Privacy Policy

Effective date: 05.06.2026

Thank you for choosing our AI-powered UI/UX design platform! Because your privacy is extremely important to us, Shamel is committed to protect and respect your privacy, by this privacy notice we describe how we collect and process your personal data through the Platform. This Privacy Policy explains how Shamel collects, uses, discloses, and protects personal and other data when you register for or use our AI-powered UI/UX, software, and product generation platform. By registering, accessing or using the Platform you agree to this Privacy Policy. If you do not agree, do not register or use the Platform.

• Controller:SDAIA
• Address:
• Privacy contact: ---------

Data Protection Officer : --------

• Account - your user account registered on the Platform.
• API - Application Programming Interface. It is a set of rules and protocols that allow Shamel to communicate and exchange data with each other without human intervention.
• Applicable legislation- refers to Kingdom of Saudi Arabia legislation framework.
• Copyright - A legal right that allows the creator of an original work (e.g., a blog post, photo, video, code etc.) to decide if and how that original work may be used by others, subject to certain limitations and exceptions (such as “fair use” and “fair dealing”).
• Deadline – is a time limits that Shamel places for the provision of a certain request/service.
• Derived Data / Model Data – aggregated, anonymized, processed or transformed data derived from User Content or usage logs used for analytics, model improvement, or product development.
• Disclaimer - A statement that limits someone’s legal responsibilities
• Government User - any Government Entity that enters into a contract, Service Order, or MSA for Platform services.
• Indemnify or indemnity – The contractual obligation to compensate the losses suffered by another individual or organization from legal proceedings such as lawsuits.
• Intellectual property rights (IP rights) - Rights over the creations of a person’s mind, such as inventions (patent rights); literary and artistic works (copyright); designs (design rights); and symbols, names, and images used in commerce (trademarks). IP rights may belong to you, another individual, or an organization
• Liability - Losses from any type of legal claim, whether the claim is based on a contract, tort (including negligence) or other reason, and whether or not those losses could have been reasonably anticipated or foreseen.
• Organization - A legal entity (such as a corporation, non-profit, or school) but not an individual person.
• Outputs - results generated by the Platform (designs, flows, mockups, code snippets, copy, or other deliverables created or produced by the Platform’s AI or tools).
• Parties - signifies Shamel and You
• Personal Data - information (typically held electronically) about a particular person, including, but not limited to, sensitive information regarding their finances, medical history, or information that identifies or can reasonably be used to identify an individual.
• Platform, Company, Controller, we, our, or us - Shamel (“Platform”), an AI-powered UI/UX, software, and product generation platform operated by SDAIA .
• Third-Party - Signifies any natural or legal person/entity, other than You and Shamel. For certain purposes the term third-party may have other meanings.
• Trademark Symbols - names, and images used in commerce that are capable of distinguishing the goods or services of one individual or organization from those of another.
• User content, your content - Things that you create, upload, submit, store, send, receive, or share using the Platform., such as: design assets, prompts, project files, images, text, metadata, Docs, Sheets, and Slides you create blog posts you upload etc., and the outputs.
• Warranty - An assurance that a product or service will perform to a certain standard.
• You, User – the individual or legal entity that registers for or uses the Platform.
• product generation platform operated by Saudi Data & AI Authority – SDAIA.

All the terms and notions defined above are general notions and, as such, are implemented throughout all of Shamel's Services, except if a certain service has specific definitions of notions and terms, in which case the specific definitions of notions and terms will be applicable. In case there is any discrepancy between the definitions of these general notions and the definitions of specific notions, then the definitions of the specific notions shall prevail. All the words used in the singular shall have the same meaning in plural.

We can collect data when you visit, register for, or use our Platform, when you update or change your personal information, purchase, or when you encounter other situations when we give you a privacy notice. Data we collect/process/store include but are not limited to:

• Personal information: Name, username, email address, phone number, job title, address, postal code or any user-supplied profile details.
• Security information: Password or passkey and security questions. Contact information: Your contacts and phonebook.
• Payment information: In cases when you purchase, you may be asked for: Credit cards or other payment methods/details saved to the account (processed by third-party payment processors), billing address, invoices, transaction history.
• User Content: Files, images, screenshots, design assets, prototypes, text, and any material you upload, submit, or create with the Platform.
• Uploaded content: Design system, UI/UX Assets, Documents, Project files, User prompts and AI instructions.
• Usage, Telemetry & Logs: IP address, device and browser characteristics, session and usage logs, timestamps, referrer, API usage, feature usage, crash reports, and performance metrics.
• Communications: Support requests, chat logs, feedback, and other communications with us.
• Cookies & Tracking: Cookies, local storage, web beacons, and similar technologies for analytics, preferences, and security.
• Generated Technical Outputs: AI-generated source code, application structures, UI/UX layouts, evelopment configurations, technical prompts and workflows, product generation history and exports.
• Derived & Aggregated Data - Anonymized or aggregated metrics derived from the above for analytics and product improvement.

We use personal data for the following purposes:

• To provide and operate the Platform: To create and maintain accounts, authenticate users, process transactions, host and deliver content, and provide customer support.
• To provide AI-driven services: To process User Content to generate designs, flows, software products, application code, and content as requested by the user, and to support related optimization and product delivery workflows.
• To improve and develop our products: To analyze usage, fix bugs, test features, and develop new services. Where contractually permitted, we may also use data to train, test, and improve our AI models.
• Security, fraud prevention and legal compliance: To detect and prevent abuse, enforce our Terms of Service, comply with legal obligations, and respond to lawful requests.
• Communications and marketing: Send account-related notices and, where consented or permitted by law, promotional materials. You may opt out of marketing communications.
• User prompts, uploaded assets, and interactions may be processed by AI systems solely for: delivering requested services, improving system functionality, and enhancing model performance where permitted by agreement.

Legal purposes: Whenever Shamel is required to, by the legislation in force by a competent Public Authority.

Unless different is foreseen in this policy, for other issues the processing of data within the Platform is performed based on:

• User consent;
• Contractual necessity;
• Legitimate business interests;
• Compliance with applicable laws and regulations.

Automatic Data – By signing this Privacy Policy, you acknowledge that by accessing or using the Platform, we collect certain data automatically. Nevertheless, if you choose not to consent to the conditions of this Privacy Notice, you may not be able to utilize essential features of our Platform. Automatically collected data include:

• Your data on preferences for marketing, advertising, and communication with us.
• Data received from devices You utilize when You use our Platform, register an account with our Platform, update or add information to your account, participate in online discussions or conversations, and/or when You communicate with us.
• Data on the ID or unique identification number of your device, the type of device, the type of operating system, or similar data.
• Your geographic location data deriving from your IP address, or other device data.
• Data from your devices such as website viewing statistics, circulation of and/ or from certain websites, links, URL references, IP addresses, browsing history, or your login information for our Platform, or partners.
• Data on search terms and/or filters used.

All personal data and system data are hosted and stored within the Kingdom of Saudi Arabia. Appropriate technical and organizational safeguards are implemented to protect data security. Shamel implements safeguards intended to:

• Protect confidential information;
• Reduce harmful AI outputs;
• Ensure compliance with Saudi regulations and organizational requirements.

We may disclose data with authorized service providers, infrastructure and hosting providers, government authorities where legally required, enterprise customers under contractual agreements, or when it is required to comply with legal obligations, court orders, or to respond to lawful requests by public authorities. Where permissible, we will attempt to notify you of such requests unless prohibited by law. Users accessing the Platform from outside Saudi Arabia acknowledge that their data will be transferred to and processed within Saudi Arabia. The Platform is not intended for users under 18 years old. We may update this Privacy Policy periodically. Continued use of the Platform constitutes acceptance of updated versions. NOTICE: We do not sell personal data.

We retain personal data:

• For as long as necessary to provide services;
• To comply with legal obligations;
• To resolve disputes;
• To enforce agreements.

Users may request deletion subject to applicable legal and contractual obligations. Account data -We retain account information for as long as your account is active and for a reasonable period thereafter to comply with legal obligations and allow account restoration. User Content -Unless otherwise agreed, we retain User Content for the period necessary to provide the Service and as set out in our retention schedule (typically for the duration of the account plus the timeframe required by the KSA legislation, for backups and compliance). Backups & logs - Backups and system logs may remain in immutable backups for a limited period even after deletion requests; deletion from backups occurs on a standard backup cycle. Retention periods may vary by the applicable KSA legislation and contractual commitments.

We implement administrative, technical, and physical measures intended to protect personal data, including:

• Encryption in transit (TLS) and encryption at rest where applicable;
• Access controls and role-based permissions;
• Authentication mechanisms;
• Infrastructure monitoring;
• Security audits and logging;
• Secure development practices, vulnerability management, and regular security testing;
• Incident response and breach notification processes.

No security system is perfect. We cannot guarantee absolute security. If a breach occurs that affects personal data in a manner that law requires notification, we will notify affected users and regulators as required by law.

Depending on KSA legislation for our Platform, you may have rights including:

• Access: request a copy of personal data we hold about you.
• Correction: request correction of inaccurate data.
• Deletion: request deletion of personal data (subject to exceptions).
• Portability: request a machine-readable copy of your data.
• Restriction: request limitation of processing.
• Objection: object to certain processing activities.
• Withdraw consent: withdraw consent where processing is based on consent.
• Opt-out of targeted advertising and certain sales (where applicable).

To exercise your rights, --------------@-----com or use controls in your account settings. We may need to verify your identity and respond consistent with local data protection laws. Regardless of everything users are prohibited to process/upload:

• Illegal content;
• Unauthorized confidential data;
• Sensitive regulated data unless contractually permitted and securely handled.