Privacy Policy

This Privacy and Information Confidentiality Policy (the "Policy") explains how Valor collects, processes, shares, and protects your personal data when you use the wevalor.ai platform or any of its services.

This Policy applies to every person who accesses the Platform, whether using the Free Service or the Paid Service, or contacting Support. By using the Platform, you acknowledge that you have read and understood this Policy.

This Policy complements the Terms and Conditions published on the Platform; it does not replace them. In case of any conflict in wording concerning personal data, the text shall be interpreted in a manner that serves your rights under the Personal Data Protection Law of the Kingdom of Saudi Arabia and its Implementing Regulations.

In this document, the following words and phrases shall have the meanings set out against them, unless the context requires otherwise:

"Platform":

The website wevalor.ai, including all subdomains, pages, interfaces, or related services derived from it.

"Service":

What Valor provides through the Platform, including the Free Service and the Paid Service as defined in the Terms and Conditions.

"User":

Any natural person who accesses the Platform or uses any of its services.

"Business":

The commercial entity whose data the User submits to obtain the Value Index.

"Personal Data":

Any data that may lead to the identification of a natural person, directly or indirectly, alone or in combination with other data, including name, email address, IP address, and any digital identifier.

"Data Subject":

The natural person to whom the Personal Data relates.

"Processing":

Any operation performed on Personal Data, by automated or manual means, including collection, recording, storage, analysis, transfer, disclosure, and deletion.

"Data Controller":

Valor AI Establishment ("Valor"), as the entity that determines the purposes and means of processing.

"Processor":

Any third party that processes Personal Data on Valor's behalf under a data processing agreement.

"Law":

The Personal Data Protection Law issued in the Kingdom of Saudi Arabia and its Implementing Regulations.

"Authority":

The Saudi Data and Artificial Intelligence Authority (SDAIA), the competent authority overseeing the Law.

2.1. This Policy applies to Personal Data that Valor collects and processes in connection with operating the Platform and providing the Service, whether provided directly by the User or collected automatically during browsing.

2.2. This Policy does not cover the privacy practices of third-party sites or services the User may reach through links within the Platform or the Report. Such sites are governed by their own policies, and Valor is not responsible for their practices.

2.3. Valor provides the Service from the Kingdom of Saudi Arabia and processes your data in accordance with the Law, subject to the cross-border transfer provisions set out in Section 7.

3.1. Data You Provide. Valor collects the following data directly from you when using the Platform:

• (a) For the Free Service: Business activity, city, preliminary estimate of revenue or assets, Business age, revenue model, growth direction. No account is required, and no email address is needed for the Free Service.
• (b) For the Paid Service: An email address for Report delivery and access management, the Business name and its Commercial Registration number, together with broader operational and financial details about the Business such as costs, simplified financial position, value characteristics, optional projections, and details of prior funding rounds where applicable, and any documents you choose to upload, such as financial statements or the Commercial Registration certificate.
• (c) In communications: The content of support messages and what you voluntarily share in help requests.
• (d) On the payment page: your Commercial Registration number, if you choose to enter it to receive the support price for small and medium enterprises.

3.2. Data Collected Automatically During Use. We automatically collect certain technical data necessary to operate and protect the Platform:

• (a) Network data: IP address, browser type and version, device type and operating system, and referring page (Referer).
• (b) Platform event logs: visit times, pages viewed, form actions (without the substance of sensitive content).
• (c) Necessary and functional cookies, as detailed in Section 11.

3.3. Payment Data. Valor does not request your card data and does not store the card number within its systems. Card processing is executed directly through a payment gateway licensed by the Saudi Central Bank. Valor receives from the gateway the transaction reference and status (success or failure) only, along with the last four digits of the card number when available, for support and reconciliation purposes.

3.4. Data We Do Not Intentionally Collect. Valor does not request national ID or residence number, nor any sensitive data (health, ideological, ethnic, or similar). If a User voluntarily enters sensitive data in a free-text field, they remain responsible for it, and Valor undertakes to delete it upon request or once the purpose of processing has ceased.

3.5. Commercial Register Data. When you enter your Commercial Registration number on the payment page, or ask to look it up in the report form, Valor retrieves your Business's registered data from the Ministry of Commerce: trade name, legal entity, city, registration date, registration status, capital, and activities. Valor does not retrieve data about owners or managers, or their identity numbers. Valor keeps the registration number and this data in its internal records, for the purposes set out in Section 4.1.

4.1. Valor processes your Personal Data for specific and clear purposes, based on the legal grounds set out in the Law:

• (a) Performance of a contractual obligation: to operate the Service, calculate the Value Index, issue the Report, deliver it to the User, manage access to it, and apply the support price after verifying the Commercial Registration number in the official register.
• (b) Legitimate interests: to protect the security of the Platform, detect and prevent fraud, verify the integrity of use, and improve the quality of the Service in ways that do not directly identify you; and to build internal records of businesses from their Commercial Registration numbers and their data in the official register, which Valor uses alone to improve its services and does not sell or share with partners or other parties for their own purposes.
• (c) Regulatory compliance: to retain payment and transaction records for accounting, tax, and supervisory purposes as required by Applicable Laws.
• (d) Explicit consent: when providing optional services or sending operational messages requested by the User.

4.2. Valor does not process your data for purposes not disclosed in this Policy and does not use it for advertising profiling or sell it to any third party.

4.3. Where Valor relies on legitimate interests, it conducts a privacy impact assessment and applies controls to minimize data collection and limit it to what is necessary, while providing transparency and user control.

5.1. Valor shares your data with a limited number of trusted service providers, to the extent required by the nature of the Service, under data processing agreements that restrict use of data to the specified purpose. Current Processors:

Cloud infrastructure provider:

Storage of account and report data and management of the authentication session. Located outside the Kingdom, subject to the cross-border safeguards in Section 7.

Payment gateway licensed by the Saudi Central Bank:

Card payment processing within the Kingdom of Saudi Arabia.

AI text-processing service provider:

Production of the textual portion of the Report from pre-processed computational inputs, and reading of documents you upload to fill in fields. Located outside the Kingdom.

Technical error-tracking provider:

Monitoring of errors and Platform performance for reliability purposes. Located outside the Kingdom.

Transactional email provider:

Sending operational messages such as transaction confirmations and access links. Located outside the Kingdom.

Network protection and content delivery provider:

Denial-of-service mitigation and user access acceleration. Located outside the Kingdom.

Cloud hosting provider:

Operation of application servers and interface delivery.

5.2. Valor does not sell your Personal Data and does not share it with advertising entities or behavioral-profiling platforms. Valor keeps your data confidential, protects it with the security controls described in Section 12, and uses it only within the purposes set out in Section 4, chief among them operating the Service and issuing the Report.

5.3. The list of Processors may be updated from time to time to serve the development of the Service, and the updated list will be published in this Policy.

5.4. When you enter your Commercial Registration number on the payment page or ask to look it up, Valor sends that number alone to the official commercial-register data provider in the Kingdom to retrieve the data described in Section 3.5. Valor sends it no other data about you.

6.1. Valor uses an AI text-processing service provider as a sub-processor to produce the textual portion (analytical narrative) of the Report. The actual computation of the Value Index is fully automated on Valor's servers, and artificial intelligence is not used to determine the final figure.

6.2. What is sent to the Processor is pre-processed computational output (numbers, classifications, field labels, factors affecting value), without email addresses or account identifiers that would link the data to a specific person, where feasible. Documents you choose to upload are sent to it as they are, to be read and have their fields extracted.

6.3. Valor does not share your data with any AI provider for advertising or profiling purposes, and does not sell or lease your data for training external models.

6.4. Valor retains full control of the data as the Controller, and the Processor operates under Valor's instructions and for its specified purposes.

7.1. Some of the Processors listed in Section 5 have infrastructure outside the Kingdom of Saudi Arabia. Data transfers to them are carried out in accordance with the Law and its Implementing Regulations, through safeguards that include binding data processing agreements, encryption during transit (TLS), and access controls based on the principle of least privilege.

7.2. Transfers outside the Kingdom do not impair your rights under the Law. Valor undertakes to notify the Authority in accordance with applicable requirements when transfer arrangements are materially modified.

7.3. Where a Data Subject requests additional information about the destination of transfer or the safeguards applied, we provide such information to the extent permitted by the Law and the applicable agreements.

8.1. Valor retains your Personal Data for the period necessary to achieve the purpose of its collection, or for the period required by Applicable Laws, whichever is longer. Detailed periods:

• (a) Paid Service account data and issued Reports: while the account is active, and a minimum of 12 months from the Report's issuance date, to enable access and review.
• (b) Security event logs and access logs: 12 months.
• (c) Payment and financial transaction records: 10 years, to meet accounting and tax requirements.
• (d) Free Service data that does not convert into a paid Report: up to 90 days, then destroyed or converted into a form that does not link them to an individual identity.
• (e) Support and communication messages: 24 months from the last contact, unless an ongoing dispute requires longer retention.
• (f) Commercial Registration numbers and business data retrieved from the official register: for as long as they are needed for the purposes set out in Section 4.1, and destroyed at your request under Section 9.

8.2. After the periods stated above expire, Valor destroys the data or converts it to a form that does not link it to an individual identity, in accordance with the Law and its Implementing Regulations.

8.3. Valor may retain a copy of the data after the purpose has ended if a regulatory obligation or ongoing judicial proceeding so requires, and shall destroy it upon expiry of the reason.

9.1. Under the Law, the Data Subject enjoys the following rights:

• (a) Right to know: to be informed of the legal basis for collection of their data and the extent and purposes of processing.
• (b) Right of access: to view their Personal Data held by Valor.
• (c) Right to obtain a copy: to receive a copy of their data in a readable and clear format.
• (d) Right to correction and updating: to correct, complete, or update inaccurate or incomplete data.
• (e) Right to request destruction: to request deletion of their Personal Data once the purpose of processing has ceased or upon withdrawal of consent, subject to any regulatory obligations that require Valor to retain the data.
• (f) Right to withdraw consent: to withdraw prior consent to data processing at any time, without affecting the lawfulness of processing before withdrawal.
• (g) Right to lodge a complaint with the Saudi Data and Artificial Intelligence Authority (SDAIA) through its official channels, without prejudice to any other statutory right.

9.2. Some rights may be limited to the extent required by the Law, for example where they conflict with a regulatory obligation to retain a transaction record, or where they relate to an ongoing judicial proceeding.

10.1. To exercise any of the rights set out in Section 9, send your request to the email address support@wevalor.ai with the subject "Personal Data", and include in the request the basic details to identify yourself and specify the nature of your request.

10.2. Valor undertakes to respond to your request within 30 days of receipt, unless the request requires additional time. In case of delay, you will be notified of the reason and the expected period to determine the request.

10.3. To protect your data, Valor may request verification of your identity before executing the request, using the email address associated with your account or another method proportionate to the nature of the request.

10.4. Exercising rights does not entail additional fees, unless the request is repetitive or manifestly excessive in a way that requires unusual effort.

11.1. Valor uses cookies and similar technologies to operate the Platform, protect the User's session, and improve the user experience. Whatever is collected through them is subject to this Policy, including Valor's commitment not to sell your Personal Data or share it with advertising entities.

11.2. Categories of cookies in use:

Authentication and session cookies (necessary):

Used to manage the User's session in the Paid Service. Expire at the end of the session or according to the standard periods of the underlying authentication tooling.

Functional cookies linking actions within the Platform:

Connect data-entry steps with payment and Report issuance so the User does not lose progress. Short duration.

11.3. You may disable cookies through your browser settings. Disabling them may prevent some core Platform functions from operating, such as authentication and payment operations.

12.1. Security Measures. Valor applies reasonable technical and organizational security measures to protect your data, including the following:

• (a) Encryption of communications in transit.
• (b) Protection of session cookies through cryptographic controls and short validity periods.
• (c) Per-account isolation of access to data, so that a User accesses only their own data.
• (d) Separation of administrative-privilege credentials from the User-facing interface.
• (e) Restriction of administrative access to authorized staff according to the principle of least privilege.
• (f) Periodic review of systems and updating of protection controls as threats evolve.

12.2. Limits of Assurance. Absolute security cannot be guaranteed on the internet. Valor recommends that you protect your account data (email, access links) and not share it with unauthorized parties.

12.3. Breach Notification. In the event of a material breach of Personal Data likely to cause harm to Data Subjects, Valor undertakes to notify the Authority within the periods set by the Law, and to notify affected individuals to the extent required by the Implementing Regulations, indicating the nature of the breach, the actions taken, and recommendations to mitigate the impact.

13.1. Valor may disclose your Personal Data to competent authorities in the following cases, and to the extent required by the request:

• (a) Pursuant to a judicial order or an official request issued by a competent authority.
• (b) Within security or criminal investigations under the Anti-Cybercrime Law and related regulations.
• (c) To protect Valor's rights or the safety of its users, or to protect a third party's right where urgent intervention is required.
• (d) To enforce the provisions of the Terms and Conditions or the Acceptable Use Policy, or to meet contractual obligations with Service partners.

13.2. Disclosure is limited to the extent required by the Law or the official request, and Valor does not share your data more broadly than that.

14.1. The Service is directed at adults who have reached 18 years of age or older, as set out in Section 2 of the Terms and Conditions.

14.2. Valor does not intentionally collect minors' data. If Valor discovers that it has collected minors' data without a legal basis, it shall destroy such data upon verification, unless the Law requires its retention.

14.3. If you are a guardian and believe that a minor's data has been submitted to Valor without your consent, please contact via the email set out in Section 16 to take appropriate action.

15.1. Policy Modification. Valor may modify this Policy from time to time to reflect developments in the Service, changes in the regulatory framework, or updates to the list of Processors. The modified version is published on the Platform with a new version number and effective date, and Valor will seek to notify Users of material changes through available channels.

15.2. Authoritative Language. The Arabic text of this Policy is the official and binding version. Any translation is made available for convenience only and may not be relied upon for interpretation of the Policy or for the resolution of any dispute.

15.3. Applicable Law. This Policy shall be governed by and construed in accordance with the laws in force in the Kingdom of Saudi Arabia, in particular the Personal Data Protection Law and its Implementing Regulations.

15.4. Jurisdiction. Any dispute arising from or relating to this Policy shall be submitted exclusively to the competent courts in the city of Riyadh, unless the Law provides otherwise. This does not affect the Data Subject's right to lodge a complaint with the Authority.

15.5. Relationship with the Terms. This Policy complements the Terms and Conditions published on the Platform; it does not replace them. In case of a conflict in wording specifically concerning Personal Data, this Policy shall prevail.

For any inquiry regarding this Policy, to exercise any of your rights relating to Personal Data, or to file an internal complaint, please contact:

Data Controller: Valor AI Establishment (مؤسسة فالور آي)

Commercial Registration: 7054039495

Email: support@wevalor.ai (subject: "Personal Data")

Platform: wevalor.ai

The Data Subject is also entitled to lodge a complaint with the Saudi Data and Artificial Intelligence Authority (SDAIA) through its official channels, without prejudice to any other statutory right.