Privacy policy

Who we are

BuiltBy3li (Built by Ali) is a web studio run by Ali in Saudi Arabia. Contact: info@builtby3li.com · +966 53 527 5175.

What we collect

• What you type in the project form: name, business name, mobile number, email, city, business type, the services and package you're interested in, budget range, timeline, your website or Instagram, the project description and any files you attach.
• How you prefer to be contacted, and the consents you tick, with the wording you agreed to and the time.
• Technical details: a one-way hash of your IP address (not the address itself), your browser type, and where your visit came from (for example a link with utm tags).
• Messages we exchange with you on WhatsApp, phone or email while we discuss or deliver a project.

Why we use it

• To reply to your request, prepare a proposal and deliver the work you ask for (the reason you contacted us).
• To keep proper records of proposals, invoices and payments, which the law requires.
• To send occasional tips and offers, only if you ticked that box. You can stop them at any time.
• To protect the form from spam and abuse.

We don't sell your data, and we don't use advertising trackers.

Where it's kept and who processes it

• Cloudflare: domain, security, the spam check on the form (Turnstile) and the secure connection to our systems.
• Our website is hosted on Amazon Web Services (London, United Kingdom).
• Requests, client records, proposals and invoices are kept in a private database on a server we operate at OVHcloud (Frankfurt, Germany). Only Ali can sign in, with a password and a second factor.
• WhatsApp (Meta) and Google Workspace carry the messages and emails we exchange with you, and the alert Ali receives when a new request arrives.

Some of these services are outside Saudi Arabia, so your data is transferred abroad. We keep that to what's needed, use encrypted connections, and limit access to the people who need it.

How long we keep it

• Requests that don't become a project: anonymised 12 months after the last contact, with attached files deleted.
• Businesses we contacted first and that didn't reply: anonymised after 6 months. If you tell us no, we never contact you again.
• Spam: deleted after 30 days.
• Clients: while we work together and for 3 years after. Invoices and payment records are kept for the period the law requires.

Your rights

Under the Saudi Personal Data Protection Law you can ask to see your data, get a copy, correct it, have it deleted (except records we must keep by law) or withdraw a consent. Email info@builtby3li.com or message us on WhatsApp and we'll respond within 30 days.

If you think we've mishandled your data, you can also contact the Saudi Data and AI Authority (SDAIA).

Cookies

We set two first-party cookies, bb_ft and bb_lt, for 30 days. They remember which page or link brought you to the site so we know which channels work. They don't contain your name, phone or email.

The spam check may set a cookie that's needed for security. We don't use advertising cookies.

Security

Connections are encrypted, sensitive notes are encrypted at rest, sign-in needs a second factor, and backups are taken every night. If a breach ever puts you at risk, we'll tell you and the authorities as the law requires.

Changes

If we change this policy we'll update the date at the top of this page.