Six questions for your agent.
| Topic | What to check | Effect on the design |
|---|---|---|
| Purpose | Is each piece of data collected for a clear, stated purpose? | The agent asks only for what the booking or question needs. |
| Notice | Does the customer know who processes their data and why? | A short notice and a link at the start of the chat. |
| Consent and legal basis | Is consent needed, or does another basis in the law apply? | Opt-in captured and logged where needed. |
| Sensitive data | Health, genetic, credit or similar data in the conversation? | Avoided by design; handed to staff where unavoidable. |
| Transfers abroad | Does any data leave the Kingdom (hosting, AI model)? | Hosting and model choice reviewed against the transfer regulations. |
| Retention | How long are conversations kept? | Automatic deletion after the agreed period. |
Orientation based on SDAIA's published English translation and secondary summaries; the implementing and transfer regulations add detail and are updated over time.
Building for Saudi customers.
Agents designed in Arabic with English alongside, tested with native speakers.
Name, phone and the reason for contact usually suffice for bookings and support.
Where data is stored and where the model runs is a decision in the design, made with your adviser.
Complaints, payments and anything sensitive go to staff, with a summary.
Every answer and action logged, so requests from customers or SDAIA can be answered.
Remote from Dubai, honestly.
We have no office in Saudi Arabia. Riyadh clients work with us online: audit and Blueprint sessions by video, the build in your own accounts, weekly reviews. Prices are the same published prices (one system from AED 15,900 or €3,900, excl. VAT).
We have not published a Saudi client case. On a call we show how the agent behaves in Arabic and how the data choices above are documented.
Not legal advice.
This guide is general information, checked against the sources listed, and not legal advice. Rules change; check the current text or ask a lawyer before you rely on it. Checked November 2026.
Common questions.
Does the PDPL apply to a company outside Saudi Arabia?
It can apply to processing of personal data of people in the Kingdom by entities outside it. Check with your legal adviser how it applies to your structure.
Can the AI model be hosted outside Saudi Arabia?
Transfers abroad are allowed only under the conditions in the law and its transfer regulations. We document the options per data field and let your adviser decide.
Is WhatsApp allowed?
Yes, on the WhatsApp Business Platform with opt-in and Meta's template rules; the PDPL applies to the data in those chats.
Do you have an office in Riyadh?
No. Oravel is based in Dubai and serves Saudi clients remotely.
Want this in your business?
Tell us how you work today. We'll tell you honestly what AI can take off your team's plate, what it costs, and whether we are the right fit.