Privacy & Data Protection Policy

1. About the service

Strategic Intelligence Axis (SIA Hub) is an independent consulting service specialized in hospitality data analysis, based in the Kingdom of Saudi Arabia, operating under the Freelance Work License issued by the Ministry of Human Resources and Social Development (License No.: FL-408548863).

2. Data collected

Only the minimum data needed to deliver the service is collected:

• Contact data: hotel name, city, email address, requested package, and your optional notes (when you submit the request form on this website or email us).
• Browsing data: anonymous data via Google Analytics (browser type, approximate location, pages visited).
• Free-tool usage data: the Review Grader runs entirely inside your browser; the review text you paste is never sent to any server and is never stored by us. Only the review count and the resulting grade are recorded for usage analytics.
• Cookies: the website uses cookies to improve browsing, for usage analytics, and to measure advertising campaign performance. You can disable them from your browser settings.
• Technical request data: IP address and device/browser identifier (User Agent) — received by the hosting, form, and advertising providers as a function of how the network works on every request, and logged server-side for security, abuse prevention, and to evidence the fact of submission. For anyone registering for the affiliate programme, both are also held in the consent record described in section 10.

The website relies on external technical service providers, which receive limited data in the course of their function:

• Google Analytics: measurement and analysis of website usage.
• Google Fonts (fonts.googleapis.com and fonts.gstatic.com): loading the fonts used across the pages; the provider receives the visitor's IP address when a font is requested.
• Formspree: receiving and processing messages submitted through the request form.
• Google Ads / Google Marketing Platform (googleadservices.com, doubleclick.net): measuring advertising campaign conversions and retargeting; advertising cookies are used and the provider receives the IP address and device identifier.
• Google (Sheets): holding the updatable website copy and the affiliate-programme records; the provider receives the IP address when content is loaded, and stores the registration data entered by an affiliate.
• Cloudflare Pages: website hosting, content delivery network (CDN), and request protection.

Transfers outside the Kingdom: some of these providers process data on servers outside the Kingdom of Saudi Arabia. Under the Personal Data Protection Law and its Implementing Regulations, that transfer relies on being necessary to perform a contract to which the data subject is a party or to take steps at the data subject's request, and on the data subject's explicit consent when submitting the form or registering for the affiliate programme — and it does not prejudice national security or the vital interests of the Kingdom.

Safeguards applied to the transfer: only the minimum data needed for each purpose is transferred; each provider is engaged under its published data-processing terms and its standard contractual clauses for cross-border transfers; data is encrypted in transit and at rest with the provider; access to the affiliate-programme records — the only place a national ID or residency number is held — is restricted to the service owner's own account with two-step verification and is granted to no other party; and data is destroyed once the retention periods in section 7 lapse. You may at any time request a copy of your data, its correction, or its deletion under section 8.

3. Legal basis

Your data is processed in accordance with the Personal Data Protection Law (PDPL) issued by the Saudi Data and AI Authority (SDAIA), based on your explicit consent when getting in touch or in fulfillment of contractual obligations.

4. How your data is used

Your data is used exclusively for the following purposes: communicating with you about the service and replying to your request with the package that fits your property, preparing and delivering requested reports and analyses, improving the website experience, and measuring advertising campaign performance and retargeting. Your data is never sold or rented, and is never shared with any third party for that party's own marketing. The only sharing is with the technical service providers listed in section 2, and solely to the extent needed to operate the site and deliver the service.

5. Guest reviews

The reviews analyzed are comments publicly published on booking platforms (Booking.com, Google, TripAdvisor, and others). No access to your accounts or your guests' private data is ever needed.

6. Data security

Reasonable technical and administrative measures are taken to protect your data against unauthorized access, loss, or damage. All reports and files are delivered to you directly and are not stored on public servers.

7. Retention period

Your data is retained for the duration of the commercial engagement and for one year after the last contact, after which it is securely deleted unless there is a legal obligation requiring longer retention.

Affiliate-programme member data is the exception: it is retained for 3 years after the contractual relationship ends, as set out in section 10 below.

8. Your rights

Under the Personal Data Protection Law, you have the right to:

• Access: request a copy of your personal data held.
• Correction: request correction of any inaccurate or outdated data.
• Deletion: request deletion of your personal data at any time.

To exercise any of these rights, email us at: owner-mbs@sia-hub.com. A response is provided within 15 business days.

9. Contact

The only contact channel for inquiries about this Privacy Policy is email: owner-mbs@sia-hub.com — or the request form on the home page.

10. Affiliate programme

This section applies only to those who register for the affiliate programme; it does not apply to analysis-service clients.

• Data categories: full name, national ID or residency number, mobile number, email, city, experience, and bank account details (when commissions are paid), in addition to referred-client data (hotel name, contact person, contact details).
• Legal basis: the affiliate's explicit consent at registration and performance of the contractual obligations set out in the programme agreement, under the Personal Data Protection Law (PDPL).
• Consent record: on acceptance of the programme agreement a consent record is kept containing the date and time of acceptance to the second, the version number of the terms accepted, the email address and ID number tied to that acceptance, the device/browser identifier (User Agent), and the IP address of the request as logged server-side on receipt. Its purpose is to evidence and document consent under the Kingdom's Electronic Transactions Law, and it is held for the retention period stated below.
• Retention period: for the duration of the contractual relationship and for 3 years after it ends, for record-keeping, audit, and regulatory compliance, after which it is securely destroyed.
• Processor and transfer outside the Kingdom: programme records are stored with Google (Sheets) and may be processed on servers outside the Kingdom of Saudi Arabia. The legal basis for that transfer and the safeguards applied to it are set out at the end of section 2 above, and include restricting access to the file holding the national ID or residency number to the service owner's own account with two-step verification.