Privacy policy

Who we are

Powrx is an AI marketing-operations platform provided by Prof Business, Riyadh. Privacy contact: info@prof.business.

Our role

• For user account data (agencies and their teams) we are the controller.
• For data about an agency's clients and their customers (leads, conversations, ad results) we process on behalf of, and on the instructions of, the agency or client, who is the controller.

Data we process

• Account data: name, email, mobile number if you add it, role and permissions, sign-in records.
• Business data users enter or connect: website, plans, ad creative, campaigns and their results.
• Data about people who contact our customers: name, mobile, email, message content, ad source, and the record of their consent and its withdrawal.
• Connected accounts (Meta, Google, TikTok, Snapchat, Odoo, stores): access tokens, stored encrypted, and page/ad-account identifiers.
• Measurement events from customers' websites: personal identifiers are kept only with advertising consent, and only as SHA-256 hashes.

Purposes and legal bases

• Providing the service and performing the contract: accounts, plans, campaigns and reports.
• Consent: marketing messages to people and uploading audience lists; nothing of this happens without a recorded consent.
• Legitimate interest: answering people who message a business themselves; platform security and abuse prevention.
• Legal obligation: keeping consent and audit records where required.

Artificial intelligence

AI agents draft and analyse; people decide at four approval gates. We use Claude models by Anthropic and remove phone numbers and emails from text sent to the model whenever the task does not need them. Your data is not used to train public models.

Anonymised industry benchmarks

Every night we compute anonymised, aggregated benchmarks per industry and country (such as cost per lead, click-through rate and return on ad spend) from campaign results across agencies. A figure is published only when at least 5 agencies and 5 clients contribute to it. No raw data, names, texts or creatives ever leave an agency — only statistical ranges. An agency owner can opt out in the agency settings at any time; the agency's figures are then left out and it no longer sees the benchmarks.

Who we share it with (sub-processors)

• DigitalOcean — hosting, database and backups, London data centre (United Kingdom).
• Anthropic — AI processing (outside Saudi Arabia).
• Advertising and messaging platforms the customer connects (Meta incl. WhatsApp and Instagram, Google, TikTok, Snapchat): to create campaigns, measure conversions and answer messages, on the customer's instructions.
• The customer's own Odoo, when connected: to deliver leads and sales.
• An email provider, to send invitations and notifications.
• We do not sell personal data or share it for our own advertising.

International transfers

Data is currently stored in London and AI processing takes place outside Saudi Arabia. We apply the safeguards the PDPL requires: minimising data sent, encryption in transit and at rest, and processing agreements with providers. A move to an in-Kingdom data centre (Dammam) is planned; customers that require in-Kingdom data can ask for it.

Retention

• Account data: for the life of the account, deleted within 30 days of closure.
• Customer data: for the term of the contract; on termination it can be exported for 30 days and is then deleted with a deletion certificate.
• Consent and audit records: as long as needed to prove the consent or action, at most 5 years after the last interaction.
• Encrypted backups: 14 days.

Your rights

• Access your data and get a copy.
• Correct it, and ask for its deletion.
• Withdraw marketing consent at any time — for example by sending "STOP" (or «إيقاف») on WhatsApp; every message stops and you are removed from ad audiences.
• Object, or complain to the Saudi Data & AI Authority (SDAIA).
• To ask: write to info@prof.business; we answer within 30 days. If a business using the platform holds your data, we pass your request to it or carry it out on its instructions.

Security

Each agency's and client's data is isolated in the database, tokens and secrets are encrypted, users can enable two-factor sign-in, the audit log cannot be altered, and backups are encrypted. Incidents are notified to the authority and to those affected within the legal deadlines (72 hours).

Cookies and storage

The platform uses only the local storage needed to keep you signed in. Measurement tags that customers place on their own websites are covered by those websites' policies and consent tools.

Children

The platform is for businesses and is not directed at people under 18.

Changes

We may update this policy and will announce material changes in the platform before they take effect.