This Privacy Policy explains how Innovant Consulting and Management Solutions (“Innovant”, “we”, “us”) collects, uses and protects personal data when you use this website and its assistant, Sultan, in line with the Personal Data Protection Law (PDPL) of the Kingdom of Saudi Arabia and its Implementing Regulations.
Who is responsible for your data
Innovant Consulting and Management Solutions — registered in the Kingdom of Saudi Arabia as شركة ابتكار وحلول للاستشارات الادارية, a limited liability company, Unified National Number 7006006311 — is the controller of the personal data described here. Our office is at 7684 Salahuddin Al-Ayoubi Street, Al Malaz, Riyadh 12831-2158, Saudi Arabia. For any privacy matter, write to info@innovant.com.sa or call +966 50 551 9986.
Personal data we collect
Information you give us — your name, email address, mobile number, company and the content of your message — when you request a consultation, send a form, write to us, or introduce yourself to our assistant. The assistant asks for your name, email address and mobile number so that a specialist can follow up with you; if you would rather not give them there, you can reach us by WhatsApp or the contact form instead.
Technical information collected automatically, such as browser type, device information, the pages you visit and the site or campaign that brought you here, through cookies and similar technologies. Like any website, our hosting and security systems also record the IP address of each request in their own logs. We do not ask for sensitive personal data, and we ask you not to send it through the website or the assistant.
Sultan, our AI assistant
Sultan is an assistant that runs on artificial intelligence, not a human member of staff. It answers from the content of this website.
What it keeps. The text of your conversation, its language, the page you opened it from, and the site or campaign that brought you. If you choose to introduce yourself — and only after you tick the consent box — it also keeps your name, email address and mobile number, so that a member of our team can follow up with you. A summary of each day’s conversations, with the details visitors gave, is emailed to our team for that purpose.
Your IP address. The assistant does not store your IP address with your conversation. To stop automated abuse it counts requests from each address; for that it keeps, for a few minutes, a one-way fingerprint of the address (a hash made with a secret key that changes daily), and then deletes it. The networks that carry your request — Cloudflare and our hosting provider — see and log IP addresses as they do for any website.
How an answer is written. The text of your question, with the relevant passages from our website, is sent to an AI language-model service, Ollama, which writes the reply. The details you enter in the assistant’s form — name, email address and mobile number — are not part of what is sent. Whatever you type into a message is sent as you typed it, so please do not put personal or confidential details in your questions. Ollama states that it processes this text only for the time needed to answer, does not keep it afterwards, and does not use it to train models. If you ask by voice, your browser’s own speech-recognition service turns your speech into text; we receive the text only.
Being remembered. So that you are not asked for your details again, your browser keeps a random identifier and your first name for up to 90 days, and a reference to your current conversation for up to 12 hours. Your email address and number are not kept in the browser. If the assistant’s invitation is shown to you, your browser also notes the date, so that it is not shown again for 30 days. The “Not you?” link under the assistant’s greeting clears what your browser remembers; it does not delete the conversation we hold, which you can ask us to delete.
How long. Conversations, and the details given with them, are kept for ten years from the start of the conversation, so that we can follow up enquiries and keep a record of our dealings, and are then deleted automatically. Copies in our database provider’s short-term recovery backups lapse within 30 days of deletion. You can ask us to delete your conversation sooner.
Why we use your data, and on what basis
We use personal data for the purposes below, each on the basis shown.
To reply to an enquiry and follow up with you when you send a form or give your details to the assistant: your consent, given when you send the form or tick the consent box. You can withdraw it at any time.
To answer the questions you put to the assistant: your consent, given by starting the conversation.
To see which questions our content does not yet answer, and to measure how the website is used: our legitimate interest in improving our service, where it does not override your rights. Measurement cookies follow your choice in the consent notice.
To keep the website and the assistant secure and to prevent abuse: our legitimate interest in protecting them.
To send you our newsletter, if you have subscribed to it or agreed to receive it: your consent. Every newsletter has a link to unsubscribe. We do not add people to the newsletter because they contacted us or used the assistant.
To carry out an engagement, when one follows: the agreement between us.
To meet obligations the law places on us: the law.
Cookies and measurement
The website uses cookies that are necessary for it to work, a consent notice (CookieYes) that records your choice, and two measurement tools, loaded through Google Tag Manager. Google Analytics counts visits, where they come from, and actions such as sending a form or tapping a contact link. Microsoft Clarity shows how pages are used and can replay a visit — the movement of the pointer, clicks and scrolling — with what is typed into forms masked. The assistant’s window is masked in these recordings, so the text of your conversation and your details are not captured by Clarity.
You can accept or decline non-essential cookies in the consent notice, and change your choice later from the cookie button at the corner of the page; declining does not affect access to the site. The assistant reports only counts and outcomes to Google Analytics — never your name, your contact details or what you wrote.
Who we share data with
With the providers that run parts of the service for us: our website hosting provider; Cloudflare, which runs the assistant and stores its conversations; Ollama, the AI language-model service described above; Google and Microsoft, for the measurement tools; Google, for our mailboxes; and MailerLite, which sends our newsletter to those who have agreed to receive it. Some of them, such as Google and Microsoft, also process data under their own privacy policies. We may also disclose data to government authorities where the law requires it, and to our professional advisers. We do not sell personal data.
Transfers outside the Kingdom
Some of these providers process data on systems outside the Kingdom of Saudi Arabia: the assistant’s conversations are stored in Western Europe, and the AI service, the measurement tools and the email services may process data in the United States, the European Union and other countries. We send them only what this policy describes. Such transfers are subject to the PDPL and its regulations on transferring personal data outside the Kingdom.
How long we keep it
Assistant conversations and the details given with them: ten years from the start of the conversation, then deleted automatically. Newsletter subscriptions: until you unsubscribe. Enquiries sent through forms or by email, the daily summary our team receives, and the notes our team makes when following up with you: for as long as needed to deal with the enquiry and any engagement that follows, and then for the period the law requires. After that the data is deleted or made anonymous.
Your rights
Subject to the PDPL, you have the right to know how your data is processed, to obtain a copy of it, to have it corrected or completed, to have it destroyed, and to withdraw your consent at any time.
To use any of these rights, write to info@innovant.com.sa. If your request concerns a conversation with the assistant, tell us the email address or mobile number you gave, so that we can find it; if you gave none, tell us the date, the approximate time and what you asked. We may ask for enough information to be sure the request comes from you. We respond within the period the law sets. You may also complain to the competent authority, the Saudi Data and AI Authority (SDAIA).
Security
We apply appropriate organisational and technical measures to protect personal data against loss, misuse and unauthorised access. No method of transmission over the internet is completely secure, and we cannot guarantee absolute security.
Children
This website is intended for businesses and professionals and is not directed at children. We do not knowingly collect personal data from children.
Changes to this policy
We may update this policy from time to time. The current version and its date are published on this page.
Contact us
Innovant Consulting and Management Solutions, 7684 Salahuddin Al-Ayoubi Street, Al Malaz, Riyadh 12831-2158, Saudi Arabia — info@innovant.com.sa — +966 50 551 9986.
Last updated: 19 October 2026.
