Privacy Policy

Last updated: May 11, 2026

1. Introduction and Data Controller

Lenci (operated by Siyada Technology, based in Riyadh, Kingdom of Saudi Arabia, "we", "us", "our") is committed to protecting your personal data in accordance with the Kingdom of Saudi Arabia's Personal Data Protection Law (PDPL), issued by Royal Decree M/19 and its amendments, enforced by the Saudi Data and AI Authority (SDAIA).

This Policy explains how we collect, process, store, share, and protect personal data when you use Lenci's AI-powered imaging service, and describes your rights as a data subject.

For privacy questions or to exercise your rights, contact dpo@lenci.ai.

2. Definitions

• Personal Data: any information that identifies you or makes you identifiable, directly or indirectly.
• Processing: any operation performed on personal data (collection, storage, use, disclosure, deletion).
• Data Controller: the entity that determines the purposes and means of processing (Siyada Technology).
• Processor: a third party that processes data on our behalf (also referred to as "sub-processors").
• Consent: a freely given, explicit, specific, informed declaration of your agreement to the processing of your data.

3. Personal Data We Collect

3.1 Account Data

Email, name, hashed password, optional profile picture.

3.2 Payment Data

We do not store card details. Payment is processed by Network, a PDPL-compliant payment service provider, which retains only an encrypted customer identifier on our side. We retain invoice records (transaction ID, amount in SAR, date, credits pack).

3.3 Uploaded and Generated Content

Images you upload, prompts, studio configurations, AI-generated images and videos. This content may include sensitive data (e.g. facial features) if you choose to upload it.

3.4 Usage and Device Data

IP address, browser type, preferred language, visit timestamps, in-app navigation, product analytics events captured via PostHog (only after your explicit consent).

3.5 Communications

Content of emails you send to support, support ticket history.

4. Legal Bases for Processing

We rely on the following legal bases under PDPL:

• Explicit consent (Article 6): usage analytics (PostHog), marketing emails, non-essential cookies.
• Performance of a contract: account creation, image generation, payment processing, credits provisioning.
• Legal obligation: retention of invoice records, response to lawful authority orders.
• Legitimate interest: service security, fraud prevention, technical performance improvement (using non-identifiable data).

5. Purposes of Processing

• Deliver the AI image generation service.
• Manage your account, credits, and payments.
• Send service notifications (account confirmation, password reset, payment receipts).
• Send marketing content (only after your explicit consent; unsubscribe at any time).
• Improve the product through usage analytics (only after you accept the consent banner).
• Investigate Terms-of-Service violations, ensure security, and prevent fraud.

6. Sub-Processors and Third Parties

We share specific data with approved service providers, each bound by a data processing agreement:

Note on self-hosted software: We operate the PostHog (analytics) and Supabase GoTrue + PostgreSQL (authentication and database) software on our own infrastructure at Contabo. PostHog Inc. and Supabase Inc. do not process your data as third parties — they are open-source software we run ourselves.

We do not sell your personal data to any third party.

7. Cross-Border Transfers

Your data is partly processed outside the Kingdom of Saudi Arabia (see table above). Under Article 29 of PDPL, cross-border transfer is conducted on the basis of:

• Your explicit consent at account creation.
• Necessity to perform the contract entered into with you.
• Contractual safeguards with each sub-processor providing protections equivalent to PDPL.

We continue to work on reducing cross-border transfers and hosting more infrastructure inside Saudi Arabia whenever suitable alternatives become available.

8. Data Retention

9. Your Rights Under PDPL

As a data subject, you have the following rights:

• Right to be informed: understand how your data is processed (this Policy).
• Right of access: request a copy of the personal data we hold about you.
• Right to rectification: request correction of inaccurate data.
• Right to erasure (destruction): request deletion of your data (subject to legal retention obligations).
• Right to restrict processing: request that processing be paused in specific cases.
• Right to data portability: receive your data in a structured, machine-readable format.
• Right to object: object to processing based on legitimate interest.
• Right to withdraw consent: withdraw at any time (without affecting prior processing).

10. How to Exercise Your Rights

Send your request to dpo@lenci.ai with proof of identity (to prevent impersonation) and a description of your request. We will respond within 30 days of receipt, or notify you of any delay and its duration. This service is free of charge.

11. Cookies and Analytics

We use essential cookies necessary for the service (session, language preference, consent state). No analytics events are collected via PostHog until you explicitly accept the consent banner on first visit. You may withdraw consent at any time by clearing site data in your browser or contacting dpo@lenci.ai.

12. Children's Privacy

Lenci is not intended for users under 18. We do not knowingly collect data from minors. If we discover an account belongs to a minor without parental consent, we will close the account and delete its data.

13. Security Measures

We apply layered technical and organizational measures: TLS encryption in transit, AES-256 encryption at rest for sensitive data, password hashing (bcrypt), session isolation, role-based access controls (RBAC), audit logging, encrypted daily backups, and periodic security review.

14. Data Breach Notification

In case of a personal data breach likely to cause you harm, we will notify you and the Saudi Data and AI Authority within 72 hours of becoming aware of the breach, in accordance with PDPL.

15. Right to Lodge a Complaint

If you believe the processing of your data violates PDPL, you have the right to complain:

• First to us: dpo@lenci.ai
• Or directly to the Saudi Data and AI Authority: sdaia.gov.sa

16. Changes to This Policy

We may update this Policy to reflect changes in our service or in legal requirements. We will notify you of material changes via your registered email and/or a prominent in-app notice 14 days before they take effect.

17. Governing Law and Jurisdiction

This Policy is governed by the laws of the Kingdom of Saudi Arabia, and the courts of the Kingdom of Saudi Arabia shall have exclusive jurisdiction over any dispute arising out of or in connection with it or your use of the service.

18. Contact

• Data Protection Officer: dpo@lenci.ai
• General privacy inquiries: privacy@lenci.ai
• Legal matters: legal@lenci.ai
• To request the controller's registered postal address, email legal@lenci.ai.