Privacy Policy
Last updated: September 2026
This is a first-draft policy prepared to unblock launch. It honestly describes our actual practices, but it has not yet been reviewed by Saudi-licensed legal counsel. In particular, final data-hosting location and registering the company as a "data controller" with the Saudi Data & AI Authority (SDAIA) are still open. Don't treat this platform as fully commercially launched until those two items are closed with licensed counsel.
1. Who we are
Sketch Design ("we", "us") is a platform that pairs specialist AI agents with mandatory review by licensed engineers. This policy explains what data we collect, how we use it, and who can access it.
2. Data we collect
- Account data: full name, email address, organization name, and your role within it.
- Engineering project content: the briefs you write, the known facts you provide, and any files/drawings you upload for analysis.
- Usage and audit data: who performed a sensitive action, and when (the audit log).
- AI execution metadata: which agent ran and which model provider handled it — not the raw conversation content in our metrics tables.
3. How we use your data
We use your data to run the service: analyzing your brief through the right specialist agent, routing the resulting draft to a licensed engineer for review before any delivery, and keeping a full audit trail of every review decision. We do not sell your data to third parties.
4. AI processing
When you run an agent, your brief and the relevant known facts are sent to an AI model provider configured for your organization (e.g. Anthropic) to produce a draft. That draft is never treated as a final output — a licensed engineer must approve it before any use or delivery. Your data is not used to train general-purpose AI models.
5. Where your data is hosted
Your database is hosted on the server our organization chooses; that server's final geographic location has not been locked in yet. When you run an agent, your brief is processed through one of two provider types: (a) a self-hosted open-source model (Ollama) running on that same server — in this case your data never leaves the server at all; or (b) a configured cloud provider (e.g. Anthropic), which processes data on its own servers outside Saudi Arabia. Any client organization can see which provider is active for it from the Control Center. This section will be updated with the exact final hosting location once it's locked in, and with legal counsel's confirmation on cross-border data-transfer requirements under the Saudi Personal Data Protection Law (PDPL) if option (b) is used.
6. Data retention
No data is deleted automatically. An organization's owner or admin can request deletion of their organization's data through the email below.
7. Your rights
You can request access to, correction of, or deletion of your data by contacting us at the email below.
8. Contact us
For any privacy question: privacy@sketchit.net