Privacy
A PDPL-aligned AI chatbot for businesses in Saudi Arabia
Before you put an AI agent in front of your customers, you should know where their data goes. This page says exactly what we do today, with no borrowed badges and no vague promises.
Updated
How Gental protects your data and your customers’ data
Stored in Saudi Arabia
Data, documents and search indexes live in Google Cloud’s me-central2 region, Dammam.
Workspace isolation
Row-level security in the database keeps every workspace’s data apart.
Not used for training
Leading AI models through commercial APIs that exclude your data from training.
Guarded instructions
Ignores instructions hidden in documents, never reveals its prompt, and stays on your topic.
Your domains only
The chat widget runs only on the domains you allow, with short-lived visitor sessions.
Roles and permissions
Each teammate sees and does what you allow, and tools that change things stay off until you allow them.
Sensitive numbers masked
When a customer sends a file or photo, national ID, iqama, passport, IBAN and card numbers are masked in what the agent keeps.
A clear record
Conversation records show what the agent was asked and which tools ran, and you choose how long voice recordings and customer files are kept.
Where exactly does the data go?
“Stored” and “processed” are different things, so we keep them apart:
| Data | What happens to it |
|---|---|
| Your files and web pages | Stored in Saudi Arabia with their search indexes, inside your workspace only |
| Customer conversations | Stored in Saudi Arabia, visible to your team according to their roles |
| Passages relevant to a question | Sent to the AI model provider for processing to write the answer, under terms that exclude training |
| Customer files and voice notes | Read for that conversation only, never added to your knowledge, deleted under the retention you choose |
What is the PDPL?
The Personal Data Protection Law (PDPL) is Saudi Arabia’s law on how personal data is collected, used, stored and transferred, supervised by the Saudi Data and AI Authority (SDAIA). The idea is simple: collect only what you need, tell people why, protect it, and move it outside the Kingdom only under the rules.
When you run a chatbot, you, the business, are usually responsible for your customers’ data, and the platform processes it on your behalf. So ask any chatbot vendor clear questions before you start. These are the ones that matter most.
Questions to ask any chatbot vendor about data privacy
A general, educational list that works with any vendor, not just Gental:
- Where are my data, documents and customer conversations stored: inside Saudi Arabia or outside?
- Is any data processed outside the Kingdom (for example by AI models)? What exactly is sent?
- Is my data used to train models? Is that written in the provider’s terms?
- How is my data kept apart from other customers’ data?
- Who on my team can see conversations? Are there roles and permissions?
- How long are conversations, files and recordings kept, and can I change or delete them?
- What happens when a customer sends an ID number, an IBAN or a medical report?
- How does the agent guard against instructions hidden in files or messages?
- Is the vendor actually certified, or “designed around” the law? Ask for the difference, not a badge.
This page is not legal advice
The information here is general and educational, and it does not replace a lawyer who knows your business. Gental is designed around the PDPL; it is not certified. Your own duties as a business, such as informing your customers and keeping your privacy policy, stay with you.
FAQ
Common questions
Is Gental PDPL compliant?
Gental is designed around Saudi Arabia’s PDPL: data is stored in the Kingdom and we collect only what is needed. It is not certified, and we don’t claim otherwise.
Where is chatbot data stored?
In Saudi Arabia, in Google Cloud’s me-central2 region in Dammam. To write an answer, the relevant passages are sent to the AI model provider for processing.
Are my conversations used to train AI?
No. We use models through commercial APIs that exclude your data from training.
Can one customer see another customer’s data?
No. Every workspace is isolated in the database, and customer files are read for that conversation only, never added to the knowledge library.
Can I delete recordings and files quickly?
Yes. In the privacy settings choose to delete voice recordings after transcription and customer files after reading, or keep them for 30 or 90 days.
Keep reading
- Arabic AI chatbotAn Arabic chatbot that understands dialects and Arabizi, and replies in the dialect you choose.
- Website chatbotAn AI chatbot for your website that answers from your knowledge, added with one line.
- Developers (API)Connect your agent to your app and systems with REST, streaming and signed webhooks.
- Voice notes and filesTranscribes voice notes and answers them, and reads the photos and files customers send.
- AI receptionist for clinicsAn AI receptionist that answers patients on services and insurance, never diagnosing.
- About GentalWho builds Gental, why it’s Arabic-first, and the principles we build on.
Meet your gentle agent
Build your first agent on your own documents today. Free to start.