How We Protect Your Information

TAWALI ("TAWALI AI", "we", "us", "our"), developed and operated by مؤسسة توالي النظم والمعلومات للتقنية الحديثة (registered on the Ministry of Commerce certificate as "tawali alnuzum walmalumat liltaqniyah alhadithah Establishment"), operates the TAWALI AI platform accessible at tawali-ai.com and associated subdomains. This Privacy Policy describes how we collect, process, use, and safeguard information in connection with your use of our platform and services. By accessing or using the TAWALI AI platform, you acknowledge that you have read and understood this Privacy Policy.

We may collect the following categories of information: • Technical Data: IP address, browser type and version, device type, operating system, access timestamps, and pages visited. • Usage Data: Navigation patterns, features accessed, session duration, and interaction data within the platform. • Communication Data: Information you voluntarily provide when contacting us via email, phone, or any contact form, including your name, email address, and the content of your communication. • Business Inquiry Data: Information provided in the context of investor, government, or partnership inquiries. TAWALI does not request sensitive personal data as a standalone category unless it is necessary and lawful to do so. However, data you choose to connect or make available through Connected Services — such as email content — may incidentally contain sensitive information. Where this occurs, such information is processed only within the scope of your authorization and the specific purpose of providing the relevant service, and subject to the protection and retention safeguards described in this Policy.

We use the information we collect for the following purposes: • To operate, maintain, and improve the TAWALI AI platform and its services • To respond to your inquiries, communications, and requests • To analyze usage patterns and optimize the user experience • To process and manage investor, government, or partnership inquiries • To comply with applicable legal obligations under Saudi law • To protect the security and integrity of our platform We process your information only for the purposes described above and do not use it for automated decision-making that produces significant legal effects without human review.

We retain information only for as long as necessary to fulfill the purposes for which it was collected: • Technical and usage data: Retained for a maximum of 12 months from collection, then deleted or anonymized. • Communication and inquiry data: Retained for as long as necessary to manage the relationship or fulfill our obligations, and deleted when no longer required. • Legal compliance data: Retained as required by applicable Saudi law and regulatory obligations. You may request deletion of your data at any time by contacting us at support@tawali-ai.com, subject to any overriding legal retention requirements.

We do not sell, rent, or trade your personal information to third parties. We may share information in the following limited circumstances: • Service Providers: Third-party vendors who assist in platform operations (hosting, analytics, security) under appropriate data processing agreements and confidentiality obligations. • Legal Requirements: When required to comply with applicable Saudi law, court orders, or legitimate requests from authorized government authorities. • Business Transfers: In the event of a merger, acquisition, or reorganization, information may be transferred as part of business assets, subject to equivalent privacy protections. • Protection of Rights: When necessary to protect the rights, property, or safety of TAWALI AI, its users, or the public. All third-party data sharing is conducted under terms that require the protection of your information.

This section applies specifically to your use of NURAI Gmail Intelligence, a feature that connects to your Google account with your explicit authorization. • Authorization: TAWALI accesses your Google/Gmail data only after you explicitly connect your Google account through Google's own consent screen and grant the specific permissions ("scopes") requested. TAWALI never accesses your Google account before you authorize it, and never requests more access than the feature you're using requires. • What NURAI Gmail Intelligence does: With your authorization, NURAI reads and analyzes your email to summarize what matters, prioritize important messages, surface tasks, deadlines, decisions, and risks, and prepare draft replies or new emails for your review. In the current release, Gmail sending is not activated for customers. NURAI may prepare drafts for your review, but TAWALI does not send Gmail messages on your behalf through the currently activated Gmail integration. • Categories of Google/Gmail data we process: message metadata (such as timestamps and labels); sender and recipient information where necessary to summarize or prioritize a message; subject lines and message content processed within bounded limits to generate summaries and drafts; and connection/authentication metadata needed to maintain your Google connection. • Data minimization: TAWALI does not create or maintain a full copy or mirror of your mailbox. Content derived from your Gmail is processed to produce bounded, normalized outputs (such as a summary or a draft) rather than stored as a raw replica of your email. • Retention: Provider-derived content connected to a specific Gmail operation (such as a stored summary or draft) is retained for a default period of 30 days. After the retention period ends, sensitive content is automatically removed or redacted in accordance with the applicable retention policy. Governance and audit data that does not contain message text (such as timestamps, status, and approval records) may be retained longer than the content itself, as described in this Policy. • How we use and share this data: We do not sell your Google user data. We do not use it for advertising. We do not use it to build unrelated profiles about you. We share it only with service providers who help us operate and secure the platform, under confidentiality and security obligations, and never for their own independent use. • Human access: Your Gmail data is not routinely accessed or viewed by TAWALI personnel. Limited engineering access to underlying systems may occur only where necessary for security, to comply with a legal obligation, or to provide support you have explicitly requested — and is subject to internal access controls. • Disconnecting and deletion: You can disconnect your Google account at any time from your TAWALI account settings. Disconnecting stops TAWALI from using that Google connection for future access. Previously derived content remains subject to the retention policy described above. You may request deletion of your account and associated data at any time by contacting support@tawali-ai.com. • Google API Services User Data Policy: TAWALI's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements.

We implement appropriate technical and organizational security measures to protect your information against unauthorized access, disclosure, alteration, or destruction. These measures include: • Secure data transmission protocols • Access controls limiting data access to authorized personnel • Regular review of our security practices While we apply industry-standard security practices, no method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security but are committed to protecting your information to the best of our ability.

Subject to applicable Saudi law, you have the following rights with respect to your personal information: • Access: Request a copy of the personal information we hold about you. • Correction: Request correction of inaccurate or incomplete information. • Deletion: Request deletion of your personal information, subject to legal retention requirements. • Restriction: Request that we restrict processing of your information in certain circumstances. • Objection: Object to processing of your information for specific purposes. To exercise any of these rights, please contact us at support@tawali-ai.com. We will respond to your request within a reasonable timeframe in accordance with applicable law.

This Privacy Policy is governed by and construed in accordance with the laws of the Kingdom of Saudi Arabia, including applicable data protection regulations. Any disputes arising from or relating to this Privacy Policy shall be subject to the exclusive jurisdiction of the competent courts of the Kingdom of Saudi Arabia.

We reserve the right to update this Privacy Policy at any time. When we make material changes, we will update the "Last Updated" date at the top of this page. Your continued use of the platform after any changes constitutes your acceptance of the updated Privacy Policy. We encourage you to review this policy periodically.