Privacy Policy

This policy explains how AcTree, the company identified at the foot of this page, handles personal data when you use actree.ai, the AcTree Portal, the hosted Console, the host agents, the mobile apps and our support channels. It is written to meet the Personal Data Protection Law of the Kingdom of Saudi Arabia (PDPL) and its regulations. For a self-hosted deployment, and for data the agents process on your hosts, your organisation decides what is collected and is the controller; we process it only on your instructions.

1. What we collect

Account and organisation data: name, work email address, organisation, role, preferred language and, if you give it, a phone number. If you sign in with Google we receive the email address and name of that account only.

Licensing and billing data: your plan, licence keys and registry credentials (stored as one-way hashes), invoices and payment records.

Hosted Console content: workspace settings, conversations with the assistant, approval requests and decisions, the inventory of enrolled hosts, the output of commands you run and the audit log of who did what.

Agent telemetry: hostname, platform, agent version, online state and the host facts the Console needs for governance. The agents send no file contents unless a command you approved returns them.

Website data: what you type into the contact and pilot forms (name, email, organisation, message), anti-abuse signals from Cloudflare Turnstile, campaign attribution and, only with your consent, analytics and advertising cookies. Questions you ask the site assistant are processed to answer them.

Technical logs: IP address, user agent, timestamps and request identifiers, kept for security and troubleshooting.

2. Why we use it and on what basis

To provide the Services under our agreement with you (accounts, licences, the Console, the agents, support). For our legitimate interests in keeping the Services secure, preventing abuse, and understanding how they are used, without profiling you. With your consent, for analytics and advertising cookies and for marketing messages, which you can withdraw at any time. To meet legal obligations such as tax and accounting rules.

3. AI processing

When you use the hosted model, your prompts and the outputs are sent to our inference service and from there to the model provider (DeepSeek models served through OpenRouter) to generate a response. If you bring your own model key, your requests go to the provider you chose under its terms. We do not use your prompts, outputs or content to train models. The assistant on this website runs on Cloudflare Workers AI.

4. Where data is processed

The Portal, the hosted Console and our database run in Saudi Arabia (Alibaba Cloud, Riyadh region). Cloudflare provides the website edge, DNS, tunnels and Turnstile and may process technical data outside the Kingdom; Microsoft 365 sends our transactional email; OpenRouter processes model requests outside the Kingdom; GitHub distributes our software releases. Transfers outside the Kingdom happen only where the PDPL permits them and with the safeguards it requires. We keep a list of these processors and share it on request.

5. Sharing

We share personal data only with the processors above, with authorities where the law requires, and in a merger or sale of the business under the same protections. We do not sell personal data.

6. Retention

Account and organisation data: for the life of the account and twelve months after. Audit logs: twelve months. Database backups: seven days. Leads from the website: twenty-four months. Cookies: as long as your consent settings say. We delete data earlier on your request, except what the law requires us to keep.

7. Security

Data is encrypted in transit; secrets are encrypted at rest; actions on hosts pass approval gates; access follows least privilege; releases are signed so you can verify them. If a security incident affects your personal data we inform you and, where required, the competent authority without undue delay.

8. Your rights

Under the PDPL you may ask to access your personal data, correct it, delete it, restrict its processing, receive a copy in a readable format, withdraw a consent you gave and object to marketing. Write to us at the address below; we answer within thirty days. You may also complain to the Saudi Data and AI Authority (SDAIA).

9. Cookies

Only necessary cookies load by default. Analytics and advertising cookies load only after you accept them, and you can change your choice at any time under Cookie settings in the footer. The product privacy page describes exactly which tags this site configures.

10. Children

The Services are for organisations and their staff and are not directed at anyone under eighteen.

11. Changes

We publish changes to this policy here with the date above and tell you about material changes through the Portal or by email.