Privacy Policy

This Privacy Policy explains how Limaz ("Company", "we", "us", or "our") collects, uses, stores, and protects personal data in connection with the Naiza platform, including our website at naiza.ai, APIs, dashboard, and related services (collectively, the "Service").

We are committed to protecting your privacy and handling your data responsibly. This policy applies to all users of the Service, including account holders, team members, and visitors to our website.

By using the Service, you acknowledge that you have read and understood this Privacy Policy. If you are using the Service on behalf of an organization, this policy applies to all data processed through your organization's account.

• Account Information: When you register for an account, we collect your name, email address, company name, and other registration details you provide. This information is necessary to create and manage your account.
• Service Usage Data: We collect data about how you interact with the Service, including API call logs, dashboard activity, feature usage, rule configurations, and event processing statistics. This helps us maintain and improve the Service.
• Event Data: When you submit events to our API for fraud evaluation, we process the data contained in those events. This may include IP addresses, device identifiers, email addresses, transaction details, and other information you choose to send. You control what data is included in each event.
• Device and Technical Data: We automatically collect technical information when you access our website or dashboard, including your browser type, operating system, IP address, referring URL, and pages visited.
• Communication Data: When you contact us via email or our contact form, we retain the content of your communications along with your contact details to respond to and track your inquiries.

We use the information we collect for the following purposes:

• Service Delivery: To provide the fraud detection and risk management capabilities of the Service, including processing events, generating Decisions, maintaining device intelligence records, and enabling rule-based evaluation.
• Account Management: To create and manage your account, authenticate your access, manage team members within your Tenant, and communicate with you about your account.
• Service Improvement: To analyze usage patterns, diagnose technical issues, optimize performance, and develop new features. We use aggregated and anonymized data for this purpose wherever possible.
• Security: To detect and prevent unauthorized access, abuse, or fraud targeting the Service itself. We monitor for anomalous patterns that may indicate security threats.
• Legal Compliance: To comply with applicable laws and regulations, including the Kingdom of Saudi Arabia's Personal Data Protection Law (PDPL) and relevant NCA regulations.
• Communications: To send you service-related notifications, respond to your inquiries, and, with your consent, share product updates or relevant information about the Service.

All data processed by the Service is stored and processed entirely within the Kingdom of Saudi Arabia. Your data does not leave Saudi territory.

We use industry-standard infrastructure within Saudi Arabia to host and operate the Service. Our data centers are selected for their compliance with local regulations, physical security measures, and operational reliability.

This data residency commitment is a core aspect of our Service and applies to all Customer Data, including Event Data, account information, and any derived data such as risk scores and device profiles.

We do not sell your personal data. We do not share your data with third parties for their marketing purposes.

We may share your information in the following limited circumstances:

• Service Providers: We work with a limited number of service providers who assist us in operating the Service (such as infrastructure hosting and email delivery). These providers are contractually obligated to protect your data and may only process it on our behalf for the purposes we specify.
• Legal Requirements: We may disclose your information if required to do so by law, regulation, legal process, or governmental request from authorities within the Kingdom of Saudi Arabia.
• Business Transfers: In the event of a merger, acquisition, or sale of assets, your data may be transferred as part of that transaction. We will notify you of any such change and ensure the receiving entity honors this Privacy Policy.
• With Your Consent: We may share your information with third parties when you have given us explicit consent to do so.

We implement appropriate technical and organizational measures to protect your data against unauthorized access, alteration, disclosure, or destruction. These measures include:

Encryption of data in transit using TLS and at rest using industry-standard encryption algorithms. Role-based access controls limiting data access to authorized personnel. Regular security assessments and monitoring of our infrastructure. Secure API authentication using API keys transmitted over encrypted connections.

While we take reasonable precautions to protect your data, no method of electronic storage or transmission is completely secure. We cannot guarantee absolute security, but we are committed to promptly addressing any security incidents in accordance with applicable law.

We retain your data for as long as your account is active or as needed to provide the Service. The specific retention periods depend on the type of data:

• Account Information: Retained for the duration of your account and for a reasonable period after account closure to fulfill legal and regulatory obligations.
• Event Data: Retained in accordance with your plan terms. You may request deletion of Event Data by contacting us at contact@limaz.co.
• Usage and Technical Data: Retained in aggregated or anonymized form for analytical purposes. Identifiable usage data is retained for up to twenty-four (24) months.

When data is no longer needed, it is securely deleted or anonymized in accordance with our data management procedures.

Under the Kingdom of Saudi Arabia's Personal Data Protection Law (PDPL) and other applicable regulations, you have the following rights regarding your personal data:

• Right of Access: You may request a copy of the personal data we hold about you.
• Right to Correction: You may request that we correct any inaccurate or incomplete personal data.
• Right to Deletion: You may request the deletion of your personal data, subject to our legal retention obligations.
• Right to Object: You may object to certain processing activities where we rely on legitimate interests as our legal basis.
• Right to Data Portability: You may request your data in a structured, commonly used, machine-readable format.

To exercise any of these rights, please contact us at contact@limaz.co. We will respond to your request within the timeframes required by applicable law. We may need to verify your identity before processing certain requests.

Our website uses cookies and similar technologies to provide core functionality, remember your preferences (such as language selection), and understand how visitors use our site.

• Essential Cookies: Required for the website to function properly, including session management and language preferences. These cannot be disabled.
• Analytics Cookies: Used to understand visitor behavior and improve our website. These collect anonymized usage data. We use Ahrefs Web Analytics for traffic insights, Pingdom Real User Monitoring for performance, and Google Analytics 4 when a measurement ID is configured for the marketing site.

You can manage cookie preferences through your browser settings. Disabling certain cookies may affect the functionality of our website.

The Service is not directed to individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware that we have collected personal data from a child, we will take steps to delete that information promptly. If you believe a child has provided us with personal data, please contact us at contact@limaz.co.

We may update this Privacy Policy from time to time to reflect changes in our practices, the Service, or applicable law. We will notify you of material changes by posting the updated policy on our website and updating the "Last updated" date.

We encourage you to review this policy periodically. Your continued use of the Service after any changes indicates your acceptance of the updated Privacy Policy.

If you have questions about this Privacy Policy, wish to exercise your data rights, or have concerns about how we handle your data, please contact us at contact@limaz.co.