How we handle personal data.

Who we are

Dstation is a data governance software company based in Riyadh, Saudi Arabia. For anything you read here, we are the controller of the personal data described — we decide why it is collected and how it is used. You can reach us at the address at the end of this page.

What we collect

We keep this deliberately small. Three categories cover everything this website gathers:

• Details you send us. When you request a meeting, we receive the name, work email, organisation and message you enter in the form. Nothing in that form is required beyond what we need to reply.
• Technical records. Our hosting provider logs standard request data — IP address, browser and device type, pages requested and timestamps — to serve the site, keep it available and investigate abuse.
• Preferences stored on your device. Your light or dark theme choice and your cookie choice are saved in your browser's local storage. They stay on your device and are never sent to us.

Why we use it, and on what basis

We use meeting requests to respond to you and, if it goes further, to prepare and deliver services under our agreement with your organisation. We use technical records to operate the site securely. We process this data where it is necessary to take steps at your request, necessary for our legitimate interest in running a secure website, necessary to perform a contract, or required by law. Where we rely on your consent, you can withdraw it at any time.

What we never do

We do not sell personal data. We do not share it with advertisers, we do not build advertising profiles, and we do not track you across other websites.

Who processes it for us

We use a small number of service providers who process data on our instructions and are bound to protect it:

• Vercel, for website hosting and delivery.
• Upstash, for the content store behind the site's text.
• Our email provider, to receive and respond to meeting requests.

Where it is processed

Our platform is designed for in-Kingdom hosting, and customer data under a services agreement is handled according to the residency terms in that agreement. This marketing website is delivered through a global content network, so website request data may be processed outside Saudi Arabia. Where that happens, we rely on the safeguards required by the Personal Data Protection Law and its implementing regulations.

How long we keep it

Meeting requests and related correspondence are kept for as long as we are in contact with you and for a reasonable period afterwards, unless a longer period is required for legal or accounting reasons. Technical logs are kept for a short operational period and then discarded. When data is no longer needed for the purpose it was collected for, we delete it.

Your rights

Under the Saudi Personal Data Protection Law you have the right to be informed about how your data is used, to access it, to request a copy in a readable format, to have inaccurate data corrected, to ask for deletion, and to withdraw consent where we relied on it. To exercise any of these, write to us at the address below. We will not charge you for a reasonable request, and we will respond within the period the regulations allow. If you are not satisfied with our response, you may complain to the Saudi Data and Artificial Intelligence Authority.

How we protect it

Data is encrypted in transit and at rest. Access is granted on a least-privilege basis and reviewed regularly, and multi-factor authentication is mandatory for our team. Details of our wider security posture are on the Security page, with full documentation available under NDA.

Children

This website is aimed at organisations and the people who work in them. It is not directed at children, and we do not knowingly collect their personal data.

Changes to this policy

If we change how we handle personal data, we will update this page and move the date at the top. Material changes will be made clear on the site rather than left for you to find.