Privacy Policy

01Data Controller

The controller of your data is Bennahub — a Saudi B2B specification, supplier-discovery, and RFQ platform for building materials and finishing products, Kingdom of Saudi Arabia.

For any query or request regarding your data, contact: privacy@bennahub.com.

02Data We Collect

We collect only what we need to operate a B2B specification and RFQ platform:

• Account & contact data: name, job title, company/organization name, email, mobile/WhatsApp number.
• Supplier data: company and brand information, products, catalogues, images, technical files, certificates, indicative pricing (if provided).
• Buyer & project data: project context, specification lists, RFQ details.
• AI-assistance data: assistant messages you choose to send, memory you confirm, BOQ/quote files or free-text need descriptions when you use extraction or structuring, and the consent records you grant or withdraw.
• Usage & technical data: login logs, pages visited, IP address, browser/device type, and cookies.

03Purposes & Legal Basis

We process your data for the following purposes:

We do not make solely automated decisions producing legal effects on you without human involvement. AI outputs are drafts or findings for your review; sending, awarding, or revealing contacts still requires your confirmation.

04Sharing & Disclosure

• We do not sell your personal data.
• We do not share supplier or buyer data, product-interest signals, pricing, or project information with any external or related business outside the Bennahub workflow. Access is role-based and internal, applied with particular care in any overlapping product category.
• We share data only with external processors providing operational services (hosting, database, email delivery, and — when you use optional AI features — OpenAI), and solely for the stated purposes. We do not claim that a signed OpenAI data-processing addendum or another contractual transfer instrument has been verified as executed on our account.
• We may disclose where required by a legal obligation or a request from a competent authority.

05Cross-Border Transfer

Some of our technical service providers may process data outside the Kingdom. When you use optional AI features, the content is processed by OpenAI outside Saudi Arabia. Where personal data is transferred abroad, we apply the transfer controls under the PDPL, its Implementing Regulations, and the Transfer Regulation, limited to what is needed, with visible contact details redacted where the current redaction contract applies. We do not claim that the destination country has been listed by the Competent Authority as providing an adequate level of protection. The transfer assessment is kept internally; a summary can be requested at privacy@bennahub.com.

06AI-assisted processing

Bennahub offers optional AI assistance to help organize specifications, RFQs, and quotes. The assistant is not an autonomous decision-maker. You review any draft or finding and confirm it before it becomes an RFQ, quote, award, or contact disclosure.

If you choose these features, Bennahub sends the minimum content needed to an external processor, OpenAI, to prepare a structured result. This involves transferring and processing that content outside Saudi Arabia.

• Buyer assistant: conversation text you send, memory you confirm, attachment metadata, and the minimum authorized project, RFQ, or quote records for your account.
• Text intake: the free-text need description, to split and classify line items. If you attach an image to the conversation, the image content itself is sent as well, so it can be read alongside your description. When a factual point materially needs checking — for example whether a maker actually produces a product — a short query derived from your description may also be used to look it up on the web through that same provider.
• BOQ extract and classify: file content when ordinary automated reading is not enough.
• Quote extract and compare: supplier quote-file content or structured lines, after the supplier’s recorded consent for that invitation. Comparison shows differences for review and never awards automatically.
• Khaled (public assistant): visitor messages in the public chat, after visible contact details are redacted.

Visible contact details (email addresses, phone numbers, and links) are redacted from the transmitted copy where the current redaction contract applies. Organizational, project, or commercial content may still be included when needed for the feature. Buyer consent alone does not authorize sending supplier-owned quote content.

OpenAI processes this content as a processor to provide the API service. OpenAI’s published API terms state that API customer content is not used to train its models by default. OpenAI may retain API inputs and outputs for abuse monitoring, typically for up to 30 days, unless a stricter retention control is enabled on our account. We do not promise that the provider retains nothing.

Bennahub stores conversations, memory, extraction drafts, consent records, and operational audit/spend metadata in its own systems. Deleting a conversation or memory in the product removes it from the assistant workspace. Consent and required audit records are kept as evidence. Account deletion follows the existing account-deletion journey (identity anonymization, subject to legal or active-deal blockers) and does not necessarily delete assistant text immediately.

The buyer assistant, BOQ extract/classify, and quote extract/compare require your recorded consent at the current consent-text version. Text intake does not require a separate recorded consent; this Policy and the Terms are its notice. Khaled is a public chat; this Policy is the notice, and no logged-in consent row is created for it. You may decline or withdraw. Withdrawal stops future provider processing for that consent scope. It does not undo completed processing and does not delete records that the law or audit integrity requires us to keep. Declining or withdrawing does not block the rest of the Platform.

07Retention

We retain your data while your account is active, then for the period necessary for operational, legal, accounting, and attribution-record purposes, up to 24 months after last activity, unless the law requires otherwise. Thereafter it is deleted or anonymized.

Assistant conversations and memory remain until you delete them in the product, subject to the retention windows shown there. Account deletion anonymizes the account under the current journey and does not necessarily delete assistant text immediately. Consent, audit, and AI spend records are kept as evidence. OpenAI retention is separate and is typically up to 30 days for abuse monitoring unless a stricter control is proven for our account.

08Your Rights Under the PDPL

You have the right to: be informed of how your data is processed; access it and obtain a copy; correct or update it; request deletion where retention is no longer justified; and withdraw consent at any time without retroactive effect. You may withdraw supplier quote-file consent from the quote-upload screen. To withdraw assistant or other AI consents, write to privacy@bennahub.com.

To exercise any right, contact privacy@bennahub.com. We respond within the statutory period, and you may file a complaint with SDAIA.

09Data Security

We apply technical and organizational controls to protect your data, including role-based access control and access separation that prevents any external related party from viewing supplier or buyer market signals.

10Cookies

We use cookies essential to operate the Platform and analytical cookies to improve performance. You can control these via your browser settings.

11Changes to This Policy

We may update this Policy and will post the updated version here with the revision date. Continued use after an update means you have reviewed it.

12Authority & Governing Law

This Policy is governed by the laws of the Kingdom of Saudi Arabia, in particular the PDPL and its Implementing Regulations, supervised by the Saudi Data & AI Authority (SDAIA).

13Contact

privacy@bennahub.com · www.bennahub.com