Privacy Policy
Effective date: 21 July 2026Last updated: 21 July 2026
1. Who we are
AGENTOx is operated by Quduratech co., a THAKA Holding company, based in Riyadh, Kingdom of Saudi Arabia (“Quduratech”, “we”, “us”, or “our”).
For personal data processed in connection with AGENTOx, Quduratech acts as the data controller unless we process data solely on behalf of a customer organization under a written agreement, in which case that organization is the controller and we act as a processor.
Contact for privacy requests: [email protected]. WhatsApp: +966 53 157 7796. Website: https://agentox.app.
2. Scope
This Privacy Policy applies to AGENTOx websites, web applications, mobile applications, APIs, and related services (collectively, the “Services”), including interest and information request forms on agentox.app.
This Policy is designed to align with the Kingdom of Saudi Arabia Personal Data Protection Law (PDPL) and, where applicable, the EU General Data Protection Regulation (GDPR) for individuals in the European Economic Area or United Kingdom.
3. Personal data we collect
Depending on how you use the Services, we may process:
- Identity and contact data: name, work email, phone number, job title, organization, entity type, city.
- Account data: login identifiers, role assignments, authentication tokens, profile settings, and preferences.
- Service content: prompts, messages, documents, mailbox metadata or content you connect, calendars, tasks, and agent configurations you choose to process through AGENTOx.
- Device and usage data: device type, OS, app version, IP address, approximate location derived from IP, log events, diagnostics, and performance metrics.
- Mobile permissions data: microphone, speech recognition, calendar, reminders, and notifications when you grant access on device.
- Cookie and similar technologies: as described in our Cookie Policy.
- Communications: support requests, WhatsApp or email correspondence, and interest-form submissions.
4. Sources of data
We collect data directly from you, from your organization (for example when an administrator creates your account), from integrations you authorize (such as email or calendar providers), and automatically through the Services and devices you use.
5. Purposes of processing
We process personal data to:
- Provide, operate, secure, and improve AGENTOx.
- Create and manage accounts, tenants, roles, and access controls.
- Respond to interest requests and commercial enquiries.
- Enable AI-assisted workflows, summaries, task management, and agent execution subject to your configuration and human-in-the-loop controls.
- Send service, security, and transactional messages (including password reset and invitation emails).
- Monitor reliability, prevent abuse, and investigate incidents.
- Comply with legal obligations and enforce our Terms and Acceptable Use Policy.
6. Legal bases and PDPL principles
Where GDPR applies, we rely on one or more of: performance of a contract; legitimate interests (for example securing and improving the Services in ways that do not override your rights); consent (for optional cookies or certain integrations); and legal obligation.
Where PDPL applies, we process personal data in accordance with PDPL principles, including lawfulness, purpose limitation, data minimization, accuracy, storage limitation, security, and transparency. Where consent is required under PDPL, we obtain it before the relevant processing.
7. Hosting, residency, and transfers
AGENTOx supports deployment models including cloud, on-premises, and hybrid options. Customer organizations may select hosting arrangements aligned with their cybersecurity and data-residency requirements, including local hosting options in the Kingdom of Saudi Arabia where contracted.
If personal data is transferred outside the Kingdom or outside the EEA/UK, we implement appropriate safeguards required by applicable law, such as contractual protections and security controls commensurate with the transfer.
8. Retention
We retain personal data only as long as needed for the purposes described above, including to provide the Services, resolve disputes, enforce agreements, and meet legal, tax, or accounting requirements. Retention periods vary by data category and customer configuration. When data is no longer required, we delete or anonymize it in accordance with our retention practices and customer instructions.
9. Your rights
Subject to applicable law, you may have rights to access, correct, delete, restrict, or object to certain processing of your personal data; to withdraw consent where processing is consent-based; and to data portability where GDPR applies.
To exercise rights, contact [email protected]. We may need to verify your identity. If you are an end user of a customer organization, we may redirect your request to that organization as controller.
You may also lodge a complaint with the competent supervisory authority. In Saudi Arabia, this includes the Saudi Data and Artificial Intelligence Authority (SDAIA) in relation to PDPL. In the EEA/UK, you may contact your local data protection authority.
10. Children
AGENTOx is a business and enterprise service and is not directed to children. We do not knowingly collect personal data from children under 18. If you believe we have collected such data, contact us and we will take appropriate steps to delete it.
11. Security
We implement technical and organizational measures designed to protect personal data against unauthorized access, alteration, disclosure, or destruction. These measures include access controls, encryption in transit where applicable, logging, and operational security practices. No method of transmission or storage is perfectly secure; you are responsible for safeguarding credentials issued to you.
12. Processors and subprocessors
We use trusted service providers to help operate AGENTOx (for example infrastructure hosting, email delivery, and identity-related services). Processors are bound by contractual obligations to process personal data only on documented instructions and to implement appropriate security.
| Category | Examples of processing |
|---|---|
| Cloud / infrastructure | Hosting, databases, backups, networking |
| Email delivery | Transactional and notification email |
| Identity & authentication | Login, session, and password-reset flows |
| Customer-authorized integrations | Mailbox, calendar, or other connectors you enable |
14. Changes
We may update this Privacy Policy from time to time. The “Last updated” date at the top of this page reflects the latest revision. Material changes will be indicated by updating that date and, where appropriate, by additional notice through the Services.
15. Contact
Privacy requests and questions: [email protected]. Quduratech co. (A THAKA Holding co.), Riyadh, Kingdom of Saudi Arabia.