We take privacy seriously because voice data is sensitive and we build for a market that rightly expects its data to stay at home. This notice explains what we collect, why, and your rights — in plain English first, legal language second.
1. Scope
This notice covers personal data processed by Basher AI Limited (“Basher”, “we”) when you:
- Visit basherai.com or any Basher-operated web property.
- Use the Basher platform as a customer or end-user.
- Contact us by email, form, or phone.
For call data processed on behalf of our customers, those customers are the data controller and Basher is the data processor. This notice describes Basher as controller.
2. What we collect
You give us
- Account details — name, work email, company, role.
- Messages you send us via the contact form or email.
- Billing information for paid accounts — company details, VAT number, invoicing address. We don't store raw card numbers; payment is handled by our PCI-DSS-compliant processor.
We collect automatically
- Log data — IP address, user agent, pages visited, timestamps.
- Product telemetry — feature usage, errors, performance metrics.
- A small number of cookies (see section 9).
3. How we use it
We process personal data to:
- Provide, operate, and improve the Service.
- Bill for usage, prevent fraud, and meet our legal and tax obligations.
- Reply to support and sales enquiries — including your contact form message.
- Send operational notices (service changes, incidents). Marketing emails are opt-in.
- Aggregate anonymised performance data to improve models and metrics. We don't use your content to train foundation models.
5. Residency
Customer call data — recordings, transcripts, and associated metadata — is stored in Google Cloud's Dammam region (me-central2) by default. Real-time call processing currently uses vetted sub-processors outside the Kingdom; see our PDPL Commitment for the specifics. Enterprise customers can arrange dedicated tenancy or alternative residency as part of their order form.
Corporate data (billing records, support tickets, website logs) may be processed in the UK or EU where our back-office tools run, with standard contractual clauses and equivalent safeguards in place.
6. Retention
- Call recordings and transcripts: 90 days by default; configurable per-customer via admin settings, subject to legal minimums.
- Account data: for as long as your account is active, plus 6 years to meet statutory retention requirements.
- Contact-form submissions: 24 months from the last interaction.
- Logs: 90 days, except where a specific investigation requires longer.
7. Your rights
Subject to applicable law, you have the right to access, correct, delete, port, or object to processing of your personal data. Where we rely on consent, you can withdraw it at any time without affecting prior processing.
To exercise these rights, email privacy@basherai.com. We reply within 30 days. If you're not satisfied with our response, you can lodge a complaint with the Saudi Data & AI Authority (SDAIA), the UK ICO, or your local supervisory authority.
8. Security
We use encryption in transit (TLS 1.2+), encryption at rest (AES-256), scoped access controls, audit logging, and regular penetration testing. Employees access customer data on a need-to-know basis and every access is logged.
If we detect a breach affecting your personal data, we'll notify you without undue delay and in line with our regulatory obligations.
10. Contact us
Privacy questions go to privacy@basherai.com. For PDPL-specific matters, see our PDPL Commitment.