Privacy & PDPL.

Last updated: 19 June 2026

This notice explains how Greynab (“we”, a creative house and production studio based in Riyadh, Saudi Arabia) handles personal data when you use greynab.com, contact us, chat with us, or apply for a role. We act as the data controller for that data and process it in line with the Saudi Personal Data Protection Law (PDPL) and its regulations.

What we collect

• Enquiries & leads — your name, company, email and/or phone, and what you tell us about your project (via the contact form or the on-site chat).
• Chat transcripts — the messages you exchange with our assistant, so we can follow up and improve the service.
• Job applications — your CV/portfolio, contact details, work history and the answers you give our careers intake.
• Usage & analytics — cookies and device/usage data, collected only after you accept in the consent banner.
• Consent record — your accept/decline choice, stored for up to 12 months.

Why we use it (lawful basis)

• To respond to you and pursue a possible engagement — on the basis of taking steps at your request / our legitimate business interest.
• To consider you for a role — on the basis of your consent, given when you apply.
• Analytics and advertising measurement — strictly on the basis of your consent, which you can withdraw at any time.

How long we keep it

• Enquiries & leads — up to 24 months after our last contact, then deleted or anonymised.
• Job applications — up to 24 months in our talent pool, after which they are automatically purged, unless you ask us to remove them sooner.
• Analytics — per each provider's retention settings; consent choices for 12 months.

Who processes it for us

We use trusted processors to run the site and our operations, under agreements that require them to protect your data: Supabase (database, authentication, storage), Anthropic (the chat assistant), Mux (video), Twilio (one-time codes / messaging), AWS SES (email), PostHog and Google (analytics and advertising measurement). Some of these providers process data outside Saudi Arabia; where they do, we rely on appropriate safeguards as required by the PDPL for cross-border transfers.

How we protect it

Access is role-restricted with row-level security and authenticated sign-in for our team; data is encrypted in transit; and personal data is masked in any session recordings. We never sell your personal data.

Your rights

Under the PDPL you can ask us to:

• access the personal data we hold about you, and get a copy;
• correct it if it's wrong, or complete it if it's incomplete;
• delete it, where there's no overriding reason for us to keep it;
• withdraw consent at any time — for analytics cookies, use “Cookie settings” in the footer; for anything else, email us;
• object to or restrict certain processing.

To exercise any of these, contact privacy@greynab.com. You also have the right to lodge a complaint with the competent Saudi authority (SDAIA).

Changes

We may update this notice; the “last updated” date above reflects the current version. Material changes will be reflected here before they take effect.