selected, personal data may also be processed in other jurisdictions, including where necessary to support hosting, support operations, or selected third-party AI providers.Where relevant, Edrak seeks to apply contractual, technical, or organizational measures appropriate to the nature of the transfer and the applicable legal requirements.
Your rights and choicesDepending on the laws that apply to you, you may have rights regarding your personal data, including the right to:
access personal data
correct inaccurate personal data
request deletion of personal data
object to or restrict certain processing
withdraw consent where processing is based on consent
request a copy of certain personal data, where applicable
We may need to verify your identity before acting on a request. We may also decline or limit requests where permitted by law, including where the request would interfere with legal obligations, security requirements, contractual duties, or the rights of others.If you use Edrak through your employer or another organization, you may need to direct certain requests to that organization first, depending on the nature of the processing relationship.
Sensitive and regulated dataCustomers should use judgment before submitting sensitive personal data, confidential business information, or regulated data to the platform.Where customers choose to use Edrak in workflows involving sensitive, regulated, or high-risk data, they remain responsible for ensuring that such use complies with applicable laws, regulations, and internal policies.
Enterprise customers and organizational useIf you use Edrak through an employer, school, or other organization:
your organization may control your access to the platform
your organization may configure workspace settings, retention choices, and administrative controls
Edrak may process relevant data under that organization's instructions and contractual arrangement
your organization may be responsible for responding to certain privacy requests relating to business data processed on its behalf
Changes to this Privacy PolicyWe may update this Privacy Policy from time to time to reflect changes in law, regulation, product functionality, security practices, or our business operations.When we do, we will post the updated version on this page and update the effective date above.Where required by law, we will provide additional notice.
Contact usIf you have questions, concerns, or requests relating to this Privacy Policy or our privacy practices, contact:privacy@edrak.com