Privacy Policy — the ARK47 Platform

1. Scope of this Policy — read this section first

1.1 Purpose. This Policy sets out how APEX Operations Company (the "Company" or "we") collects, processes, retains and destroys personal data in its capacity as Controller, your rights in respect of it and how to exercise them, in implementation of what the Personal Data Protection Law issued by Royal Decree No. (M/19) dated 9/2/1443H and its Implementing Regulations require by way of publishing a privacy policy and making it available to data subjects before their data is collected. This Policy is made available before your data is collected, is displayed to you at registration before it is completed, and your review of it is documented in accordance with Clause 5.2 of the Terms and Conditions.

1.2 Who this Policy addresses. This Policy addresses:

• (a) visitors to the ark47.ai website and those who contact us through it;

• (b) representatives of Customers and their Authorised Users who create accounts on the Platform or use it;

• (c) those who contact our sales or support teams, subscribe to our mailing lists, or take part in our events;

• (d) applicants for employment with us, as regards application data.

1.3 Who this Policy does not address — an important notice. Our Customers are establishments that use the Platform to configure and operate their Applications. The personal data that our Customers enter into their Applications or collect through them — such as the data of their employees, their End Users, their contacts, their correspondence and their calls — is data of which the Customer is the Controller, and which we process on its behalf and in accordance with its instructions in our capacity as Processor. If you are a customer or an employee of one of our Customers, the privacy notice that governs your data is that Customer's notice, and you should approach it to exercise your rights; we refer to it without delay any request that reaches us from you. Section (16) of this Policy sets out how we process that data in our capacity as Processor.

1.4 Supplementary documents. This Policy is read together with: the General Terms and Conditions of Use of the ARK47 Platform and the Personal Data Processing Addendum contained in them, the Sub-processor List, which we provide to Customers on request, and the terms and conditions and the privacy policy of the customer relationship management system where applicable.

2. Who we are and how to contact us

2.1 The Controller. APEX Operations Company, a Saudi limited liability company registered under Unified Number 7051961980, whose head office is at Riyadh, King Salman District, Ibn Zaydan Street, Postal Code 12443.

2.2 Contact for data protection. The Company has designated a point of contact for personal data protection matters, who may be contacted at [email protected], or at the postal address above marked for the attention of the "Data Protection Officer".

2.3 Channels for exercising rights. You may exercise the rights set out in Section (10) by writing to [email protected].

3. The legal framework

We process personal data in accordance with the Personal Data Protection Law and its Implementing Regulations, the Regulation on Personal Data Transfer outside the Kingdom issued by the Saudi Data and Artificial Intelligence Authority, the E-Commerce Law issued by Royal Decree No. (M/126) dated 7/11/1440H and its Regulation as regards the data of those dealing electronically, the Anti-Cyber Crime Law, and all other laws in force in the Kingdom of Saudi Arabia. We are guided by the artificial intelligence ethics principles and the controls issued by the Saudi Data and Artificial Intelligence Authority as regards the use of artificial intelligence technologies.

4. The data we collect and how we collect it

4.1 Data you provide to us directly.

4.2 Data collected automatically when the website or the Platform is used. Internet Protocol address; device, browser and operating system type; the pages and features used and the times of use; event and error logs; the electronic acceptance data for the Terms (the date, the time, the Internet Protocol address, the version number and its digital fingerprint); cookies and similar technologies (Section 13); and the metering and consumption data necessary for billing. When you take certain steps on the website or in the Platform, our own servers also count them, as daily totals that identify no one (Clause 13.4); and on the public pages of the website only — never inside the Platform after sign-in — the Cloudflare Web Analytics service counts visits, without any cookie and without storing anything in your browser, as set out in Clause 13.5. If you arrive from one of our ads and create an account, the click identifier that the ad's link carried is kept with your account; if the ad was one of ours on ChatGPT, it is also reported to OpenAI, as set out in Clause 13.6. If you choose "Agree" in the question about cookies (Clause 13.11), the pixels of our ads — those of TikTok, Meta, Snapchat, X and Google Ads — also receive data about your visits to the public pages of the website directly from your browser, and set their own cookies in it, as set out in Clauses 7.6 and 13.12; they never run inside the Platform after sign-in, and nothing is sent to them before you agree. And in the ARK47 phone app, only after you agree, your device's advertising identifier (Clause 13.13).

4.3 Data we receive from third parties. Commercial registration and commercial identity verification data from the available government bodies and platforms, payment confirmations from payment service providers, and data from our partners where you have authorised them to share it with us.

4.4 Data we do not collect and do not request. We do not request, for our own purposes, any sensitive data (such as health, biometric, belief-related, ethnic-origin or criminal-record data), and we do not knowingly collect the data of minors. If data of this kind reaches us without being requested, we destroy it unless the law requires otherwise.

5. Why we process your data and on what legal basis

5.1 The rule. We do not process your personal data except for a specific and legitimate purpose, on one of the legal bases prescribed by the Personal Data Protection Law, and to the minimum extent necessary to achieve the purpose.

5.2 Table of purposes and bases.

5.3 Legitimate interest. Where we rely on legitimate interest, we document an assessment balancing our interest against your rights and interests; we do not rely on it in any case for the processing of any sensitive data, nor where the effects of the processing on your rights outweigh it.

5.4 Consequences of not providing the data. If you do not provide the data marked as mandatory in Section (4), we will not be able to create your account, activate your subscription, issue your invoices or provide you with support. As for optional data, the only consequence of not providing it is that the feature associated with it will not be available.

5.5 Consent and its withdrawal. Where we rely on your consent, it is requested from you separately from acceptance of the Terms and for a specific purpose, and you may withdraw it at any time by writing to [email protected] — and you may also withdraw your consent to the pixels of our ads directly, by choosing "Reject" through the "Cookie settings" link in the website footer (Clause 13.11) — without this affecting the lawfulness of the processing that preceded the withdrawal.

6. Artificial intelligence and automated decisions

6.1 The Platform relies on generative artificial intelligence technologies. As regards your data in your capacity as a representative of the Customer or an Authorised User, we do not take any automated decision producing a material legal or contractual effect on you without human intervention, save for automated security measures (such as stopping suspicious sign-in attempts), which you may object to and have reviewed by a natural person by contacting us.

6.2 We do not use the personal data of your account to train general artificial intelligence models. The use of Inputs and of structural metadata to improve the Platform is governed by what is set out in Clause 9.9 of the Terms and Conditions, and takes place after anonymisation such that the data cannot — by any reasonable means — be linked to any natural person.

6.3 Where you interact with automated systems of ours (such as the automated support assistant), we disclose that to you at the start of the interaction and make a natural person reachable to you.

6.4 To build and change your Applications, what you write in the Studio — your messages, and the parts of your Applications they need — is sent to the artificial intelligence model providers in the table in 7.2, which process it to generate replies and code. In the mobile app we ask for your permission before your first message (5.5); you may withdraw it by writing to [email protected], after which the Studio cannot answer you.

7. With whom we share your data

7.1 The rule. We do not sell or rent your personal data, and we do not disclose it except to the categories set out below and to the extent necessary for the purpose.

7.2 Sub-processors. We engage service providers who process data on our behalf under written agreements binding them to confidentiality and to a level of protection no lower than our own obligations. We do not publish their names, save for the two services named below; the list — with each provider's name, the purpose of the engagement, its location and its country of processing — is provided to our Customers in writing on request. The categories are:

The two services we name. We name the Web Analytics service of Cloudflare and the Contentsquare service below as an exception to the rule of not publishing the names of Sub-processors, because each of them receives something directly from your browser; the exception extends to no other provider.

We use the Web Analytics service of Cloudflare, Inc. (United States of America), which is already our content delivery and protection network, to count visits to the public pages of the website (Clause 13.5). It sets no cookie, stores nothing in your browser, receives no identifier of you or of your account, and does not run inside the Platform after sign-in. Cloudflare processes this data in its capacity as Processor on our behalf under its data processing addendum, and it is processed in the United States of America and in the other countries where Cloudflare operates.

We also use the Contentsquare service provided by Content Square SAS (France) for the feedback form alone: a page of its own that our "Feedback" link opens, where it receives what you choose to write there and your rating (Clause 13.9). Content Square SAS processes this data in its capacity as Processor on our behalf under its terms of use and its data processing agreement, and it is processed in the European Union (Ireland) and in the other countries where the provider operates. No script of Contentsquare's is loaded on the website or in the Platform, and it receives no identifier of your account.

Save the pixels of our ads, which run on the public pages of the website only and only with your consent (Clauses 7.6 and 13.12), we use no other third-party analytics, measurement, recording or advertising tool on the website or in the Platform, and we use no messaging channel other than e-mail; save our report to OpenAI of a sign-up from one of our ads on ChatGPT (Clause 7.5) and what those pixels send from your browser after you agree (Clause 13.12), no measurement data is sent to any third party. If we add any, this Policy and the Sub-processor List are updated.

When you arrive through a link that carries campaign tags, for example a link in one of our videos, or the click identifier of one of our ads, we record them, the page you landed on and the website that sent you, together with your answer to "How did you hear about us?". We read them from the link at the moment you sign up and keep them with your account, to learn which of our campaigns and ads bring customers. Apart from that record, each page opened through such a link adds one to that day's count of its campaign tags, and nothing else is kept with it (Clause 13.4). We do this ourselves, and nothing is stored in your browser for it: the record kept with your account is received by no third party, save that the click identifier of one of our ads on ChatGPT is reported to OpenAI as set out in Clause 13.6. If you have agreed to the pixels of our ads, they too read the campaign tags and the click identifier from the address of the page, in your browser (Clause 13.12). The Cloudflare Web Analytics service on the public pages receives no campaign tags and no click identifier: it receives the address of the page and of the website that sent you without their query (Clause 13.5).

7.3 Other parties. We may disclose your data: (a) to the competent governmental, judicial and regulatory authorities upon their request in accordance with the law; (b) to our legal advisers, accountants and auditors who are bound by confidentiality; (c) to our successor in the business in the event of a merger, an acquisition or a transfer of assets, with notification to you and with your data remaining subject to this Policy or to a policy no less protective than it; (d) to any other party with your consent.

7.4 Payment service providers. Payment method data are processed by the payment service provider in accordance with its own policy, and we do not retain full card numbers. What is collected inside the Kingdom is processed by a payment service provider licensed by the Saudi Central Bank; subscriptions collected by card outside the Kingdom are processed by an international payment service provider identified in the Sub-processor List, and that entails the transfer of payment data outside the Kingdom in accordance with Section (8).

7.5 OpenAI, for our ads on ChatGPT. If you create an account after arriving from one of our ads on ChatGPT, our servers send OpenAI one report of the sign-up (Clause 13.6). It is received by OpenAI OpCo, LLC (United States of America), the company with which we contract for advertising on ChatGPT. It uses the report to measure for us the sign-ups that our ads bring, and receives it as an independent controller under its own terms and privacy policy, so it is not a Sub-processor of ours; we mark every report so that OpenAI does not use it to personalise ads. OpenAI processes data in the United States of America and the other countries where it operates. This report is sent from our servers and needs no script in your browser, and in it OpenAI receives from us no e-mail address, telephone number, name or Internet Protocol address — not even in hashed form. No script of OpenAI's is loaded on the website. The other platforms of our ads — TikTok, Meta, Snapchat, X and Google Ads — receive no report from our servers: they learn of a sign-up only through their pixels, and only if you agree to them (Clause 7.6).

7.6 The pixels of our ads — with your consent. If you choose "Agree" in the question about cookies (Clause 13.11), we use the pixels of five advertising platforms on the public pages of the website (Clause 13.12). In the ARK47 phone app, with your consent in its own question (Clause 13.13), we use Meta's tool and Google Analytics for Firebase, and our servers send reports to TikTok and Snapchat, on the same footing. What each pixel collects is received by the company of its platform with which we contract for advertising: for TikTok, TikTok Pte. Ltd. (Singapore); for Meta, on Facebook and Instagram, Meta Platforms, Inc. (United States of America); for Snapchat, Snap Inc. (United States of America); for X, X Corp. (United States of America); and for Google Ads, Google LLC (United States of America). Each of them uses it to measure for us the visits, sign-ups and presses on the button that opens our WhatsApp line that our ads bring, and also — in its capacity as an independent controller and under its own terms and privacy policy — for its own purposes, among them showing and personalising ads, improving the delivery of ads and its services, and safety and security; none of them is therefore a Sub-processor of ours. TikTok keeps data in Singapore, Malaysia, Ireland, the United States of America and the other countries where it operates; Meta, Snap, X and Google process data in the United States of America and the other countries where they operate, and Meta keeps what it receives through its pixel for up to two years. We have turned off the advanced or automatic matching of every pixel, and Google's enhanced conversions, so none of them receives through its pixel your e-mail address, telephone number or name — not even in hashed form — anything you type, or anything of your Applications. If you choose "Reject", no script of any of them is loaded and nothing is sent to them.

8. Transfer of data outside the Kingdom

8.1 Disclosure. Providing the Services may require some of your personal data to be processed by Sub-processors whose premises or servers are outside the Kingdom of Saudi Arabia, as set out in Section (7.2) and in the Sub-processor List, which states the country of processing for each of them. This includes the visit data of the public pages of the website that the Cloudflare Web Analytics service receives and processes in the United States of America and in the other countries where Cloudflare operates (Clause 13.5), and what you choose to write in the feedback form, which the Contentsquare service receives and processes in the European Union (Ireland) and in the other countries where it operates (Clause 13.9). It also includes the report of a sign-up from one of our ads on ChatGPT that our servers send to OpenAI, which processes it in the United States of America and the other countries where it operates (Clause 7.5). It further includes — where you have agreed to the pixels of our ads — what those pixels send from your browser to TikTok, which keeps it in Singapore, Malaysia, Ireland, the United States of America and the other countries where it operates, and to Meta, Snap, X and Google, which process it in the United States of America and the other countries where they operate (Clause 7.6). The hosting of the website and the Platform, the production database — which holds your account data — and its backups, and the Applications our Customers are building before they publish them, are processed in France (Clause 7.2); uploaded files are stored in Western Europe; the hosting of the Applications our Customers publish, and their databases, are in the Kingdom. The controls set out in Clause 8.2 apply to all of these.

8.2 Controls. We do not transfer personal data outside the Kingdom except: (a) to the minimum extent necessary to achieve the purpose; (b) in a manner that does not prejudice the national security or the vital interests of the Kingdom; (c) under the mechanisms permitted by the Regulation on Personal Data Transfer outside the Kingdom, among them the standard contractual clauses and appropriate contractual safeguards, and after carrying out a risk assessment where the Regulation requires one and documenting it; (d) or to a country included by the competent authority in the list of countries with an adequate level of protection, once that list is issued. You may request information about the safeguards applied through the Data Protection Officer.

8.3 Subjection to foreign laws. We disclose that some of our Sub-processors are subject to the laws of other countries, which may affect the level of protection, and that we have contracted with them for appropriate contractual safeguards to address this.

9. Retention periods and the method of destruction

9.1 The principle. We retain personal data for the period necessary to achieve the purpose for which it was collected, and then destroy it without undue delay, unless the law requires it to be retained for a longer period.

9.2 Table of periods.

9.3 The method of destruction. We destroy data by methods that prevent its retrieval, among them: secure deletion from the operational databases, the expiry of backups according to their defined cycle, the destruction of encryption keys where they are used, and the physical destruction of media when taken out of service. Where destruction is not technically possible immediately (such as archived backups), we isolate the data from use until it is destroyed at its due time.

9.4 Anonymisation. We may retain anonymised data that cannot by any reasonable means be linked to you, for statistical and development purposes, without a time limit.

9.5 Deleting your account yourself. You may delete your account at any time, in the ARK47 app (Account → Delete account) or on the web (Settings → Delete account), or by writing to us through the channels in Section 2. When you delete it yourself you give up the Retrieval Window: your account and registration data are deleted from our operational databases at once, every session and device is signed out, and your applications and their data are deleted. We keep only what 9.2 says the law requires (invoices and accounting and tax records, and the electronic acceptance records for the Terms), with no more of your data than the law requires, and the copies in backups expire within 90 days, as 9.3 describes. The pseudonymous measurement data sent with your consent to the Google Analytics service before Version 1.13 of this Policy remain there until Google deletes them at the end of the period set out in 9.2.

10. Your rights and how to exercise them

10.1 Your rights under the Personal Data Protection Law.

10.2 Exercise. Submit your request through the channels set out in Section (2), stating your identity and the nature of your request. We may ask you for what is necessary to verify your identity, in order to protect your data.

10.3 The period. We answer your request within thirty (30) days of receiving it, and the period may — in complex cases or where requests are numerous — be extended by a like period, with notification to you of that and of its reasons, unless the Regulations prescribe a shorter period, in which case we comply with it.

10.4 No fees and no adverse effect. Exercising your rights is free of charge, unless the request is manifestly repetitive or excessive, in which case a reasonable fee may be requested or the request refused with a statement of the reason. Exercising your rights has no adverse effect on your dealings with us.

10.5 Limits. We may decline to meet the request in whole or in part where the law so requires, such as protecting the rights of others or complying with a legal obligation to retain, or where the request relates to data we process in the capacity of Processor for a Customer (Section 16), in which case we refer the request to the Customer concerned.

10.6 Complaints. If you are not satisfied with our handling of your request, you may escalate to the Data Protection Officer, and you may lodge a complaint with the Saudi Data and Artificial Intelligence Authority (SDAIA) as the competent authority, through its official channels.

11. Data security

We apply appropriate organisational, administrative and technical measures to protect personal data, guided by recognised practices, among them the Essential Cybersecurity Controls issued by the National Cybersecurity Authority to the extent applicable, and comprising: encryption in transit and at rest, multi-factor authentication for access, permission control on a need-to-know basis, logical separation between Customers' workspaces, logging and monitoring, backup, vulnerability and update management, and our employees' obligation of confidentiality. Responsibility for protecting your sign-in credentials and for enabling multi-factor authentication rests with you.

12. Data breach incidents

In the event of an incident of leakage, destruction or unlawful access affecting your personal data that we process in the capacity of Controller, we notify the competent authority within seventy-two (72) hours of becoming aware of it, in accordance with what the Regulations prescribe, and we notify you without undue delay if the incident would harm your data, your rights or your interests, stating the nature of the incident, its likely effects, the measures taken and what is advised to be done.

13. Cookies and similar technologies

13.1 Necessary cookies — and the pixels of our ads only with your consent. Without asking you, the website and the Platform use only the cookies that are necessary for operating them, among them the cookie that keeps your answer to the question about cookies (Clause 13.2). The only advertising cookies are those of the pixels of our ads, which load on the public pages of the website only — never inside the Platform after sign-in — and only after you choose "Agree" in the question about cookies (Clauses 13.11 and 13.12); before that, no script of any of them is loaded. We place no analytics or recording cookie in your browser and load no script of any recording service; apart from those pixels, the only measurement script is that of the Cloudflare Web Analytics service on the public pages of the website, which sets no cookie and stores nothing in your browser (Clause 13.5). None of the necessary cookies is sent to any third party.

13.2 Table of cookies.

13.3 Working entries in your browser's storage. The website and the Platform keep in your browser's storage a few working entries that what you are doing needs — for example the width you chose for the side menu, or the request you typed in the build box while you sign in. They contain no identifier of you, are read by the website alone, and are sent to no one.

13.4 Counting the steps taken on the website and in the Platform, and the visits by our campaigns' links. When you take certain steps — for example opening sign-in, signing up, creating an Application, sending a message in the Studio, a build finishing or failing, opening the preview, publishing, choosing a Plan or starting checkout — your browser tells our own servers the name of the step, accompanied only by values from fixed lists (for example, which way of signing in you chose), never by free text or by a number such as an amount. The report carries no cookie and no identifier of you or of your account. Our servers only add one to that step's count for the day, and keep nothing else; your Internet Protocol address is used only in memory, for one minute, to stop a single sender from flooding the count, and it is not stored. Likewise, when you open a page of the website through a link that carries campaign tags, our servers read those tags — the source, medium, campaign and content the link names, and nothing else of the request — and add one to that day's count for them; your browser sends nothing for it, and no cookie, Internet Protocol address or description of your browser is kept with it. These counts identify no one and reach no third party. Their basis is our legitimate interest in knowing where the website and the Platform get in our users' way, and which of our campaigns bring visitors (Clause 5.2).

13.5 Counting visits to the public pages (Cloudflare Web Analytics). On the public pages of the website only — the home page, sign-in, sign-up, password reset, the Terms and Conditions, this Policy, the page of the customer relationship management system and the account deletion page — your browser sends a short report of each page load to the Cloudflare Web Analytics service (Clause 7.2), through our own domain. The report carries only: the address of the page, without its query; the address of the website or page that sent you, without its query; the type of device, the browser and its engine, and the operating system; the type of navigation, the time the page took to load and the memory it used; and a random number for that page load alone. Cloudflare derives the approximate country from the Internet Protocol address, and the data it keeps contain no Internet Protocol address. The service sets no cookie, stores nothing in your browser, receives no identifier of you or of your account, and its data contain nothing that links one visit to another. It does not run inside the Platform after sign-in. Its basis is our legitimate interest in knowing which public pages are visited and whether they load well (Clause 5.2); if you object to it, you may block scripts from static.cloudflareinsights.com in your browser, or write to us at [email protected].

13.6 Our report of a sign-up from one of our ads on ChatGPT — and how to object to it. A link from one of our ads carries, in the address of the page it opens, the click identifier that the ad's platform gave that click ("ttclid" at TikTok, "fbclid" at Meta or "oppref" at OpenAI). Our own website keeps nothing of it in your browser. If you create an account from that page, the identifier is read from the address at the moment you sign up, as the campaign tags are (Clause 7.2), and kept with your account. Only for an ad on ChatGPT do our servers then send one report, to OpenAI: that an account was created, with that click identifier, a number from which the account cannot be identified, the time the account was created, and the address of our website. Our servers send no report of a sign-up on the website to TikTok, Meta or any other platform: they learn of it only through their pixels, if you agree to them (Clause 13.12); the phone app is set out in Clause 13.13. Nothing else is sent to OpenAI: not your e-mail address, your name, your telephone number, your Internet Protocol address, anything you type, or anything of your account or your Applications. A visit that does not end in a new account, and signing in to an existing account, are never reported. OpenAI uses the report as set out in Clause 7.5. Its basis is our legitimate interest in knowing which of our ads bring customers, with a documented balancing assessment (Clause 5.3). You may object to it at any time: before signing up, open the website without the identifier — by typing its address yourself, or by removing from the address the part that begins with "ttclid=", "fbclid=" or "oppref=" — and nothing is kept or reported; after signing up, write to us at [email protected] and we delete the identifier kept with your account. A report already sent is held by OpenAI under its own privacy policy, through which you may exercise your rights with it:

https://openai.com/policies/row-privacy-policy/

13.7 What is never sent. The following is never sent to Cloudflare Web Analytics, to Contentsquare, to TikTok, to Meta, to Google, to Snapchat or to OpenAI, nor through any pixel of our ads (Clause 13.12) or any tool of the phone app (Clause 13.13), in any case: the prompts or any text you write in the website or the Platform — save what you choose to send through the feedback form (Clause 13.9) — the names of Applications, the data recorded in your Applications, the content of the preview, e-mail addresses, names, telephone numbers, or payment card data. None of these services receives anything of what our Customers enter into their Applications or collect through them (Section 16).

13.8 Cookies set by earlier versions. Until Version 1.13 of this Policy, the website set — with your consent — the cookies and storage entries of Google Analytics, of Contentsquare and of the pixels of TikTok and Meta, and our own ark47_consent and ark47_oppref cookies. If your browser still holds a cookie of Google Analytics or of Contentsquare, or the ark47_oppref cookie, the website deletes it on your next visit without reading it, and nothing more is sent to Google Analytics or to Contentsquare. An answer you gave under an earlier version is not honoured: the question is asked again (Clause 13.11), and your new answer replaces it in the ark47_consent cookie. The cookies and storage entries of the pixels of TikTok and Meta that remain from an earlier version are no longer deleted on your next visit: they remain until they expire, they are deleted if you choose "Reject" (Clause 13.11), and those pixels use them again if you choose "Agree". What was sent to those services before remains with them as set out in Clause 9.2.

13.9 The feedback form. A "Feedback" link appears in the website footer, and in the Platform in the side menu and above the preview in the Studio. It opens the feedback form in a new tab, on a page run by Contentsquare (Clause 7.2), where you may rate your experience or tell us in your own words what got in your way. The link passes nothing about you or about the page you came from: no account identifier, no page address and no address of your Applications. What you write there, and your rating, are sent to the Contentsquare service from that page; nothing is sent unless you send it. Contentsquare's privacy notice also applies to that page, so do not include in what you write personal data, or the data of your Applications or of your clients. Contentsquare explains how it processes data in its privacy centre:

https://contentsquare.com/privacy-center/

13.10 Browser settings. You may also manage cookies at any time through your browser settings, noting that disabling the necessary cookies may affect the operation of the website and the Platform.

13.11 The question about cookies — agreeing, rejecting and changing your answer. On the public pages of the website — the home page, the overview, the "About" page, the page of the customer relationship management system, pricing, the store, the start page, support, the ready systems and the guides, sign-in, sign-up, and the WhatsApp page (/whatsapp), where our ads lead — a question about the cookies of our ads appears in the middle of the screen, with the page dimmed behind it, until you answer it. It offers two answers of equal size, "Agree" and "Reject", and the page cannot be used until you choose one; whichever you choose, the website and the Platform work for you in the same way. It is not shown over the Terms and Conditions or over this Policy, so that you can read them first. Your answer is kept in our own ark47_consent cookie for one year (Clause 13.2), after which you are asked again; you are also asked again whenever we change the version of the question, as when the pixels or the terms of this Policy that concern them change. You may change your answer at any time through the "Cookie settings" link in the website footer. If you choose "Reject" — when first asked, or later through "Cookie settings" — no script of any pixel is loaded, the cookies the pixels set (Clause 13.2) and the entries they keep in your browser's storage are deleted, and if the pixels were running on the page you are on, it is reloaded without them. Withdrawing your consent does not affect the lawfulness of the processing that preceded it; what was sent before remains with each platform under its own privacy policy (Clauses 7.6 and 9.2), and your rights set out in Section (10) remain.

13.12 The pixels of our ads — only after you agree. Before you choose "Agree", no script of any pixel is loaded. After you choose "Agree", the pixels of TikTok, Meta, Snapchat, X and Google Ads (Clause 7.6) load on the public pages of the website listed in Clause 13.11, and also on the pages of the Terms and Conditions and of this Policy, over which the question is not shown. They load only while the address of the page carries nothing beyond the campaign tags and the click identifier of an ad, and a link to a section of the same page; not when you reach one of these pages directly from a page of the website on which they may not run, such as a page inside the Platform; and never inside the Platform after sign-in, or on any other page of the website, the password reset page among them. The moment you leave these pages for any other page of the website, the pixels are switched off: that page is loaded afresh, without them. We tell the pixels of three events only: that a page was viewed; that you finished signing up, when an account is created; and, on the WhatsApp page, a press on the button that opens our WhatsApp line. Because each pixel's script runs in your browser, each platform receives directly from your browser: the address of the page, with the campaign tags and the click identifier of an ad where the link carried them, and the title of the page; the address of the page or website that sent you; the description your browser gives of itself (its user-agent string) and your Internet Protocol address, as any website you visit receives them; the identifiers kept in its own cookies, which it sets on our website's domain (Clause 13.2); and the technical details its script reads of the visit, such as the size of the screen, the time zone, how long the page took to load and how long you stayed on it. A platform's script may also pass its own identifier of your browser to that platform's advertising partners, under the platform's own privacy policy. If your browser keeps cookies of a platform's own — for example because you use Facebook, Instagram, Snapchat or X in it — they reach that platform with its pixel's requests, as its privacy policy explains. The pixels of TikTok, Meta and Snapchat also keep a few entries in your browser's storage — such as the address of the website that last sent you and the click identifier of an ad — which are deleted if you choose "Reject" (Clause 13.11). Nothing else is given to any of them through its pixel: not your e-mail address, your name, your telephone number, anything you type, or anything of your Applications; the advanced or automatic matching of every pixel and Google's enhanced conversions are turned off (Clause 7.6). Their basis is your consent (Clause 5.2). Each platform receives this data as an independent controller under its own privacy policy, which explains how it uses it and through which you may exercise your rights with it:

https://www.tiktok.com/legal/page/row/privacy-policy/en

https://www.facebook.com/privacy/policy/

https://values.snap.com/privacy/privacy-policy

https://x.com/en/privacy

https://policies.google.com/privacy

13.13 Measuring our ads in the ARK47 phone app — only after you agree. The ARK47 phone app (iPhone and Android) contains two tools for measuring ads: Meta's, and Google Analytics for Firebase, which Google Ads reads. Neither starts or sends anything before you agree. After you build your first system in the app, a question, "Ad measurement", appears in the middle of the screen with two answers of equal size, "Agree" and "Reject"; whichever you choose, the app works for you in the same way. You may change your answer at any time under Account → "Ad measurement". On an iPhone, if you choose "Agree", the system then asks you Apple's question about tracking; Meta's tool does not run, no advertising signal is sent to Google, and nothing is sent to TikTok or Snapchat, unless you choose "Allow"; Google's count of your use of the app runs on your consent to our question alone. After you agree:

• Meta (Meta Platforms, Inc.) receives from the app: its installation and opening, an account you create on the phone, and your purchases in the store at the store's price as its tool records them by itself, with your device's advertising identifier.

• Google (Google LLC) receives from the app: its opening, the screens you view and how long you use it, an account you create on the phone, and your purchases in the store as its tool records them by itself, with your device's advertising identifier where tracking is allowed; we do not allow it to use these to personalise ads.

• TikTok and Snapchat have nothing running inside the app: our servers send each of them a report of three events only — the first opening of the app after you agree, an account created on the phone, and a purchase in the store with its price — carrying: the name and time of the event, the app's identifier in its store, the type of device (iPhone or Android), the app's version and the operating system's version, your device's advertising identifier, on an iPhone your answer to Apple's question, and your Internet Protocol address and the app's description of itself (its user-agent string). An event that carries no advertising identifier is not sent.

Nothing else is sent to any of them: not your e-mail address, your name, your telephone number, your account's identifier, anything you type, or anything of your Applications (Clause 13.7). If you later choose "Reject", both tools stop sending and nothing more is sent to TikTok or Snapchat; what was sent before remains with each platform under its own privacy policy (Clause 9.2). On an iPhone you may also stop tracking under Settings → Privacy & Security → Tracking, and on Android delete or reset the advertising identifier in the device's settings. Its basis is your consent (Clause 5.2). Each platform receives this data as an independent controller under its own privacy policy (Clause 7.6), at the addresses listed in Clause 13.12.

14. Minors

Our services are directed at establishments and are not aimed at minors, and we do not knowingly collect the data of minors. If we learn that the data of a minor has been collected without the necessary legal basis, we destroy it.

15. Direct marketing

15.1 We do not send you marketing messages or make promotional calls to you except with your express and separate consent, and your acceptance of this Policy or of the Terms and Conditions does not constitute consent to receive marketing, in compliance with the controls on unsolicited messages and calls issued by the Communications, Space and Technology Commission.

15.2 Every marketing message includes identification of the sender and an easy means of unsubscribing, and we stop sending within twenty-four (24) hours of your request and confirm that to you. We do not send promotional messages at the times prohibited by the controls.

15.3 We may send you — without marketing consent — the operational and statutory notifications necessary to perform the agreement or to comply with a legal obligation.

16. Data we process in the capacity of Processor on behalf of our Customers

16.1 The role. This Policy does not create any obligation on us towards you in the capacity of Controller in respect of what we process on behalf of our Customers; this Section is a transparency statement about what we do in the capacity of Processor, and the corresponding obligations fall on the Customer as Controller. When our Customer uses the Platform to configure and operate its Applications, the personal data that it enters or collects (the data of its employees, its End Users, its contacts, its correspondence and its calls) is data of which the Customer is the Controller, and which we process on its behalf and in accordance with its documented instructions, under the Personal Data Processing Addendum contained in the Terms and Conditions, which sets out the purpose, the categories, the duration, our security obligations, incident notification, Sub-processors, transfer outside the Kingdom, and deletion at the end of the subscription.

16.2 What we do not do. We do not use that data for our own purposes, we do not take decisions in respect of it, we do not disclose it to others except in accordance with the Customer's instructions or by order of a competent authority, and we do not use it to train artificial intelligence models. Our authorised staff may look into a Customer's application, or make an internal working copy of it, to fix faults and improve the quality of our services, as set out in Clause 8.8 of the Terms: under confidentiality, with every copy recorded, deleted within thirty days, and never used to contact anyone or to train a model.

16.3 If you are a data subject held by one of our Customers. Direct your request to that Customer, as it is the party that determines the purposes and means of the processing and that determines the privacy notice applicable to you. If your request reaches us directly, we refer it to the Customer within five (5) Business Days and inform you of that, and we do not answer it ourselves except to the extent that the law requires.

16.4 AI Agents. If you deal with an AI Agent operated by one of our Customers on the Platform, that agent acts in the Customer's name and on its behalf, and the Customer is responsible for disclosing its automated nature to you and for what issues from it.

17. Amendment of this Policy

We may amend this Policy to keep pace with legal or operational changes. We publish the amended version together with its version number, its effective date and a summary log of the changes, and we notify account holders of material amendments at their registered e-mail address and through the Platform at least thirty (30) days before they take effect. If an amendment requires your consent (such as the addition of a new purpose of processing), we request it from you separately before the processing begins.

Change log.

• Version 1.16 (22/5/1448H corresponding to 2/11/2026): the ARK47 phone app measures our ads only after you agree in its own question — Meta's tool and Google Analytics for Firebase in the app, and our servers' reports to TikTok and Snapchat — in the new Clause 13.13, with the related changes in Clauses 4.2, 7.6, 9.2, 13.6 and 13.7.

• Version 1.15 (19/5/1448H corresponding to 30/10/2026): the table in Clause 7.2 and Clause 8.1 state that the hosting of the website and the Platform, the production database and backups, and the Applications our Customers are building before they publish them — their working copies, previews and databases — are processed in France, that uploaded files are stored in Western Europe, and that the hosting of the Applications our Customers publish, and their databases, are in the Kingdom of Saudi Arabia.

• Version 1.14 (11/5/1448H corresponding to 22/10/2026): on the public pages of the website, a question about cookies appears in the middle of the screen with the page dimmed behind it, with two answers, "Agree" and "Reject", and the answer can be changed at any time through "Cookie settings" (the new Clause 13.11); the pixels of TikTok, Meta, Snapchat, X and Google Ads run on the public pages only, and only with your consent (the new Clauses 7.6 and 13.12); our servers report a sign-up to OpenAI alone, for our ads on ChatGPT — TikTok and Meta learn of it only through their pixels (Clauses 7.5 and 13.6); Clause 13.1 and the table in Clause 13.2 are rewritten, and Clause 13.8 is corrected: only the cookies of Google Analytics and Contentsquare and the ark47_oppref cookie are still deleted; with the related changes in Clauses 4.2, 5.2, 5.5, 7.2, 8.1, 9.2 and 13.7.

• Version 1.13 (7/5/1448H corresponding to 18/10/2026): the website and the Platform no longer use Google Analytics, Contentsquare's recordings or the pixels of TikTok and Meta, set no analytics or advertising cookie, and show no consent panel; the steps taken in them, and the visits by our campaigns' links, are counted by our own servers as daily totals that identify no one (the new Clause 13.4); a sign-up from one of our ads is reported to the ad's platform from our servers, on the basis of legitimate interest and with the right to object (Clauses 7.5 and 13.6); the cookies of earlier versions are deleted (Clause 13.8); Section (13) is rewritten, with the related changes in Clauses 4.2, 5.2, 5.5, 7.2, 8.1, 9.2 and 9.5, and Clauses 7.6 and 7.7 are merged into Clause 7.5.

• Version 1.12 (5/5/1448H corresponding to 16/10/2026): the files uploaded to the Platform and to the Applications are stored in the Kingdom of Saudi Arabia, in the Riyadh region — the table in Clause 7.2.

• Version 1.11 (4/5/1448H corresponding to 15/10/2026): on the public pages of the website, Contentsquare's recordings show the words we wrote ourselves; everything you type, numbers, images, anything showing your account, and every page inside the Platform stay hidden (Clauses 4.2, 5.2, 7.2, 13.2 and 13.11); because the analytics terms changed, the consent panel asks for your choice again (Clause 13.4).

• Version 1.10 (3/5/1448H corresponding to 14/10/2026): Meta's pixel on the same four public pages as TikTok's, with your consent to advertising — in the new Clauses 7.7 and 13.17 and the rows for its cookies in Clause 13.3 — with the related changes in Clauses 4.2, 5.2, 7.2, 8.1, 9.2, 13.1, 13.2, 13.4, 13.6, 13.7 and 13.15; because the advertising terms changed, the consent panel asks for your choice again (Clause 13.4).

• Version 1.9 (2/5/1448H corresponding to 13/10/2026): sign-in with an Apple account, for whoever chooses it, added to the table in Clause 7.2; the consent panel first offers "Accept" and "Reject", and "Analytics only" when it is reopened through "Cookie settings" (Clause 13.4).

• Version 1.8 (2/5/1448H corresponding to 13/10/2026): our report to OpenAI of an account created after a visit from one of our ads on ChatGPT, with your consent to advertising, sent from our servers and with no script of OpenAI's on the website — in the new Clauses 7.6 and 13.16 and the row for the ark47_oppref cookie in Clause 13.3; TikTok's pixel no longer runs when one of its four pages is reached directly from another page of the website (Clause 13.15); and the related changes in Clauses 4.2, 5.2, 7.2, 8.1, 9.2, 13.1, 13.2, 13.4, 13.6 and 13.7.

• Version 1.7 (1/5/1448H corresponding to 12/10/2026): TikTok's pixel on four public pages of the website, with your separate consent to advertising — the consent panel now offers "Accept all", "Analytics only" and "Decline" — in the new Clauses 7.5 and 13.15 and the rows for its cookies in Clause 13.3; and the related changes in Clauses 4.2, 5.2, 5.5, 7.2, 8.1, 9.2, 13.1, 13.2, 13.4, 13.6 and 13.7.

• Version 1.6 (1/5/1448H corresponding to 12/10/2026): Clause 16.2 states that our authorised staff may look into a Customer's application, or make an internal working copy of it, to fix faults and improve the quality of our services, in accordance with Clause 8.8 of the Terms.

• Version 1.5 (1/5/1448H corresponding to 12/10/2026): the disclosure of the Cloudflare Web Analytics service, which counts visits to the public pages of the website without cookies and without storing anything in the browser, in the new Clause 13.14 and its naming in Clause 7.2; the related changes in Clauses 4.2, 5.2, 8.1, 9.2, 13.2, 13.6 and 13.7; and the correction of Clause 13.12: the feedback form opens on Contentsquare's own page and receives no address of ours.

• Version 1.4 (29/4/1448H corresponding to 10/10/2026): the addition, through the Contentsquare service and with your consent only — under one answer with Google Analytics — of recordings of the use of the website and the Platform in which every text, number and image is hidden, of heatmaps and of a feedback form; its naming in Clause 7.2; the new Clauses 13.11 to 13.13 and the rows for its cookies in Clause 13.3; the statement in Clause 13.7 that nothing is sent from our servers; and the related changes in Clauses 4.2, 5.2, 8.1, 9.2, 13.1, 13.2, 13.4, 13.6 and 13.8.

• Version 1.3 (29/4/1448H corresponding to 10/10/2026): the addition of measuring the use of the website and the Platform through the Google Analytics service with your consent only, its naming as an exception in Clause 7.2, the rewriting of Section (13) with a table of cookies, the related changes in Clauses 4.2, 5.2, 5.5, 8.1, 9.2 and 9.5, and the addition of this log.

• Version 1.2 (29/4/1448H corresponding to 10/10/2026): the addition of Clause 6.4 on what is sent from the Studio to the artificial intelligence model providers and the request for your permission in the mobile app before your first message, and of Clause 9.5 on deleting your account yourself and thereby giving up the Retrieval Window.

• Version 1.1 (25/4/1448H corresponding to 6/10/2026): a statement of the recording of campaign tags, the landing page and the referring website at sign-up (Clause 7.2), and a statement that the databases of the Applications our Customers publish are processed in the Kingdom of Saudi Arabia.

• Version 1.0 (7/4/1448H corresponding to 18/9/2026): the first version.

18. Contact and complaints

The complaints route: (1) submit your complaint to the Data Protection Officer, and we respond to you within fifteen (15) Business Days; (2) if it is not resolved, you may escalate to the Company's senior management at [email protected]; (3) and you have, in all cases, the right to lodge a complaint with the competent authority.

Severability: If any provision of this Policy is adjudged void, the remaining provisions remain in force.

APEX Operations Company — Unified Number 7051961980 — Tax Number 314285795400003 — Riyadh, King Salman District, Ibn Zaydan 12443