Privacy Policy
Last updated: 2026-07-07
1. Who we are
Sadu (sadu.cloud) operates an AI gateway hosted on infrastructure in the Kingdom of Saudi Arabia. For personal data processed through your account, Sadu is the data controller; contact: privacy@sadu.cloud.
2. What we collect
Account data (email address); billing data (payment status and invoice details — card data is handled by the payment processor, never by us); usage records per API request (model, provider, residency, token counts, cost, latency, status); and orchestration traces for Sadu models, which may include short prompt excerpts.
3. Why we process it
To provide and meter the service (contract), to issue tax invoices (legal obligation), to secure the service against abuse (legitimate interest), and — only where the key has not opted out — to improve the Sadu routing policy from orchestration traces.
4. Where data lives
Gateway state — accounts, usage records, ledger, traces, policies — is stored on in-Kingdom infrastructure. Requests made with a global-residency key are forwarded to the model provider you select, which may process them outside the Kingdom; ksa-pinned keys are never routed outside designated in-Kingdom providers.
5. Model inputs and outputs
We do not store chat message bodies for completed requests beyond capped excerpts in orchestration traces (Sadu models only), and never for keys with the training opt-out. Providers you route to process your inputs under their own terms.
6. Retention
Usage and ledger records are retained as required for accounting and audit. Trace prompt excerpts are capped in size and subject to periodic review; backups follow a 14-day rotation.
7. Your rights
Under the Saudi Personal Data Protection Law (PDPL) you may request access to, correction of, or deletion of your personal data, and withdraw consent where processing is consent-based. Write to privacy@sadu.cloud; we respond within the statutory period.
8. Processors
We use a payment processor for card payments and a transactional email provider for sign-in links. Both act on our documented instructions; neither receives model inputs or outputs.
9. Changes
We will post material changes here with a new "last updated" date and, for significant changes, notify account holders by email.