Privacy Policy
Version 2026-10-21, effective 21 October 2026. This Privacy Policy explains how ALANHAR ALKHAMSA COMPANY LTD., the company that operates Telvory ("Telvory", "we", "us"), collects, uses, shares and protects personal data, and the rights you have. It is written to meet the Saudi Personal Data Protection Law (PDPL) and its implementing regulations.
1. Who this policy covers
This policy applies to everyone whose personal data we handle through Telvory: people who visit our websites, workspace owners and users, technicians and help-desk agents, and End Users who join a session, meeting or webinar, or who contact a workspace through its help desk or help centre.
2. Our role: controller and processor
- We are the controller for account, workspace-administration, billing, security and website data: we decide why and how it is processed.
- For personal data inside Customer Content (what happens inside a workspace's sessions, recordings, transferred files, chat, meetings, webinars, tickets, emails and help centres), the workspace is the controller and we are its processor. We process that data only to provide the Service on the workspace's instructions, as set out in the Terms and Conditions.
If you are an End User of a workspace, that organisation decides how your data is used inside its workspace. Please contact it first; if you contact us, we will pass your request to it.
3. Personal data we collect
| Category | Examples |
|---|---|
| Account data | name, email address, phone number if given, password (stored only as a secure hash), multi-factor settings, role, workspace membership, language and time-zone preferences |
| Workspace and billing data | organisation name, billing contacts, address, VAT number, subscription, invoices, payment status, card brand and last four digits returned by the payment provider |
| Device data | device name, operating system, agent version, IP address, online status and health signals, installed-agent consent record |
| Session data | who connected to which device and when, consent events, session reports, chat, notes, recordings and file-transfer records where enabled |
| Meetings and webinars | participant names and email addresses, registration answers, attendance, chat and recordings where enabled |
| Help desk data | requester names and email addresses, tickets, messages, attachments, satisfaction ratings and comments, help-centre questions |
| Security and usage data | sign-in events, IP address, browser type, audit-log entries, error and performance logs |
| Communications | messages you send us through our contact form, by email or through support |
We do not ask for special categories of data (such as health or religious beliefs). Do not enter them into the Service unless it is necessary and lawful for your purpose.
4. How we collect it
From you (when you sign up, set up a workspace, subscribe or contact us); from your workspace's administrators (when they invite you or enrol devices); automatically from the Service, the Agent software and your browser (sign-in events, device status, logs and cookies); and from our payment provider (payment results).
5. Why we use it and our legal bases
| Purpose | Legal basis |
|---|---|
| Creating and running accounts and workspaces, providing remote support, meetings, webinars and the help desk | performing our contract with you |
| Taking payments, issuing tax invoices and keeping accounting records | contract, and legal obligations under Saudi tax and commercial laws |
| Securing the Service: authentication, multi-factor sign-in, fraud and abuse prevention, audit logs | our legitimate interest in a secure service, and legal obligations |
| Sending service, security and billing notices | contract and legitimate interest |
| Answering questions and support requests | contract or legitimate interest |
| Improving reliability and fixing faults using logs and aggregated usage | legitimate interest |
| Complying with laws and lawful requests from competent authorities | legal obligation |
| Anything else we ask you to agree to | your consent, which you can withdraw at any time |
We do not sell personal data, do not use Customer Content for advertising, and do not use it to train AI models.
6. Remote sessions, recordings and consent
Technicians can view or control a device only within the workspace's policies. In attended sessions the End User is told who is connecting and can end the session at any time. Unattended access is set up when the Agent software is installed by someone with authority over the device; that consent is recorded and can be withdrawn by uninstalling the agent or removing the device. When a session, meeting or webinar is recorded, participants are told. Do not share passwords or card details during a session unless you trust the organisation and it is necessary.
7. AI features
If a workspace turns on AI features, such as session summaries or the help-centre answer assistant, the relevant text is sent to our AI model provider to produce the result. The provider receives only what is needed to produce that result. Workspaces can turn these features off at any time.
8. Payments
Card payments are handled by a payment provider licensed in the Kingdom of Saudi Arabia. Your full card number and security code go directly to the provider; we never see or store them. We keep the payment reference, amount, status and the card brand and last four digits for billing, reconciliation and legal records.
9. Who we share data with
We share personal data only with the sub-processors below, with professional advisers under confidentiality, with a successor if our business is transferred, and with authorities where the law requires it. Each sub-processor is bound by a written agreement to protect the data and use it only for the stated purpose.
| Sub-processor | Purpose | Location |
|---|---|---|
| Microsoft Azure (Microsoft Corporation) | hosting of the Service, databases, storage of recordings, files and attachments, connection relays | United Arab Emirates (UAE North region) |
| Azure Communication Services (Microsoft Corporation) | sending service, security, billing and help-desk email | Microsoft data centres |
| Moyasar | card payment processing | Kingdom of Saudi Arabia |
| Cloudflare, Inc. | domain name services and routing of inbound email to our addresses and to help-desk mailboxes | global network |
| AI model provider | AI features, only when a workspace turns them on | may be outside the Gulf region |
| SMS provider | text-message notifications, only when a workspace turns them on | may be outside the Gulf region |
We will update this list before adding a new sub-processor that handles Customer Content, and workspace owners will be notified.
10. Where data is stored and international transfers
The Service and its data are hosted in the Gulf region, in Microsoft Azure's UAE North region (Dubai, United Arab Emirates). This means personal data is transferred outside the Kingdom of Saudi Arabia. Such transfers, and any made to the sub-processors above, are carried out in line with the PDPL and its regulation on transferring personal data outside the Kingdom, limited to what is needed for the purpose, and protected by contractual commitments and the security measures in section 12.
11. How long we keep data
| Data type | Default retention | Notes |
|---|---|---|
| Account and workspace data | while the account is open | deleted or anonymised after the workspace is closed, except what the law requires us to keep |
| Invoices, payments and accounting records | for the period Saudi tax and commercial-record laws require | kept even after closure |
| Session recordings | 30 days | the workspace can set 1 to 90 days |
| Meeting and webinar recordings | 90 days | the workspace can delete them sooner |
| Chat transcripts | 365 days | the workspace can set 7 days to 10 years |
| File-transfer records | 365 days | the workspace can set 7 days to 10 years; file contents pass through the encrypted session |
| Session reports and history | 2 years | the workspace can set 30 days to 10 years |
| Help-centre answer assistant questions | 180 days | the workspace can set 7 days to 10 years |
| Help desk tickets, messages and attachments | while the workspace keeps them | deleted when the workspace deletes them or is closed |
| Audit logs | 2 years | the workspace can keep them 1 to 10 years; never less than 1 year |
| Device heartbeat logs | 90 to 180 days | operational diagnostics |
| Sign-in sessions and one-time security codes | 30 to 90 days | security records |
| Notifications | 180 days | in-app notification feed |
| Sign-ups that were never completed | 14 days | deleted automatically |
When a retention period ends, the data is deleted or anonymised. Data may be kept longer only where the law requires it or to establish or defend a legal claim.
12. How we protect data
We protect personal data with measures appropriate to the risk, including: encryption in transit (TLS) and at rest; encrypted media for remote sessions, meetings and webinars; strict separation between workspaces, tested automatically; role-based access and multi-factor authentication; a tamper-evident audit log; signed agent software; least-privilege access for our staff; monitoring, backups and incident response. No system is perfectly secure, so please use strong, unique passwords and multi-factor authentication.
13. Personal data breaches
If a personal data breach occurs, we act at once to contain it and assess the risk. Where required, we notify the Saudi Data and Artificial Intelligence Authority (SDAIA) within 72 hours of becoming aware of it, notify affected workspaces without undue delay, and inform affected individuals where the breach may cause them harm.
14. Your rights
Under the PDPL you have the right to:
- be informed about how your personal data is collected and used;
- access your personal data and obtain a copy in a readable format;
- ask us to correct, complete or update it;
- ask us to destroy it when it is no longer needed, subject to legal retention duties;
- withdraw consent where processing is based on consent;
- complain to the Saudi Data and Artificial Intelligence Authority (SDAIA).
Many of these you can do yourself in your profile and workspace settings. Otherwise write to privacy@telvory.app. We may need to verify your identity, and we respond within 30 days; if a request is complex we may extend this by up to a further 30 days and will tell you why. Requests about data inside a workspace are handled together with that workspace, which is its controller.
15. Children
The Service is for businesses and professionals and is not directed at children. Workspaces must not use it to collect children's data without a lawful basis and the consent of a parent or guardian.
16. Cookies
We use only cookies that are strictly necessary for the Service or that remember your preferences; we use no advertising or tracking cookies. See the Cookie Policy for the full list.
17. Changes to this policy
We may update this policy. Each version carries a version label and effective date; we notify workspace owners in the console and by email before material changes take effect, and owners are asked to accept the new version.
18. Contact
For privacy questions or to exercise your rights, write to privacy@telvory.app. Our postal address is shown on our invoices. You may also contact the Saudi Data and Artificial Intelligence Authority (SDAIA).