Privacy Policy — the ARK47 Platform

1. Scope of this Policy — read this section first

1.1 Purpose. This Policy sets out how APEX Operations Company (the "Company" or "we") collects, processes, retains and destroys personal data in its capacity as Controller, your rights in respect of it and how to exercise them, in implementation of what the Personal Data Protection Law issued by Royal Decree No. (M/19) dated 9/2/1443H and its Implementing Regulations require by way of publishing a privacy policy and making it available to data subjects before their data is collected. This Policy is made available before your data is collected, is displayed to you at registration before it is completed, and your review of it is documented in accordance with Clause 5.2 of the Terms and Conditions.

1.2 Who this Policy addresses. This Policy addresses:

• (a) visitors to the ark47.ai website and those who contact us through it;

• (b) representatives of Customers and their Authorised Users who create accounts on the Platform or use it;

• (c) those who contact our sales or support teams, subscribe to our mailing lists, or take part in our events;

• (d) applicants for employment with us, as regards application data.

1.3 Who this Policy does not address — an important notice. Our Customers are establishments that use the Platform to configure and operate their Applications. The personal data that our Customers enter into their Applications or collect through them — such as the data of their employees, their End Users, their contacts, their correspondence and their calls — is data of which the Customer is the Controller, and which we process on its behalf and in accordance with its instructions in our capacity as Processor. If you are a customer or an employee of one of our Customers, the privacy notice that governs your data is that Customer's notice, and you should approach it to exercise your rights; we refer to it without delay any request that reaches us from you. Section (16) of this Policy sets out how we process that data in our capacity as Processor.

1.4 Supplementary documents. This Policy is read together with: the General Terms and Conditions of Use of the ARK47 Platform and the Personal Data Processing Addendum contained in them, the Sub-processor List, which we provide to Customers on request, and the terms and conditions and the privacy policy of the customer relationship management system where applicable.

2. Who we are and how to contact us

2.1 The Controller. APEX Operations Company, a Saudi limited liability company registered under Unified Number 7051961980, whose head office is at Riyadh, King Salman District, Ibn Zaydan Street, Postal Code 12443.

2.2 Contact for data protection. The Company has designated a point of contact for personal data protection matters, who may be contacted at [email protected], or at the postal address above marked for the attention of the "Data Protection Officer".

2.3 Channels for exercising rights. You may exercise the rights set out in Section (10) by writing to [email protected].

3. The legal framework

We process personal data in accordance with the Personal Data Protection Law and its Implementing Regulations, the Regulation on Personal Data Transfer outside the Kingdom issued by the Saudi Data and Artificial Intelligence Authority, the E-Commerce Law issued by Royal Decree No. (M/126) dated 7/11/1440H and its Regulation as regards the data of those dealing electronically, the Anti-Cyber Crime Law, and all other laws in force in the Kingdom of Saudi Arabia. We are guided by the artificial intelligence ethics principles and the controls issued by the Saudi Data and Artificial Intelligence Authority as regards the use of artificial intelligence technologies.

4. The data we collect and how we collect it

4.1 Data you provide to us directly.

4.2 Data collected automatically when the website or the Platform is used. Internet Protocol address; device, browser and operating system type; the pages and features used and the times of use; event and error logs; the electronic acceptance data for the Terms (the date, the time, the Internet Protocol address, the version number and its digital fingerprint); cookies and similar technologies (Section 13); and the metering and consumption data necessary for billing. If you consent to analytics cookies through the consent panel, data about your use of the website and the Platform is also collected through the Google Analytics service, and that use is recorded through the Contentsquare service in recordings in which every text, number and image is hidden, as set out in Section (13); none of it is collected before your consent. On the public pages of the website only — never inside the Platform after sign-in — the Cloudflare Web Analytics service also counts visits, without any cookie and without storing anything in your browser, as set out in Clause 13.14. If you also consent to advertising, TikTok's pixel receives data about your visits to some of the public pages of the website, as set out in Clause 13.15, and — if you arrived from one of our ads on ChatGPT and then create an account — our servers tell OpenAI that the account was created, as set out in Clause 13.16; nothing is sent to either before that consent.

4.3 Data we receive from third parties. Commercial registration and commercial identity verification data from the available government bodies and platforms, payment confirmations from payment service providers, and data from our partners where you have authorised them to share it with us.

4.4 Data we do not collect and do not request. We do not request, for our own purposes, any sensitive data (such as health, biometric, belief-related, ethnic-origin or criminal-record data), and we do not knowingly collect the data of minors. If data of this kind reaches us without being requested, we destroy it unless the law requires otherwise.

5. Why we process your data and on what legal basis

5.1 The rule. We do not process your personal data except for a specific and legitimate purpose, on one of the legal bases prescribed by the Personal Data Protection Law, and to the minimum extent necessary to achieve the purpose.

5.2 Table of purposes and bases.

5.3 Legitimate interest. Where we rely on legitimate interest, we document an assessment balancing our interest against your rights and interests; we do not rely on it in any case for the processing of any sensitive data, nor where the effects of the processing on your rights outweigh it.

5.4 Consequences of not providing the data. If you do not provide the data marked as mandatory in Section (4), we will not be able to create your account, activate your subscription, issue your invoices or provide you with support. As for optional data, the only consequence of not providing it is that the feature associated with it will not be available.

5.5 Consent and its withdrawal. Where we rely on your consent, it is requested from you separately from acceptance of the Terms and for a specific purpose, and you may withdraw it at any time by writing to [email protected] — and you may also withdraw your consent to analytics, or to advertising, directly through the "Cookie settings" link in the website footer or in your account settings (Section 13) — without this affecting the lawfulness of the processing that preceded the withdrawal.

6. Artificial intelligence and automated decisions

6.1 The Platform relies on generative artificial intelligence technologies. As regards your data in your capacity as a representative of the Customer or an Authorised User, we do not take any automated decision producing a material legal or contractual effect on you without human intervention, save for automated security measures (such as stopping suspicious sign-in attempts), which you may object to and have reviewed by a natural person by contacting us.

6.2 We do not use the personal data of your account to train general artificial intelligence models. The use of Inputs and of structural metadata to improve the Platform is governed by what is set out in Clause 9.9 of the Terms and Conditions, and takes place after anonymisation such that the data cannot — by any reasonable means — be linked to any natural person.

6.3 Where you interact with automated systems of ours (such as the automated support assistant), we disclose that to you at the start of the interaction and make a natural person reachable to you.

6.4 To build and change your Applications, what you write in the Studio — your messages, and the parts of your Applications they need — is sent to the artificial intelligence model providers in the table in 7.2, which process it to generate replies and code. In the mobile app we ask for your permission before your first message (5.5); you may withdraw it by writing to [email protected], after which the Studio cannot answer you.

7. With whom we share your data

7.1 The rule. We do not sell or rent your personal data, and we do not disclose it except to the categories set out below and to the extent necessary for the purpose.

7.2 Sub-processors. We engage service providers who process data on our behalf under written agreements binding them to confidentiality and to a level of protection no lower than our own obligations. We do not publish their names, save for the analytics tools named below; the list — with each provider's name, the purpose of the engagement, its location and its country of processing — is provided to our Customers in writing on request. The categories are:

The analytics tools. We use the Google Analytics service provided by Google Ireland Limited and Google LLC to measure the use of the website and the Platform, and we do so only with your consent (Section 13). We name this service and the Contentsquare service below as an exception to the rule of not publishing the names of Sub-processors, because the terms of use of each require its disclosure in this Policy, and we name the Cloudflare Web Analytics service below because it runs without the consent panel; the exception extends to no other provider. Google processes this data in its capacity as Processor on our behalf, under the Google Analytics Terms of Service and the Google Ads Data Processing Terms, and it is processed in the United States of America and in the other countries where Google operates. We have turned off all data-sharing settings with Google and the Google signals feature, and we use no advertising features, no ads personalisation and no remarketing.

We also use the Contentsquare service provided by Content Square SAS (France) to record — only with your consent — how the pages of the website and the Platform are used, in recordings in which every text, number and image is hidden, to draw heatmaps from them, and to receive what you choose to tell us through the feedback form (Section 13). Content Square SAS processes this data in its capacity as Processor on our behalf under its terms of use and its data processing agreement, and it is processed in the European Union (Ireland) and in the other countries where the provider operates. We send it no identifier of your account, and we use none of its advertising or audience-sharing features.

We also use the Web Analytics service of Cloudflare, Inc. (United States of America), which is already our content delivery and protection network, to count visits to the public pages of the website (Clause 13.14). It sets no cookie, stores nothing in your browser, receives no identifier of you or of your account, and does not run inside the Platform after sign-in. Cloudflare processes this data in its capacity as Processor on our behalf under its data processing addendum, and it is processed in the United States of America and in the other countries where Cloudflare operates.

Save TikTok's pixel and our report to OpenAI for our advertising (Clauses 7.5 and 7.6), we use no other third-party analytics or measurement tool, and we use no messaging channel other than e-mail. If we add any, this Policy and the Sub-processor List are updated.

When you arrive through a link that carries campaign tags, for example a link in one of our videos, we record those tags, the page you landed on and the website that sent you, together with your answer to "How did you hear about us?". We read them from the link at the moment you sign up and keep them with your account, to learn which of our campaigns bring customers. We do this ourselves: the record kept with your account is not received by any third party, and nothing is stored in your browser for it. If, however, you consent to analytics cookies, the Google Analytics and Contentsquare services also receive the campaign tags and the website that sent you along with the data of your visit, as set out in Section (13); if you do not consent, none of this reaches them. The Cloudflare Web Analytics service on the public pages receives no campaign tags: it receives the address of the page and of the website that sent you without their query (Clause 13.14).

7.3 Other parties. We may disclose your data: (a) to the competent governmental, judicial and regulatory authorities upon their request in accordance with the law; (b) to our legal advisers, accountants and auditors who are bound by confidentiality; (c) to our successor in the business in the event of a merger, an acquisition or a transfer of assets, with notification to you and with your data remaining subject to this Policy or to a policy no less protective than it; (d) to any other party with your consent.

7.4 Payment service providers. Payment method data are processed by the payment service provider in accordance with its own policy, and we do not retain full card numbers. What is collected inside the Kingdom is processed by a payment service provider licensed by the Saudi Central Bank; subscriptions collected by card outside the Kingdom are processed by an international payment service provider identified in the Sub-processor List, and that entails the transfer of payment data outside the Kingdom in accordance with Section (8).

7.5 TikTok — with your consent to advertising. If you consent to advertising, we use TikTok's pixel on some of the public pages of the website (Clause 13.15). What it collects is received by TikTok Pte. Ltd. (Singapore), the TikTok company with which we contract for advertising. TikTok uses it to measure for us the visits and sign-ups our ads bring, and also — in its capacity as an independent controller and under its own privacy policy — to show and personalise ads on TikTok, to improve the delivery of ads and its services, and for safety and security. TikTok is therefore not a Sub-processor of ours. It keeps data in Singapore, Malaysia, Ireland, the United States of America and the other countries where it operates. We have turned off TikTok's automatic advanced matching and its enhanced data collection, so it receives from us no e-mail address, telephone number or name — not even in hashed form — and nothing of the content of the page.

7.6 OpenAI — with your consent to advertising. If you consent to advertising and you arrive at the website from one of our ads on ChatGPT, our servers tell OpenAI when you then create an account (Clause 13.16). What we send is received by OpenAI OpCo, LLC (United States of America), the OpenAI company with which we contract for advertising on ChatGPT. OpenAI uses it to measure for us the sign-ups that our ads on ChatGPT bring, and receives it as an independent controller under its own terms and privacy policy; OpenAI is therefore not a Sub-processor of ours. We mark every report so that OpenAI does not use it to personalise ads. OpenAI processes data in the United States of America and the other countries where it operates. No script of OpenAI's is loaded on the website, and it places no cookie in your browser; it receives no e-mail address, telephone number, name or Internet Protocol address of yours from us — not even in hashed form.

8. Transfer of data outside the Kingdom

8.1 Disclosure. Providing the Services may require some of your personal data to be processed by Sub-processors whose premises or servers are outside the Kingdom of Saudi Arabia, as set out in Section (7.2) and in the Sub-processor List, which states the country of processing for each of them. This includes — where you have consented to analytics cookies — the measurement data that the Google Analytics service receives and processes in the United States of America and in the other countries where Google operates, and the recordings and measurement data that the Contentsquare service receives and processes in the European Union (Ireland) and in the other countries where it operates (Section 13). It also includes the visit data of the public pages of the website that the Cloudflare Web Analytics service receives and processes in the United States of America and in the other countries where Cloudflare operates (Clause 13.14). It further includes — where you have consented to advertising — the data that TikTok's pixel sends to TikTok, which keeps it in Singapore, Malaysia, Ireland, the United States of America and the other countries where it operates (Clause 7.5), and the report of a sign-up that our servers send to OpenAI, which processes it in the United States of America and the other countries where it operates (Clause 7.6). The controls set out in Clause 8.2 apply to all of these.

8.2 Controls. We do not transfer personal data outside the Kingdom except: (a) to the minimum extent necessary to achieve the purpose; (b) in a manner that does not prejudice the national security or the vital interests of the Kingdom; (c) under the mechanisms permitted by the Regulation on Personal Data Transfer outside the Kingdom, among them the standard contractual clauses and appropriate contractual safeguards, and after carrying out a risk assessment where the Regulation requires one and documenting it; (d) or to a country included by the competent authority in the list of countries with an adequate level of protection, once that list is issued. You may request information about the safeguards applied through the Data Protection Officer.

8.3 Subjection to foreign laws. We disclose that some of our Sub-processors are subject to the laws of other countries, which may affect the level of protection, and that we have contracted with them for appropriate contractual safeguards to address this.

9. Retention periods and the method of destruction

9.1 The principle. We retain personal data for the period necessary to achieve the purpose for which it was collected, and then destroy it without undue delay, unless the law requires it to be retained for a longer period.

9.2 Table of periods.

9.3 The method of destruction. We destroy data by methods that prevent its retrieval, among them: secure deletion from the operational databases, the expiry of backups according to their defined cycle, the destruction of encryption keys where they are used, and the physical destruction of media when taken out of service. Where destruction is not technically possible immediately (such as archived backups), we isolate the data from use until it is destroyed at its due time.

9.4 Anonymisation. We may retain anonymised data that cannot by any reasonable means be linked to you, for statistical and development purposes, without a time limit.

9.5 Deleting your account yourself. You may delete your account at any time, in the ARK47 app (Account → Delete account) or on the web (Settings → Delete account), or by writing to us through the channels in Section 2. When you delete it yourself you give up the Retrieval Window: your account and registration data are deleted from our operational databases at once, every session and device is signed out, and your applications and their data are deleted. We keep only what 9.2 says the law requires (invoices and accounting and tax records, and the electronic acceptance records for the Terms), with no more of your data than the law requires, and the copies in backups expire within 90 days, as 9.3 describes. The pseudonymous measurement data already sent with your consent to the Google Analytics service (Section 13) remain there until Google deletes them at the end of the period set out in 9.2.

10. Your rights and how to exercise them

10.1 Your rights under the Personal Data Protection Law.

10.2 Exercise. Submit your request through the channels set out in Section (2), stating your identity and the nature of your request. We may ask you for what is necessary to verify your identity, in order to protect your data.

10.3 The period. We answer your request within thirty (30) days of receiving it, and the period may — in complex cases or where requests are numerous — be extended by a like period, with notification to you of that and of its reasons, unless the Regulations prescribe a shorter period, in which case we comply with it.

10.4 No fees and no adverse effect. Exercising your rights is free of charge, unless the request is manifestly repetitive or excessive, in which case a reasonable fee may be requested or the request refused with a statement of the reason. Exercising your rights has no adverse effect on your dealings with us.

10.5 Limits. We may decline to meet the request in whole or in part where the law so requires, such as protecting the rights of others or complying with a legal obligation to retain, or where the request relates to data we process in the capacity of Processor for a Customer (Section 16), in which case we refer the request to the Customer concerned.

10.6 Complaints. If you are not satisfied with our handling of your request, you may escalate to the Data Protection Officer, and you may lodge a complaint with the Saudi Data and Artificial Intelligence Authority (SDAIA) as the competent authority, through its official channels.

11. Data security

We apply appropriate organisational, administrative and technical measures to protect personal data, guided by recognised practices, among them the Essential Cybersecurity Controls issued by the National Cybersecurity Authority to the extent applicable, and comprising: encryption in transit and at rest, multi-factor authentication for access, permission control on a need-to-know basis, logical separation between Customers' workspaces, logging and monitoring, backup, vulnerability and update management, and our employees' obligation of confidentiality. Responsibility for protecting your sign-in credentials and for enabling multi-factor authentication rests with you.

12. Data breach incidents

In the event of an incident of leakage, destruction or unlawful access affecting your personal data that we process in the capacity of Controller, we notify the competent authority within seventy-two (72) hours of becoming aware of it, in accordance with what the Regulations prescribe, and we notify you without undue delay if the incident would harm your data, your rights or your interests, stating the nature of the incident, its likely effects, the measures taken and what is advised to be done.

13. Cookies and similar technologies

13.1 Necessary cookies. We use the cookies that are necessary for operating the website and the Platform, namely: the session and security cookies that keep you signed in and protect sign-in and your account; preference cookies, among them the NEXT_LOCALE cookie, which keeps the display language you chose; and the ark47_consent cookie, which keeps your choice in the consent panel. These do not require your consent, because the website and the Platform cannot be provided without them, and none of them is sent to Google, to Contentsquare, to TikTok or to OpenAI.

13.2 Analytics cookies — with your consent only. We use the Google Analytics service (Clause 7.2) to understand how the website and the Platform are used, to learn which campaigns bring us customers, and to improve the product; and the Contentsquare service (Clause 7.2) to see — in recordings in which every text is hidden, and in heatmaps — where the website and the Platform get in our users' way, and to receive what you choose to tell us through the feedback form. The legal basis for both is your consent (Clause 5.2), and one answer in the consent panel covers both. No script of either service is loaded and no request is sent to either before you click "Accept" in the consent panel, which is shown to you in Arabic and in English, and no analytics cookie is stored in your browser before then. We use no marketing or advertising cookies other than those of TikTok's pixel and our own ark47_oppref cookie, which you are asked about separately (Clauses 13.15 and 13.16). The Cloudflare Web Analytics service is not an analytics cookie: it sets no cookie and stores nothing in your browser, and Clause 13.14 sets it out.

13.3 Table of cookies.

13.4 Accepting, declining and withdrawing. The consent panel offers you three answers — "Accept all", "Analytics only" and "Decline" — and none of them has any effect on your use of the website or the Platform, both of which remain fully available to you. You may change your choice or withdraw your consent at any time through the "Cookie settings" link in the website footer or in your account settings; on withdrawal, measurement and recording stop and the analytics cookies are deleted from your browser, save the _cs_optout cookie, which keeps the recording off; and on withdrawing your consent to advertising, TikTok's pixel stops, its cookies and the ark47_oppref cookie are deleted from your browser, and nothing more is reported to OpenAI; neither affects the lawfulness of the processing that preceded the withdrawal. What was sent before the withdrawal remains with Google and Contentsquare until the retention period set out in Clause 9.2 expires, and with TikTok and OpenAI under their own privacy policies (Clauses 7.5 and 7.6), and your rights set out in Section (10) remain. We ask for your consent again twelve (12) months after your choice, or whenever the analytics or advertising terms of this Policy change.

13.5 What is sent to Google Analytics after your consent. Only the following is sent:

• the page you visit, as a template free of the actual identifiers — for example "/dashboard/studio/[instanceId]" rather than the actual number of your Application;

• the display language;

• the approximate geographical location that Google derives from the Internet Protocol address, noting that the Google Analytics service does not store Internet Protocol addresses;

• the type of device, browser and operating system;

• the website that sent you to us, and the campaign tags carried in the link;

• the random identifier of your browser kept in the _ga cookie;

• the names of specific actions in the product, such as: signing up, signing in, creating an Application, sending a message in the Studio, a build of an Application finishing or failing, opening the preview, publishing, choosing a Plan, starting checkout, completing a purchase together with its amount and currency, and cancelling a subscription; these actions are accompanied only by values from fixed categories and by numbers, never by free text;

• and, for a signed-in user: an internal pseudonymous identifier of their account, never their e-mail address or their name.

13.6 What is never sent. The following is never sent to Google Analytics, to Contentsquare, to Cloudflare Web Analytics, to TikTok or to OpenAI in any case: the prompts or any text you write in the Platform — save what you choose to send through the feedback form (Clause 13.12) — the names of Applications, the data recorded in your Applications, the content of the preview, e-mail addresses, names, or payment card data. None of these services receives anything of what our Customers enter into their Applications or collect through them (Section 16).

13.7 Sending from your browser only. Everything that Google Analytics and Contentsquare receive under this Section is sent from your browser, and only after your consent; nothing is sent from our servers to either of them. TikTok receives what Clause 13.15 sets out from your browser too, and only after your consent to advertising; nothing is sent to it from our servers. OpenAI, by contrast, receives what Clause 13.16 sets out from our servers only, and only after your consent to advertising; nothing is sent to it from your browser.

13.8 When measurement begins. Measurement and recording begin, on the website and inside the Platform alike, from the effective date of this version, and only for those who consent to them. For an account created before 29/4/1448H corresponding to 10/10/2026, measurement and recording of its use inside the Platform after sign-in begin only after its holder has been notified in accordance with Section (17) thirty (30) days in advance, the Customer to which it belongs has been notified in accordance with Clause B-6 of Annex (B) of the Terms and Conditions, and Version 1.3 of the Terms and Conditions has come to apply to that Customer; and then only for those who consent to them.

13.9 How Google uses information. Google explains how it uses information from the sites and apps that use its services on its page entitled "How Google uses information from sites or apps that use our services":

https://policies.google.com/technologies/partner-sites

13.10 Browser settings. You may also manage cookies at any time through your browser settings, noting that disabling the necessary cookies may affect the operation of the website and the Platform.

13.11 What Contentsquare records after your consent. The Contentsquare service records how the pages of the website and the Platform are used, in recordings in which every text, every number and every image on the page is hidden before it leaves your browser, and in which nothing you type is collected; a recording therefore shows only the layout of the page and the movements, clicks, taps and scrolling made in it, and the heatmaps are drawn from these recordings. Alongside them it receives only: the page you visit — as a template free of the actual identifiers in the page views, while the recording itself carries the address of the page, which, for a page of one of your Applications, includes that Application's internal reference number, never its name or its content; the type of device, browser and operating system; the approximate geographical location that it derives from the Internet Protocol address, which it deletes within three days; the website that sent you to us, without its query and with the identifiers of our own pages masked, and the campaign tags carried in the link; and the random identifier of your browser kept in the _cs_id cookie. It receives no identifier of your account, and the preview of your Applications is not recorded. Inside the Platform, recording stops as soon as you reach a page that this Section does not allow to be recorded.

13.12 The feedback form. With your consent, a "Feedback" link appears in the website footer, and in the Platform in the side menu and above the preview in the Studio. It opens the feedback form in a new tab, on a page run by Contentsquare, where you may rate your experience or tell us in your own words what got in your way. The link passes nothing about you or about the page you came from: no account identifier, no page address and no address of your Applications. What you write there, and your rating, are sent to the Contentsquare service from that page; nothing is sent unless you send it. Contentsquare's privacy notice (Clause 13.13) also applies to that page. Do not include in what you write personal data, or the data of your Applications or of your clients.

13.13 How Contentsquare handles information. Contentsquare explains how it processes data in its privacy centre:

https://contentsquare.com/privacy-center/

13.14 Counting visits to the public pages (Cloudflare Web Analytics). On the public pages of the website only — the home page, sign-in, sign-up, password reset, the Terms and Conditions, this Policy, the page of the customer relationship management system and the account deletion page — your browser sends a short report of each page load to the Cloudflare Web Analytics service (Clause 7.2), through our own domain. The report carries only: the address of the page, without its query; the address of the website or page that sent you, without its query; the type of device, the browser and its engine, and the operating system; the type of navigation, the time the page took to load and the memory it used; and a random number for that page load alone. Cloudflare derives the approximate country from the Internet Protocol address, and the data it keeps contain no Internet Protocol address. The service sets no cookie, stores nothing in your browser, receives no identifier of you or of your account, and its data contain nothing that links one visit to another. It does not run inside the Platform after sign-in. Its basis is our legitimate interest in knowing which public pages are visited and whether they load well (Clause 5.2), and for that reason it does not appear in the consent panel; if you object to it, you may block scripts from static.cloudflareinsights.com in your browser, or write to us at [email protected].

13.15 TikTok's pixel — with your separate consent to advertising. If you choose "Accept all" in the consent panel, TikTok's pixel runs on four public pages of the website only — the home page, the page of the customer relationship management system, sign-in and sign-up — and only while the page's address carries nothing beyond campaign tags and TikTok's click identifier; it does not run on any other page, inside the Platform after sign-in, or on the password reset page, nor when you reach one of these four pages directly from any other page of the website. If you choose "Analytics only" or "Decline", no script of TikTok's is loaded and nothing is sent to it. From your browser, the pixel sends TikTok: the address of the page, with the campaign tags and TikTok's click identifier where the link carried them; the address of the page or website that sent you; the type of device and browser; the time you spent on the page; the random identifiers kept in its cookies (Clause 13.3); and, when you finish signing up, the fact that you signed up — never your e-mail address, your name, your telephone number, anything you type, or the content of the page. TikTok also receives your Internet Protocol address, as any website you visit does, and the pixel looks up an IPv6 address through a TikTok server in the United States of America. It keeps a few working entries in your browser's session storage, deleted when you close the tab. The moment you leave these four pages for any other page, the pixel is switched off for the rest of that visit. TikTok uses this data as set out in Clause 7.5, and explains how in its privacy policy:

https://www.tiktok.com/legal/page/row/privacy-policy/en

13.16 Our report to OpenAI — with your separate consent to advertising. A link from one of our ads on ChatGPT carries OpenAI's click reference in the address of the page it opens. If you have chosen "Accept all" in the consent panel, we keep that reference in the ark47_oppref cookie, on our own website only, for up to 30 days. If you create an account within that time, our servers send OpenAI OpCo, LLC one report: that an account was created, with that click reference, a number that is the same for every report about the same account but from which the account cannot be identified, the time the account was created, and the address of our website. Nothing else is sent — not your e-mail address, your name, your telephone number, your Internet Protocol address, anything you type, or anything of your account or your Applications — and the cookie is then deleted. If you choose "Analytics only" or "Decline", the reference is not kept and nothing is sent to OpenAI. No script of OpenAI's is loaded on the website. OpenAI uses the report as set out in Clause 7.6, and explains how in its privacy policy:

https://openai.com/policies/row-privacy-policy/

14. Minors

Our services are directed at establishments and are not aimed at minors, and we do not knowingly collect the data of minors. If we learn that the data of a minor has been collected without the necessary legal basis, we destroy it.

15. Direct marketing

15.1 We do not send you marketing messages or make promotional calls to you except with your express and separate consent, and your acceptance of this Policy or of the Terms and Conditions does not constitute consent to receive marketing, in compliance with the controls on unsolicited messages and calls issued by the Communications, Space and Technology Commission.

15.2 Every marketing message includes identification of the sender and an easy means of unsubscribing, and we stop sending within twenty-four (24) hours of your request and confirm that to you. We do not send promotional messages at the times prohibited by the controls.

15.3 We may send you — without marketing consent — the operational and statutory notifications necessary to perform the agreement or to comply with a legal obligation.

16. Data we process in the capacity of Processor on behalf of our Customers

16.1 The role. This Policy does not create any obligation on us towards you in the capacity of Controller in respect of what we process on behalf of our Customers; this Section is a transparency statement about what we do in the capacity of Processor, and the corresponding obligations fall on the Customer as Controller. When our Customer uses the Platform to configure and operate its Applications, the personal data that it enters or collects (the data of its employees, its End Users, its contacts, its correspondence and its calls) is data of which the Customer is the Controller, and which we process on its behalf and in accordance with its documented instructions, under the Personal Data Processing Addendum contained in the Terms and Conditions, which sets out the purpose, the categories, the duration, our security obligations, incident notification, Sub-processors, transfer outside the Kingdom, and deletion at the end of the subscription.

16.2 What we do not do. We do not use that data for our own purposes, we do not take decisions in respect of it, we do not disclose it to others except in accordance with the Customer's instructions or by order of a competent authority, and we do not use it to train artificial intelligence models. Our authorised staff may look into a Customer's application, or make an internal working copy of it, to fix faults and improve the quality of our services, as set out in Clause 8.8 of the Terms: under confidentiality, with every copy recorded, deleted within thirty days, and never used to contact anyone or to train a model.

16.3 If you are a data subject held by one of our Customers. Direct your request to that Customer, as it is the party that determines the purposes and means of the processing and that determines the privacy notice applicable to you. If your request reaches us directly, we refer it to the Customer within five (5) Business Days and inform you of that, and we do not answer it ourselves except to the extent that the law requires.

16.4 AI Agents. If you deal with an AI Agent operated by one of our Customers on the Platform, that agent acts in the Customer's name and on its behalf, and the Customer is responsible for disclosing its automated nature to you and for what issues from it.

17. Amendment of this Policy

We may amend this Policy to keep pace with legal or operational changes. We publish the amended version together with its version number, its effective date and a summary log of the changes, and we notify account holders of material amendments at their registered e-mail address and through the Platform at least thirty (30) days before they take effect. If an amendment requires your consent (such as the addition of a new purpose of processing), we request it from you separately before the processing begins.

Change log.

• Version 1.8 (2/5/1448H corresponding to 13/10/2026): our report to OpenAI of an account created after a visit from one of our ads on ChatGPT, with your consent to advertising, sent from our servers and with no script of OpenAI's on the website — in the new Clauses 7.6 and 13.16 and the row for the ark47_oppref cookie in Clause 13.3; TikTok's pixel no longer runs when one of its four pages is reached directly from another page of the website (Clause 13.15); and the related changes in Clauses 4.2, 5.2, 7.2, 8.1, 9.2, 13.1, 13.2, 13.4, 13.6 and 13.7.

• Version 1.7 (1/5/1448H corresponding to 12/10/2026): TikTok's pixel on four public pages of the website, with your separate consent to advertising — the consent panel now offers "Accept all", "Analytics only" and "Decline" — in the new Clauses 7.5 and 13.15 and the rows for its cookies in Clause 13.3; and the related changes in Clauses 4.2, 5.2, 5.5, 7.2, 8.1, 9.2, 13.1, 13.2, 13.4, 13.6 and 13.7.

• Version 1.6 (1/5/1448H corresponding to 12/10/2026): Clause 16.2 states that our authorised staff may look into a Customer's application, or make an internal working copy of it, to fix faults and improve the quality of our services, in accordance with Clause 8.8 of the Terms.

• Version 1.5 (1/5/1448H corresponding to 12/10/2026): the disclosure of the Cloudflare Web Analytics service, which counts visits to the public pages of the website without cookies and without storing anything in the browser, in the new Clause 13.14 and its naming in Clause 7.2; the related changes in Clauses 4.2, 5.2, 8.1, 9.2, 13.2, 13.6 and 13.7; and the correction of Clause 13.12: the feedback form opens on Contentsquare's own page and receives no address of ours.

• Version 1.4 (29/4/1448H corresponding to 10/10/2026): the addition, through the Contentsquare service and with your consent only — under one answer with Google Analytics — of recordings of the use of the website and the Platform in which every text, number and image is hidden, of heatmaps and of a feedback form; its naming in Clause 7.2; the new Clauses 13.11 to 13.13 and the rows for its cookies in Clause 13.3; the statement in Clause 13.7 that nothing is sent from our servers; and the related changes in Clauses 4.2, 5.2, 8.1, 9.2, 13.1, 13.2, 13.4, 13.6 and 13.8.

• Version 1.3 (29/4/1448H corresponding to 10/10/2026): the addition of measuring the use of the website and the Platform through the Google Analytics service with your consent only, its naming as an exception in Clause 7.2, the rewriting of Section (13) with a table of cookies, the related changes in Clauses 4.2, 5.2, 5.5, 8.1, 9.2 and 9.5, and the addition of this log.

• Version 1.2 (29/4/1448H corresponding to 10/10/2026): the addition of Clause 6.4 on what is sent from the Studio to the artificial intelligence model providers and the request for your permission in the mobile app before your first message, and of Clause 9.5 on deleting your account yourself and thereby giving up the Retrieval Window.

• Version 1.1 (25/4/1448H corresponding to 6/10/2026): a statement of the recording of campaign tags, the landing page and the referring website at sign-up (Clause 7.2), and a statement that the databases of the Applications our Customers publish are processed in the Kingdom of Saudi Arabia.

• Version 1.0 (7/4/1448H corresponding to 18/9/2026): the first version.

18. Contact and complaints

The complaints route: (1) submit your complaint to the Data Protection Officer, and we respond to you within fifteen (15) Business Days; (2) if it is not resolved, you may escalate to the Company's senior management at [email protected]; (3) and you have, in all cases, the right to lodge a complaint with the competent authority.

Severability: If any provision of this Policy is adjudged void, the remaining provisions remain in force.

APEX Operations Company — Unified Number 7051961980 — Tax Number 314285795400003 — Riyadh, King Salman District, Ibn Zaydan 12443