Privacy & PDPL.

Last updated: 5 September 2026

This notice explains how Greynab (“we”, a creative house and production studio based in Riyadh, Saudi Arabia) handles personal data when you use greynab.com, contact us, chat with us, or apply for a role. We act as the data controller for that data and process it in line with the Saudi Personal Data Protection Law (PDPL) and its regulations.

What we collect

• Enquiries & leads — your name, company, email and/or phone, and what you tell us about your project (via the contact form or the on-site chat).
• Chat transcripts — the messages you exchange with our assistant, so we can follow up and improve the service.
• Documents you attach — a brief, deck or image you attach in the chat or on the contact form, or send to our WhatsApp number, is kept with your enquiry so the team can read the original, not just a summary. Videos and voice notes sent on WhatsApp are kept with your enquiry as well.
• Job applications — your CV/portfolio, contact details, work history and the answers you give our careers intake.
• Usage & analytics — cookies and device/usage data, collected only after you accept in the consent banner.
• Consent record — your accept/decline choice, stored for up to 12 months.

Why we use it (lawful basis)

• To respond to you and pursue a possible engagement — on the basis of taking steps at your request / our legitimate business interest.
• To consider you for a role — on the basis of your consent, given when you apply.
• Analytics and advertising measurement — strictly on the basis of your consent, which you can withdraw at any time.

How long we keep it

• Enquiries & leads — up to 24 months after our last contact, then deleted or anonymised. A document attached to an enquiry is deleted with it.
• Documents and photos attached in a chat, on the contact form or over WhatsApp that never became an enquiry — deleted automatically after 90 days.
• Videos and voice notes sent on WhatsApp — not swept automatically; we delete them by hand or together with the enquiry, and you can ask us to remove them at any time.
• Job applications — up to 24 months in our talent pool, after which they are automatically purged, unless you ask us to remove them sooner.
• Analytics — per each provider's retention settings; consent choices for 12 months.

Who processes it for us

We use trusted processors to run the site and our operations, under agreements that require them to protect your data: Supabase (database, authentication, storage), Anthropic (the chat assistant), Mux (video), Twilio (one-time codes / messaging), AWS SES (email), PostHog and Google (analytics and advertising measurement). Some of these providers process data outside Saudi Arabia; where they do, we rely on appropriate safeguards as required by the PDPL for cross-border transfers.

How we protect it

Access is role-restricted with row-level security and authenticated sign-in for our team; data is encrypted in transit; and personal data is masked in any session recordings. We never sell your personal data.

Your rights

Under the PDPL you can ask us to:

• access the personal data we hold about you, and get a copy;
• correct it if it's wrong, or complete it if it's incomplete;
• delete it, where there's no overriding reason for us to keep it;
• withdraw consent at any time — for analytics cookies, use “Cookie settings” in the footer; for anything else, email us;
• object to or restrict certain processing.

To exercise any of these, contact privacy@greynab.com. You also have the right to lodge a complaint with the competent Saudi authority (SDAIA).

Changes

We may update this notice; the “last updated” date above reflects the current version. Material changes will be reflected here before they take effect.