Early Access — This document reflects our current operational practices and has been prepared with reference to Saudi PDPL requirements. It has not yet been reviewed by external legal counsel. Content may be updated as the platform evolves.

Privacy Policy

Version 1.0 | Effective date: pending legal finalisation

1. Data Controller

Bana'i (بنائي) is a building compliance management platform operated under the brand Imtisal (إمتثال) by Osama Shehab. The platform is currently in early-access stage. Commercial registration is in progress. For data protection enquiries, contact privacy@binaey.com.

2. Data We Collect

We collect the following categories of personal data:

Identity data: full name
Contact data: email address, phone number
Technical data: IP address, user-agent string, login timestamps
Compliance data: building information, inspection records, certificates
Consent records: timestamped record of consents given or withdrawn
legal.privacy.sections.collected.item6
legal.privacy.sections.collected.item7

legal.privacy.sections.purpose.heading

legal.privacy.sections.purpose.intro

legal.privacy.sections.purpose.item1
legal.privacy.sections.purpose.item2
legal.privacy.sections.purpose.item3
legal.privacy.sections.purpose.item4
legal.privacy.sections.purpose.item5
legal.privacy.sections.purpose.item6

3. Legal Basis for Processing

We process your personal data on the following legal bases under PDPL Article 6:

Contractual necessity: processing required to provide the compliance management service you have contracted for
Explicit consent: marketing communications and optional data processing, where you have provided separate, freely-given consent
Legal obligation: retention of compliance records as required by Saudi Building Code and Civil Defence regulations
legal.privacy.sections.basis.item4

5. Data Retention

We retain personal data for the following periods, in accordance with RES-004 §7.3:

Account data (name, email, phone): retained for the duration of your account plus 3 years after closure
Compliance and building records: retained for 7 years to comply with Saudi Building Code requirements
Marketing consent records: retained for 3 years from last interaction; withdrawn consent records are retained as evidence
legal.privacy.sections.retention.item4
legal.privacy.sections.retention.item5

4. Your Data Subject Rights

Under the Saudi PDPL you have the following rights:

Right to access: obtain a copy of your personal data (PDPL Article 4)
Right to correction: request correction of inaccurate data (PDPL Article 5)
Right to erasure: request deletion of your data subject to legal retention requirements (PDPL Article 6)
Right to withdraw consent: withdraw any consent at any time without affecting the lawfulness of prior processing (PDPL Article 10)
Right to restriction: request that we restrict processing of your data in certain circumstances
legal.privacy.sections.rights.item6
legal.privacy.sections.rights.item7

We will respond to data subject rights requests within 30 days as required by PDPL. To exercise your rights, contact privacy@binaey.com.

6. Cross-Border Data Transfer

The Platform currently uses Supabase database infrastructure hosted in Frankfurt, Germany (EU). This means your personal data is stored and processed outside the Kingdom of Saudi Arabia. We disclose this transparently in accordance with PDPL Article 29. During our early-access period, your use of the Platform constitutes informed consent to this cross-border transfer. We implement encryption in transit and at rest, along with strict access controls. We are evaluating options to host data within the GCC region and will update this section when arrangements change.

legal.privacy.sections.security.heading

legal.privacy.sections.security.body

legal.privacy.sections.security.item1
legal.privacy.sections.security.item2
legal.privacy.sections.security.item3
legal.privacy.sections.security.item4
legal.privacy.sections.security.item5
legal.privacy.sections.security.item6

legal.privacy.sections.cookies.heading

legal.privacy.sections.cookies.body

legal.privacy.sections.cookies.item1
legal.privacy.sections.cookies.item2
legal.privacy.sections.cookies.item3

legal.privacy.sections.cookies.manage

legal.privacy.sections.changes.heading

legal.privacy.sections.changes.body

7. Contact & Data Protection Officer

For privacy enquiries, data subject rights requests, or to report a data protection concern, contact our Data Protection Officer at privacy@binaey.com

legal.privacy.sections.contact.address