Privacy Policy

Version 1.0
Last updated: 16 September 2026

1. Who we are and what this covers

Absher builds Khaleeji Arabic voice AI agents that answer calls and messages for enterprises, carry out the resulting task such as booking an appointment or updating a CRM record, and escalate to a human when needed.

This Privacy Policy is issued by [LEGAL ENTITY NAME], a company registered in Tunisia under commercial register number [RC NUMBER], with its registered office at [REGISTERED ADDRESS] ("Absher", "we", "us" or "our").

It covers two very different things, and the difference matters for your rights:

• Our website. Everything you do on absher-ai.com, including joining a waiting list, contacting us, applying for a job and reading our articles. Here we decide why and how your data is used, so we are the controller.
• Our voice service. Calls and messages handled by an Absher agent deployed by one of our business customers, such as a bank, a telecom operator or a contact centre. Here our customer decides why and how your data is used, and we act on their instructions, so we are the processor and they are the controller.

If an Absher agent handled your call and you want to exercise your rights, contact the organisation you called. They are responsible for your data. We will support them in responding, and section 13 explains how to reach us if you cannot reach them.

2. Personal data we collect through the website

When you join the waiting list or contact us. Your name, work email address, company, role, country, telephone number if you give one, and whatever you write in the message. We also record when you submitted it.

When you request or attend a demonstration. The above, plus notes about what you are trying to solve, and, if you interact with a demonstration agent, the audio and transcript of that interaction.

When you simply browse. Your IP address, approximate location derived from it, device and browser type, the pages you viewed, how you arrived and how long you stayed. Some of this comes from cookies, which our Cookie Policy describes in detail, and analytics data is only collected if you consent.

When you apply for a role. Your CV and anything you send with it.

We do not ask for payment card details, government identifiers, health data or religious or political information through the website. Please do not send them to us.

3. Why we use website data, and our legal basis

• To respond to you and manage the waiting list. Basis: taking steps at your request before entering a contract, and our legitimate interest in running our business.
• To tell you when Absher becomes available, and to send occasional updates about the product. Basis: your consent, which you can withdraw at any time. Every message carries an unsubscribe link.
• To operate, secure and improve the website, and prevent abuse of our forms. Basis: our legitimate interest in a working, secure website.
• To measure how the website is used. Basis: your consent, given through the cookie banner.
• To consider your job application. Basis: steps before a contract, and our legitimate interest in recruiting.
• To comply with law, and to establish or defend legal claims. Basis: legal obligation, and legitimate interest.

Joining the waiting list does not guarantee access to Absher, and we explain that in our Terms of Use.

4. Personal data we process through the voice service

When a business customer deploys an Absher agent, we process, strictly on their documented instructions:

• Call audio for the duration of the call, and a recording where our customer has enabled recording;
• Transcripts produced from that audio, in Arabic, English or both;
• Caller identifiers such as the telephone number, account or reference number, and any identifier our customer passes to us;
• The content of the conversation, including anything the caller chooses to say;
• Outcome and metadata: what the agent did, what it wrote back to our customer's CRM or booking system, call duration, timestamps, language detected, whether the call was escalated to a human.

The same applies to messages handled over web chat, WhatsApp, Instagram or a mobile application.

We do not decide what these agents are used for, which callers they speak to, what questions they ask, or how long our customer keeps the results. Our customer decides all of that.

5. Voice recordings, and whether they are biometric data

We take this seriously because a voice is personal in a way that a form field is not.

We use speech recognition to work out what was said. We do not use voiceprints to work out who is speaking, and we do not offer voice biometric identification or verification. On that basis, and provided our customer does not configure the service otherwise, voice data we process is not biometric data for the purposes of the GDPR, and is not processed as sensitive data under the Saudi Personal Data Protection Law on biometric grounds.

A conversation can still contain sensitive information, for example about someone's health or finances, simply because the caller said it. We treat all call content as confidential, apply the security measures in section 11 to it, and never use it to build a profile of a caller for our own purposes.

Telling callers they are speaking to an AI. Absher agents disclose that they are an automated system at the start of the interaction. We require our customers to keep that disclosure switched on, and to give callers a way to reach a human. This reflects both good practice and the transparency obligations in the EU Artificial Intelligence Act that apply to AI systems interacting with people.

Call recording consent. Where the law requires callers to be told about or to consent to recording, our customer is responsible for giving that notice and collecting that consent, because they control the call. We give them the configuration needed to do it.

6. Using data to improve our models

Our ability to understand Khaleeji Arabic improves when we learn from real conversations. We are direct about how that works.

Website data. We do not use your waiting list entry, your message to us or your CV to train models.

Customer conversations. By default we do not use our customers' call audio, transcripts or conversation content to train, fine tune or improve our models or anyone else's. We use them only to deliver the service to that customer.

A customer may separately and expressly opt in, in a signed order form or pilot agreement, to let us use their conversation data to improve our models.

Two consents have to be in place, not one. The organisation has to opt in contractually, and it has to have told you and obtained your consent, where the law requires it, for your conversation to be used this way. A contract between us and them cannot create your consent. If either is missing, the data is not used for improvement. We ask each customer to re-confirm the opt in at every renewal, so it does not quietly persist after the basis for it has gone.

Where a customer opts in:

• the data is de-identified before it enters any training set, by removing direct identifiers such as names, telephone numbers, account numbers and addresses;
• it is used to improve speech recognition, language understanding and speech synthesis for Arabic, and not for any unrelated purpose;
• we do not use it to train models for that customer's competitors in a way that would expose the customer's own information;
• the customer may withdraw the opt in at any time, which stops further use immediately, though it cannot always reverse training already completed;
• if you withdraw your consent, tell the organisation you spoke to. They will tell us, and we stop using your data and remove it from any training set not yet used;
• we never knowingly include special category or sensitive data in a training set.

If you spoke to an Absher agent and want to know whether that organisation opted in, ask them, and they can tell you.

7. Automated decisions

Absher agents carry out tasks such as answering a question, making a booking or routing a call. They are not designed to make decisions that produce legal effects for you or similarly significantly affect you, such as granting credit, deciding a claim or terminating a service. If one of our customers configures an agent to do something like that, they are responsible for the safeguards the law requires, including your right to obtain human intervention.

You can always ask an Absher agent to transfer you to a human.

8. Who we share data with

We do not sell personal data, and we do not share it for advertising.

We use a small number of suppliers who process data on our behalf under written contracts that oblige them to protect it and to act only on our instructions. They fall into these categories:

• Cloud hosting and storage for the platform and the website;
• Telephony and messaging carriers, to connect calls and deliver messages;
• Speech and language model providers, where we use a third party component to transcribe or generate speech. Where we do, we contract on terms that prohibit the provider from using our customers' content to train their own models;
• Analytics, email delivery and anti-abuse providers for the website;
• Professional advisers, such as our accountants and lawyers.

We maintain a current list of the sub-processors used in the voice service, and business customers can request it and are notified before we add a new one, as set out in our Service Terms.

We may also disclose data where we are legally required to, to a competent authority acting within its powers, or to protect our rights, our users or the public. Where we are permitted to tell our customer about such a request, we will.

9. Where data is stored

We host the voice service in the region our customer selects. For customers in Saudi Arabia we offer hosting inside the Kingdom, and we can commit to keeping call content there where our customer requires it.

Our own team works from Tunisia and the European Union, so our staff may access data from those countries for support and maintenance under confidentiality obligations and role based access control.

10. International transfers

Where the Saudi Personal Data Protection Law applies, we transfer personal data outside the Kingdom only on a basis that law permits, and we apply the safeguards required by its implementing regulations. Where a customer requires data to remain in the Kingdom, we configure the service accordingly.

Where the GDPR applies, we transfer personal data outside the European Economic Area only where there is an adequacy decision, or under the European Commission's Standard Contractual Clauses combined with a transfer risk assessment and, where needed, additional technical measures such as encryption.

You can ask us for a copy of the relevant safeguard by writing to contact@absher-ai.com.

11. Security

We protect personal data with measures appropriate to the risk, including encryption in transit and at rest, role based access control and least privilege, segregation of customer environments, logging and monitoring of access to call content, background screening of staff with access to production systems, confidentiality obligations for everyone on the team, and a documented process for handling security incidents.

If a personal data breach occurs, we notify affected business customers without undue delay so that they can meet their own notification duties, and we notify regulators and individuals where the law requires us to.

No system is perfectly secure. Please do not send sensitive information to us by ordinary email.

12. How long we keep data

• Waiting list entries: until we launch and contact you, or until you ask us to remove you, and in any event no longer than 24 months after your last interaction with us.
• Enquiries and demonstration requests: up to 24 months after our last contact.
• Job applications: up to 12 months after the process ends, unless you agree we may keep them longer.
• Website analytics: up to 14 months.
• Call audio, transcripts and outcomes: for the period our business customer instructs. We delete or return them at the end of the contract, subject to any retention the law requires of us.
• Accounting and tax records: for the period required by applicable law.

13. Your rights

Depending on where you are and which law applies, you have some or all of the following rights: to be told what we hold about you and to get a copy of it; to have inaccurate data corrected; to have data deleted; to restrict or object to how we use it, including objecting to direct marketing at any time; to receive your data in a portable format; and to withdraw consent you have given, without affecting what we did before you withdrew it.

Under the Saudi Personal Data Protection Law you also have the right to be informed, to access, to request a copy, to correction and to destruction of your personal data.

To exercise any of these, write to contact@absher-ai.com. We respond within 30 days, and we will tell you if we need longer. We may ask for enough information to confirm who you are, and we will not charge you unless a request is manifestly unfounded or excessive.

If your request is about a call you made to a company. Send it to that company. They are the controller and they can act on it. If you do not know who to contact, write to us and we will point you to them.

Complaints. Please raise it with us first so we can put it right. You can also complain to a regulator:

• in Saudi Arabia, the Saudi Data and Artificial Intelligence Authority (SDAIA);
• in the European Union, your national data protection supervisory authority;
• in Tunisia, the Instance Nationale de Protection des Données Personnelles (INPDP).

14. Children

The website is intended for business users and is not directed at children. We do not knowingly collect personal data from children through it. Where an Absher agent is deployed in a setting in which children may call, our business customer is responsible for the safeguards and consents that setting requires.

15. Changes to this policy

We may update this policy as the product and the law develop. The version published here is the one that applies, and the date at the top shows when it last changed. Where a change materially affects you we will take reasonable steps to tell you, and where the law requires it we will ask for your consent again.

16. Contact

Privacy questions, data rights requests and everything else: contact@absher-ai.com

[LEGAL ENTITY NAME]
[REGISTERED ADDRESS]