Privacy Policy

Who we are

The tools platform (Malvet) is operated by Malvet Establishment, a sole establishment, referred to in this policy as the "Controller", "we", or "us". The Controller is the party that determines the purposes and means of processing your personal data.

• Unified National Number: 7050490098
• Commercial Registration number: 7050490098
• National Address: Building 4899, Jabal Khiraz Street, East Umm Al Hamam District, Riyadh 12323, Kingdom of Saudi Arabia (short code RGUA4899)
• Data protection contact: privacy@ml-technologies.net

This policy explains what personal data we collect about you, why we collect it, the lawful basis for each purpose, who receives it, where it is processed, how long we keep it, and your rights under the Personal Data Protection Law of the Kingdom of Saudi Arabia (PDPL) and its Implementing Regulations. We comply with the PDPL, in particular the notice obligation in Article 12 of the Law and Article 11 of the Implementing Regulations.

What we process, why, and on what basis

We process your personal data for specific purposes, and each purpose has its own lawful basis. We do not process your data for any other purpose without notifying you or obtaining your consent where required.

1. Account creation and authentication

• Data: your email address, your account identifier, and the sign-in information managed by the central identity provider. We do not hold your password; authentication happens at that provider.
• Lawful basis: performance of a contract. We cannot provide you an account or save your results without processing this data.
• Providing it: your email is required to hold an account and to save your results; without it we cannot create or maintain your account.

2. Running the tools and processing the documents you upload

• Data: the files, documents, and text you upload to run a tool, and the outputs they produce.
• Lawful basis: performance of a contract. Processing what you upload is the very service you requested.
• Where your content goes: the tools that only rearrange or convert a file (for example merging, splitting, or compressing a PDF) run on our own systems. The AI-powered tools (summarizing or translating a document, and the Arabic text tools) are different: the text you enter and the text extracted from a document you submit are sent for processing to a third-party AI provider located outside the Kingdom (see "Who receives your data" and "Transfer outside the Kingdom" below).
• Automated safety screening (AI-powered tools only): before an AI-powered tool processes your content, that content is first sent to an automated third-party safety model to be checked against categories of prohibited content. For a document, a sample of up to 15,000 characters, drawn from its beginning, middle, and end, is screened; for the text tools, the text you submitted is screened. This screening runs for the AI-powered tools only; the tools that merely rearrange or convert a file do not send your content to it.
• Providing it: providing content is required to run a tool (a tool cannot produce an output without the input you give it), but you choose what, if anything, to upload, and the free tools can be used without an account.

3. Payments and top-ups

• Data: your purchase and top-up history, amounts, references, and the receipts issued for them. Card details are processed by the payment provider; we neither see your full card number nor store it.
• Lawful basis: performance of a contract and legal obligation. We retain transaction records to meet our accounting and statutory obligations.
• Providing it: this is required only if you choose to top up a paid balance; you can use the free tools without it.

4. Security and anti-abuse

• Data: your IP address, human-verification signals (from an automated bot-detection check), and rate-limit counters that prevent excessive use and automated attacks.
• Lawful basis: legitimate interest. Protecting the service and its users from fraud and abuse is an interest not overridden by your rights and freedoms.
• Providing it: this is collected automatically as part of using the service and is necessary to protect it; it cannot be switched off while you use the service.

5. Error diagnostics

• Data: technical error reports (error type, path, and context data stripped of personal identifiers) sent to our error-tracking system.
• Lawful basis: legitimate interest (detecting and fixing faults to keep the service reliable). We scrub these reports of personal data before they are sent.
• Providing it: these reports are generated automatically only when a fault occurs, are stripped of personal identifiers, and are necessary to run a reliable service.

6. Product analytics

• Data: anonymised or limited-identifier usage signals (such as pages visited and tool-run events), without passing identifying data to them.
• Lawful basis: consent. Product analytics are opt-in and run only with your explicit consent through the consent banner; without it, they do not load at all.
• Providing it: this is optional. Refusing it changes nothing about the tools or your ability to use the service.

Who receives your data: recipients

We do not sell your personal data. Your personal data is processed on our behalf and under our instructions by a limited set of service providers. These fall into the following categories, including:

• a cloud hosting, edge-network, and object-storage provider: front-end hosting, storage of the files you upload, and automated visitor bot-verification, operating over a global edge network;
• a hosting and database provider located in the European Union: origin compute and the database;
• providers of AI text and document processing, located outside the Kingdom: running the AI-powered tools and the automated safety screening described above; this is where the text you enter, the contents extracted from a document you submit to those tools, and the safety-screening sample are processed;
• a speech-to-text (transcription) provider, located outside the Kingdom: running the audio-transcription tool; the audio recording you upload is transferred to it to be transcribed;
• a payment-processing provider: card and mada payment processing for top-ups;
• an email-delivery provider: transactional email such as receipts and account notices;
• an sms-delivery provider: the phone number you enter and a share link for the saved document, sent by text message when you request to send a saved result to a phone;
• product-analytics providers located outside the Kingdom: usage measurement that is opt-in, running only after you grant consent.

Our error-tracking system is self-hosted on our own infrastructure (with personal identifiers scrubbed before an error is recorded) and is not a third-party recipient.

Transfer outside the Kingdom

Some of your personal data is processed outside the Kingdom of Saudi Arabia: origin compute and the database run with a hosting provider in the European Union; our cloud hosting and edge services operate over a global edge network; the AI-powered tools and their automated safety screening are provided by AI-processing providers located outside the Kingdom, to which the text you enter and the contents extracted from a document you submit to those tools are transferred for processing; the audio recording you upload to the audio-transcription tool is transferred to a speech-to-text provider located outside the Kingdom to be transcribed; and, when product analytics are activated, the product-analytics providers will process data outside the Kingdom.

Where we transfer your personal data outside the Kingdom, we do so under the conditions the Personal Data Protection Law and its Implementing Regulations permit for transfers outside the Kingdom.

Retention

We keep your data for as long as is necessary to fulfill the purpose it was collected for, then delete or anonymise it:

Category	Retention
Files you upload and tool outputs (unsaved)	6 hours, then automatically deleted by a recurring job that runs every 15 minutes
Results you save to your history (when signed in)	Kept until you delete them
Counts of how many times you used each tool (per day, when signed in)	90 days, then automatically deleted
Anonymous tool-use totals, not linked to you or to any identifier	Kept indefinitely as aggregate statistics
Product-analytics click and heatmap data (when active)	13 months (session replay is kept for 30 days)
Account and authentication records	For as long as your account remains active
Transaction records and receipts	For the period our accounting and statutory obligations require
Email delivery metadata held by the email-delivery provider (the sender and recipient address, the message subject line, and delivery events)	Retained by that provider outside our direct control. The query windows it publishes (up to 30 days, and up to 60 days in aggregate) are query windows, not deletion guarantees, and it documents no procedure to delete this metadata.
Error reports (stripped of identifiers)	For a limited period sufficient to diagnose and fix the fault

Your rights

Article 4 of the PDPL grants you the following five rights in your personal data:

• The right to be informed: to know how your personal data is collected and processed, and the legal basis for it (which this policy provides).
• The right to access your personal data held by us.
• The right to obtain your personal data in a readable, clear format. On request we provide it in a commonly used electronic format, and a printed copy where you ask for one (Article 6 of the Implementing Regulations).
• The right to correction: to have your personal data corrected, completed, or updated.
• The right to destruction: to have your personal data destroyed once it is no longer needed for the purpose it was collected for.

One limit we state plainly: when we destroy your personal data we delete our own copies, but we cannot delete the delivery metadata (including the message subject line) that the email-delivery provider retains (described in the retention table above); and where an email to you has hard-bounced, a suppression-list entry for your address is kept by that provider until it is removed and does not expire on its own.

To exercise any of these rights, contact us at privacy@ml-technologies.net. We respond to your request within the statutory period. Withdrawing a consent you have given is covered under "Withdrawing consent" below.

Withdrawing consent

Where processing is based on your consent (product analytics), you can withdraw it at any time, as easily as you gave it (Article 5(2) of the Law and Article 12 of the Implementing Regulations), from the privacy settings page, without affecting the lawfulness of processing before the withdrawal.

Website analytics

We measure how this website is used with two analytics services: Google Analytics 4 and Microsoft Clarity. These services load only after you grant consent through the consent banner. Once loaded, they use first-party cookies stored in your browser (the _ga cookie for Google Analytics 4 and the _clck and _clsk cookies for Clarity) to measure which pages and tools are used. If you decline in the banner, or withdraw consent later, none of these services loads, no cookie is set, and no measurement is sent. Your consent decision is stored in your browser's local storage (under the key mlt_consent) and is kept until you withdraw it, or until we ask you to choose again after a material change to this policy. You can grant or withdraw consent at any time from the privacy settings page. The measurement data itself is kept for the periods listed in the retention table above.

Changes to this policy

We may update this policy from time to time. When we make a material change, we update the "Last updated" date and version number at the top of the page, and we may notify you by email or through an in-platform notice. Your continued use of the service after an update takes effect constitutes your awareness of it.