This Privacy Policy explains how FursAI collects, uses, shares and protects personal data, in accordance with the Saudi Personal Data Protection Law (PDPL) and its Implementing Regulations. It applies to our websites, subdomains and applications (the “Services”) and should be read with our Terms of Service.
1. Who We Are & How to Contact Us
FursAI is operated from Riyadh, Kingdom of Saudi Arabia, and acts as the controller of personal data processed to run the Services. For any privacy request or question, contact privacy@fursai.ai (or hello@fursai.ai).
2. Our Two Roles (Controller and Processor)
- We are the data controller for the personal data of our account holders (Creators) — the data we need to provide, secure and improve the Services.
- We are a data processor for the personal data a Creator collects from their own audience, subscribers and Buyers through the Services (for example, email subscribers, inquiry-form submissions and store orders). We process that data only on the Creator’s documented instructions. The Creator is the controller of that data and warrants it obtained all consents required by the PDPL.
3. Personal Data We Collect
- Account & profile: email address, username, password (stored only as a salted hash), display/legal name, bio, profile photo, language and appearance preferences, and social-media handles you add.
- Seller & tax data: VAT number and VAT-registration status (if you provide them), and your bank details (bank name, account holder, IBAN) — used as the destination for your monthly earnings payouts and, where you enable the direct-transfer option (paid plans), shown to your Buyers at checkout. Where your plan includes your own payment gateway, your gateway API credentials (the secret key is stored encrypted and never displayed back).
- Commerce data: orders you and your Buyers generate — Buyer email, amount, currency, VAT and receipt number.
- Subscriber data (as processor for Creators): subscriber email and name, tags, and the consent trail (IP address, method, the consent text shown, and timestamp).
- Media kit & social statistics: publicly available follower counts, avatars and handles for connected platforms, retrieved at your direction (see Section 4).
- AI data: the inputs you submit to AI Helpers and the outputs generated, and AI chat messages (with token counts) — see Section 6.
- Analytics data: profile views, link clicks and QR scans, approximate country derived from IP, and a do-not-track flag.
- Security data: sessions, two-factor (TOTP) secrets (encrypted) and recovery codes (hashed), and personal access tokens (stored as hashed digests).
Payment-card details are entered with and handled by our licensed payment provider; FursAI does not store full card data.
4. Sources, Including Social-Statistics Retrieval
We collect data directly from you and from Visitors’ interactions with Creator pages. In addition, at your direction (when you add a social handle to your profile or media kit), we retrieve publicly available profile statistics for that handle — such as follower or subscriber counts and profile avatars — for Instagram, TikTok, YouTube, Snapchat and X, through ScrapeCreators, a third-party social-data API. These retrieved figures refresh periodically (approximately weekly) and are labelled as verified where they come from this retrieval; figures you type in yourself are labelled self-reported. You are responsible for your right to display this information and for its accuracy.
5. Purposes & Legal Basis (PDPL)
| Purpose | PDPL legal basis |
|---|---|
| Providing the Services, accounts, the store, orders and payouts | Performance of a contract with you |
| Marketing emails; non-essential cookies; AI features; social-statistics retrieval | Your consent |
| Security, fraud prevention and service analytics/improvement | Legitimate purpose |
| Tax-record retention and responding to lawful requests | Compliance with a legal obligation |
You may withdraw consent at any time; this does not affect processing already carried out.
6. AI Features — How Your Data Is Handled
Our AI Helpers are powered by a third-party provider, OpenAI. The inputs you submit and the outputs generated are sent to that provider solely to produce your output. Your AI inputs, outputs and chat messages may be stored in your account so you can reuse them. We do not use this data to train our own models, and we do not permit the provider to use it to train its models beyond what is necessary to provide the feature. No human reviews your prompts except where necessary for safety, abuse-prevention or legal compliance. Sending data to this provider may involve a transfer outside the Kingdom (see Section 12).
Improving our AI features. We may use information about how you interact with our AI features and services — including the feedback you choose to give (such as rating a response helpful or not) — to improve the quality, accuracy, personalization and overall experience we provide. Where this would involve reusing your own inputs or conversations beyond producing your immediate output, we do so only with your consent, which you can grant or withdraw at any time in Settings. This is never used to train third-party models.
7. Cookies & Tracking
We use cookies and similar technologies that are strictly necessary to run the Services (such as sign-in and security), simple preference cookies (your language and theme), and, only with your consent, behavioural analytics by Microsoft Clarity (session replays and heat-maps that help us improve the product). The analytics cookies are set only after you accept the cookie notice, and you can withdraw consent at any time from the same notice (it can be reopened from the footer) or by clearing cookies in your browser. Our own analytics (profile views, link clicks and QR scans) are first-party; where an analytics event records a do-not-track signal, we honour it.
8. How We Share Data & Our Sub-Processors
We do not sell or rent personal data. We share data only as needed to run the Services, with the providers below, and with authorities where legally required. Buyer data is shared with the relevant Creator only.
| Provider | Purpose |
|---|---|
| A SAMA-licensed payment service provider | Card payments for platform subscriptions and for Creator sales made through FursAI checkout (FursAI as merchant of record); Business-plan Creators may instead process on their own gateway account |
| Cloud object storage | File storage and signed digital-download delivery |
| Email delivery provider | Transactional and broadcast email delivery |
| OpenAI | AI Helpers |
| ScrapeCreators | Retrieval of publicly available social-profile statistics (Instagram, TikTok, YouTube, Snapchat, X) for handles you add |
| Microsoft Clarity | Consent-based behavioural analytics (session replay, heat-maps) |
| YouTube Data API (Google) | Public YouTube channel statistics (legacy/fallback) |
| Pexels / Coverr | Optional stock photos / videos for page design |
9. Your Rights Under the PDPL
Subject to the PDPL, you have the right to:
- be informed of how and why your personal data is processed;
- access your personal data;
- obtain a copy of your personal data in a readable, clear format;
- request correction of inaccurate or incomplete data; and
- request destruction (deletion) of your data where the law allows.
We also honour, where applicable, your request to withdraw consent you previously gave and to object to or restrict certain processing.
To exercise these rights, contact privacy@fursai.ai; we may need to verify your identity and will respond within the period required by the PDPL. You also have the right to lodge a complaint with the Saudi Data & AI Authority (SDAIA).
10. How Long We Keep Data
- Account & content: hidden during the 7-day account-deletion grace period; after the grace period the account is soft-deleted (public access stays off and the username is released) until you ask support to fully erase it or until law requires erasure.
- Tax, receipt & order records: retained for at least the six-year minimum required by the KSA VAT Implementing Regulations (longer for certain record types, such as those relating to capital assets).
- Consent records: retained as proof of consent for as long as needed and for a reasonable period afterwards.
- Analytics & logs: retained for a limited period, then deleted or anonymised.
11. Personal-Data Breach Notification
In the event of a personal-data breach, we will notify the Saudi Data & AI Authority (SDAIA) within seventy-two (72) hours of becoming aware of it, and affected individuals without undue delay where required, in accordance with the PDPL and its Implementing Regulations.
12. Cross-Border Data Transfers
Your personal data is primarily processed within the Kingdom of Saudi Arabia or in jurisdictions providing an adequate level of protection. Where data is transferred outside the Kingdom — for example to our AI (OpenAI), email, social-statistics (ScrapeCreators) and analytics (Microsoft Clarity) providers — we rely on a lawful PDPL transfer basis (transfer to a jurisdiction with an adequate level of protection recognised by SDAIA, appropriate contractual safeguards such as a data-processing agreement, or a transfer necessary to perform our contract with you), and transfer only the data necessary for the relevant purpose.
13. Children
The Services are not intended for children, and sellers must be at least 18. We do not knowingly collect personal data from children below the age threshold set by the PDPL. If you believe a child has provided personal data, contact us and we will take appropriate steps.
14. Changes to This Policy & Controlling Language
We may update this Policy and will note the effective date; for material changes we will give notice by email or in the Services. This Policy is published in Arabic and English; in the event of any conflict, the Arabic version prevails and is the binding reference.