Privacy Policy

1. Who we are

SWSAM Solutions Company ("BazGrid", "we"), Office #60, "The Garage", Al Raid, Riyadh 12354, Kingdom of Saudi Arabia. Contact: info@swsam.sa. We operate the BazGrid readiness-assessment platform at bazgrid.com.

2. Scope

This policy explains what personal data we collect through the platform and our website, why we collect it, how long we keep it, and your rights under the Saudi Personal Data Protection Law (PDPL).

3. Data we collect

Account and identity: name, email address, organisation and role; sign-in events; identity identifiers if you sign in with Microsoft or Google; an authentication secret if you enable authenticator-app multi-factor authentication. We do not store passwords — sign-in is by emailed magic link or federation.

• Assessment data: your answers, applicability decisions, comments, assignments, and — on paid tiers — files you upload as evidence.
• AI assistance: help conversations (up to 40 messages per thread, retained 90 days) and documents you draft with assistance, including the revision history.
• Billing and enquiries: organisation billing details, invoice and purchase-order references, payment status. Contact-form data: name, email, organisation, country, the scope of your enquiry, and consent timestamps for service and marketing contact.
• Security and audit: audit events, sign-in and rate-limit logs, IP address and browser information, and malware-scan results for uploaded files. Audit records never contain evidence content, AI prompts or secrets.

4. How we use it

To provide and secure the service; to score assessments and generate reports; to validate results on expert tiers; to scan evidence for malware; to issue invoices and provide support; to meet legal and regulatory obligations; and — only with your consent — to send marketing communications. We do not use your assessment content to train AI models.

5. AI processing

AI features assist, not decide. Applicability and scoring are deterministic and versioned; a human decision is required before an expert-validated report is issued. AI inference runs on in-Kingdom infrastructure. We record content-free usage telemetry — counts, timings, model and safety signals — never your evidence or prompts for analytics.

6. Legal bases

Performance of our contract with you; our legitimate interests in securing and improving the service; your consent where required (marketing); and compliance with applicable law.

7. Sharing and processors

We do not sell personal data. We do not use advertising or analytics cookies. We disclose data to authorities only where the law requires it.

8. International transfers

Production customer data is hosted in the Kingdom. If a transfer outside the Kingdom is ever required, we will do so only under a documented PDPL-compliant basis.

9. Retention

We keep data only as long as needed for the purposes above:

• Account and assessment data: while your account is active; then per your deletion request or organisational agreement.
• Uploaded evidence: destroyed 30 days after your assessment is validated by an expert, unless the law requires longer retention.
• AI help threads: 90 days.
• Security and audit logs: 12 months.
• Enquiries and leads: 24 months, or until you withdraw marketing consent.
• Backups: rotated on a 35-day cycle.

10. Security

Encryption in transit and at rest, tenant isolation enforced by authorization policy, tenant-scoped data access and PostgreSQL row-level security, malware scanning with clean-only promotion, least-privilege access, and audit logging of sensitive operations.

11. Your rights

Under the PDPL you may request access, correction, deletion, restriction, or portability of your personal data, withdraw consent, and lodge a complaint with the competent authority (SDAIA). Contact info@swsam.sa; we respond within 30 days. Data-subject requests from customer users are normally handled through your organisation administrator.

12. Cookies and local storage

We use only strictly necessary cookies: a session cookie for sign-in (HttpOnly, SameSite=Lax, Secure) and a 10-minute multi-factor challenge cookie. Your language preference is stored in your browser's local storage. We use no analytics, advertising or third-party tracking cookies.

13. Children

The platform is a business service and is not directed to anyone under 18.

14. Changes

We will post changes on this page and set a new effective date. Material changes affecting customer data will be communicated to account administrators.

15. Contact

info@swsam.sa — SWSAM Solutions Company, Office #60, "The Garage", Al Raid, Riyadh 12354, KSA.