Ledger GRC Privacy Policy

Information Ledger GRC keeps

The only personal information requested from a user is:

• name; and
• email address.

When you use Ledger GRC, the service also creates and stores the information needed for it to work:

• your account role, account status, sign-in and security status;
• your chat titles, questions, answers, citations, and timestamps;
• your privacy choice and any response feedback you submit; and
• limited technical and audit records needed to secure, troubleshoot, and operate the private beta.

Ledger GRC does not request payment-card information, government identification, precise location, health information, or advertising-profile data. Users should not enter personal, confidential, or classified information into chat questions.

Why this information is used

This information is used only to:

• provide and secure your private-beta account;
• save conversation history and provide source-backed answers;
• operate, troubleshoot, and protect Ledger GRC;
• manage access and regulatory source documents; and
• improve answer quality where you have allowed review or submitted feedback.

Ledger GRC does not sell personal data and does not use it for advertising.

Legal basis

Account and chat information is processed to provide the private-beta service you agreed to use. Limited security and audit records are processed for the legitimate interest of protecting the service and its users. Optional quality review is based on your consent, which you may withdraw at any time.

Chat privacy and optional review

Your chats are stored so conversation history works. Administrators normally see only the limited account and technical details needed to operate and secure the service—not the full text of your chats.

An administrator may review chat content when:

• you allow optional quality-improvement review in Manage Account; or
• you submit feedback on a particular answer, which shares that question, answer, and your feedback for review.

You may decline or withdraw optional quality review without losing access to Ledger GRC. Withdrawal stops future review under that permission but cannot undo a review already completed.

Service providers

Ledger GRC uses:

• Supabase for accounts, database, and file storage;
• Netlify for application hosting and server functions; and
• a configured AI provider to create embeddings and answers.

To answer a question, Ledger GRC sends the AI provider the question, relevant conversation context, instructions, and retrieved regulatory excerpts. Your name and email are not intentionally included in that request. Other information is sent to these providers only as needed to operate Ledger GRC. Because they may operate outside Saudi Arabia, information may be processed internationally subject to applicable Saudi data-protection requirements.

Retention and deletion

Account details and chat history are kept while your account and the private beta remain active because they support access, history, security, and audit functions. The current system may preserve an email address, chat history, and limited audit records after account access ends so the security and GRC audit trail remains intact. They are kept only while needed for that purpose or a legal requirement.

Requests for access, correction, a copy, or deletion are handled manually through adnanaiworks@gmail.com. Identity may be verified before a request is completed. A deletion request may be limited where retention is legally permitted or required, and the reason will be explained.

Your rights

Subject to the Saudi Personal Data Protection Law and its applicable exceptions, you may request to:

• be informed about how your personal data is used;
• access it and receive a readable copy;
• correct, complete, or update it;
• have it destroyed when the legal conditions are met; or
• withdraw consent where processing depends on consent.

You may also submit a complaint to the competent Saudi data-protection authority. Applicable requests will be handled within the period required by Saudi law.

Security

Ledger GRC uses authenticated access, role restrictions, multi-factor authentication for administrators, audit records, and encrypted network connections. No online service can guarantee absolute security. Suspected unauthorized access should be reported to adnanaiworks@gmail.com.

Cookies and browser storage

Ledger GRC uses only essential session and preference storage needed for sign-in, security, and the interface. The reviewed application does not use advertising or behavioral-analytics tracking.

Changes

This policy may be updated if Ledger GRC’s features, providers, or legal obligations change. Material changes will be shown through the application or another appropriate channel.

Official references

• Saudi Personal Data Protection Law — SDAIA
• Implementing Regulation — SDAIA Data Governance Platform

This policy is written for the current private beta and should be reviewed if the service opens publicly, begins charging users, or starts collecting additional personal information.