1. Scope and Consent

This policy applies to the Naqlio website (naqlio.ai), the Naqlio platform, subscriptions, and the Naqlio AI Assistant. Where you provide us with information about other individuals, you must have authority to do so and must make available to them the information contained in this Privacy Policy.

2. Information You Provide

We collect information you provide directly, such as:

• Contact and demo requests: first and last name, work email, company name, job title, fleet size, monthly shipment volume, and any message you send through the "Request a Demo" or contact forms.
• Account and service information: company and billing details, authorized user names, and credentials needed to operate your Naqlio account.
• Support communications: details you share when contacting support, including issue descriptions and correspondence.

We use this information to respond to your requests, operate your account, provide the services, and follow up about Naqlio products and services. We do not sell this information.

3. Information We Collect Automatically

When you use the Naqlio website or platform, we and our service providers may collect technical and usage information, such as IP address, browser type, device information, pages visited, feature usage, and operational logs. This information helps us operate, secure, and improve the services.

We do not use advertising or cross-site tracking cookies on this website. If we introduce cookies or analytics tools in the future, we will update this policy with a description of those technologies and how to control them.

4. Information From Third Parties

We may receive information from partners and service providers, including carrier and delivery partners, payment providers, and the AI assistant platforms you choose to connect to your Naqlio account. Where we receive information about you from others, we treat it in accordance with this policy and applicable law.

5. How We Use Information

We use the information we collect to:

• Provide, operate, and maintain the Naqlio platform and its services, including shipment allocation, route optimization, demand forecasting, and fleet management;
• Process contact, demo, and sales requests;
• Provide customer support and respond to inquiries;
• Secure the services and prevent fraud, misuse, and unauthorized access;
• Comply with legal, regulatory, and contractual obligations;
• Improve and develop products and services, and communicate relevant updates.

6. Legal Bases for Processing

We process personal information on the grounds permitted under the Saudi Personal Data Protection Law (PDPL) and applicable law, including where processing is necessary to perform a contract with you, to comply with a legal obligation, to protect your vital interests, or is based on your consent or on our legitimate interests. Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

7. Cookies and Similar Technologies

This website does not currently set advertising or analytics cookies. Where the website or platform stores local preferences (for example, your language choice), such information stays on your device and is used only to personalize the experience. If we later use cookies or similar technologies, we will describe them here and provide applicable controls.

8. How We Share Information

We share information only as described in this policy and in line with applicable law:

• Service providers: vendors that help operate the platform, such as hosting, infrastructure, security, payment, and support providers, under contractual obligations of confidentiality and data protection;
• AI assistant platforms you connect: see the "Naqlio AI Assistant" and "AI Assistant Platforms" sections below;
• Business transactions: if we are involved in a merger, sale, or reorganization, information may be transferred subject to obligations of confidentiality and this policy;
• Legal and regulatory: courts, regulators, and public authorities where required or permitted by Saudi law or where necessary to protect our rights.

We do not sell personal information. We do not share personal information with third parties for their independent marketing without your consent.

9. International Data Transfers

Some service providers and AI assistant platforms may process information on infrastructure located outside the Kingdom of Saudi Arabia. Where personal information is transferred outside the Kingdom, we apply safeguards consistent with the PDPL and applicable law, and we design the Naqlio AI Assistant so that model-visible output excludes direct personal identifiers (see Section 12 below).

10. The Naqlio AI Assistant

The Naqlio AI Assistant is an optional, read-only feature that lets an authorized user connect a Naqlio account to a supported AI assistant platform — such as ChatGPT (OpenAI), Claude (Anthropic), or Gemini (Google) — and request information that is already available to their Naqlio account. Public V1 supports shipment search, shipment details, and shipment timeline/history. The Naqlio AI Assistant does not create, modify, assign, cancel, or update shipments, and it does not perform any write operation on your account.

When you connect a Naqlio account, we use an OAuth account-connection flow. You sign in to Naqlio, review the requested read-only shipment permission, and grant or deny access. The implementation uses security controls such as PKCE (S256), opaque OAuth tokens, hashed token storage, and encrypted backend session material. You can disconnect or revoke access through the AI assistant platform's connection settings where available, or by contacting Naqlio support.

11. Information Not Processed Through the AI Assistant

Naqlio does not process protected health information (PHI) or payment-card data through the Naqlio AI Assistant. The Naqlio AI Assistant returns only information that the connected account is authorized to access, and it never expands account permissions, selects another tenant, or bypasses Naqlio authorization controls.

12. AI Assistant Data Minimization

When you connect Naqlio to a supported AI assistant (such as ChatGPT, Claude, or Gemini), we send only the minimum information needed to answer your read-only request; we do not train on, or otherwise use beyond your request, the responses.

The Naqlio AI Assistant is designed to be data-minimizing. Model-visible output may include tracking or order references; canonical shipment status; service type; coarse city, area, or region; depot and account display labels; trip reference and status; driver display name; vehicle registration; parcel count and package type; safe shipment timeline or event labels; and proof-presence labels (such as proof of delivery or pickup) without image or signature URLs.

Model-visible output intentionally excludes: phone numbers; email addresses; full addresses; precise coordinates; OTP values; signature or proof-of-delivery URLs; payment-sensitive details including COD values; backend JWTs; OAuth access or refresh tokens; raw backend records; and access-scope data.

AI-generated outputs are provided for operational review only and are not final legal, financial, customs, tax, or contractual records.

13. AI Assistant Platforms

When you connect and use the Naqlio AI Assistant through a supported platform, the platform receives the tool output needed to answer your request within that platform's service. Each platform has its own privacy practices and terms for how it handles information within its service. Please review the applicable privacy and product terms of the platform you use — for example, OpenAI for ChatGPT, Anthropic for Claude, and Google for Gemini.

14. Security

We apply administrative, technical, and physical safeguards appropriate to the nature of the information we process, including account authorization, scoped OAuth access, exact redirect-URI validation, token hashing, session encryption, rate limiting, sensitive-field filtering, and access controls. No system can guarantee absolute security. Please keep your credentials confidential and disconnect any connected AI assistant if you no longer want that access.

15. Data Retention

We retain information only as long as necessary to provide the services and to meet our legal and contractual obligations. Our retention periods include:

• Account and subscription information: for as long as your account is active, and afterwards for the period required by applicable Saudi commercial and regulatory record-keeping obligations;
• Contact and demo requests: up to 24 months from the date of your last interaction, after which we delete or anonymize them;
• Service activity and operational logs: up to 12 months, unless a longer period is required for security, fraud prevention, or legal compliance;
• AI Assistant tool-call logs: a minimum, metadata-only set of records for up to 30 days, used for operational and security purposes;
• Financial and tax-related records: for the period required by applicable Saudi tax and accounting law.

Where personal information is no longer needed, we delete or de-identify it. Nothing in this policy requires us to retain information longer than permitted or required by law.

16. Your Rights

Depending on applicable law, including the Saudi PDPL, you may have rights regarding your personal information, including the right to access, correct, delete, restrict, object to or request portability of your information, and to withdraw consent where processing is based on it. You may also request that we stop processing your information for direct marketing purposes. To make a request, contact us at solution@kacommerce.com. We will respond within the timeframes required by applicable law.

17. Business Use and Children

The Naqlio platform and the Naqlio AI Assistant are intended for business and operational use by organizations and by individuals aged 18 or older acting within their authorization. They are not intended for children, and we do not knowingly collect personal information from children.

18. Third-Party Links and Services

The Naqlio website may link to third-party websites and services, including AI assistant platforms. This Privacy Policy does not apply to those third parties. We encourage you to review their privacy practices before connecting or sharing information.

19. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our services, law, or practices. Material updates will be reflected on this page with a revised "Last updated" date. Where required by law, we will provide additional notice.

20. Contact

For privacy questions, data subject requests, or to reach our designated privacy contact, email solution@kacommerce.com.