01 — Who is responsible
Tetra Growth Company (Tetra), Commercial Registration 7055387703, is responsible for the personal data it collects through this website. Contact info@tetra.sa for privacy questions and requests. Please use that address rather than the public AI assistant for private matters.
02 — What we collect
We collect information you choose to submit and limited technical information needed to operate the service. Please provide only information relevant to your request, and do not submit passwords, identity documents, payment details, sensitive personal data or another person’s confidential information.
- Enquiries: your name, email, selected service and consent; company, phone number and project description are optional. We also record a booking or enquiry reference, delivery status and timestamps.
- Bookings: your selected appointment, name, email, company and any project details entered in the booking flow, together with consent and scheduling references. Required and optional fields are identified where you enter them.
- AI assistant: the message you send after agreeing to AI processing, a limited conversation history and public page context. This is not a confidential channel.
- Technical data: IP address and request/browser information processed by hosting and security providers. Our application uses temporary counters and HMAC-derived identifiers for abuse protection rather than storing raw IP addresses in those counters.
- Browser preferences: the privacy choice you save and, on Digital Growth pages, a session-only page-position record. Optional embedded previews are described in our cookie notice.
03 — Why we use it
We use enquiry details to understand your request, route it to the relevant Tetra division and respond. Booking information is used to check availability, arrange the appointment, send a calendar invitation and handle cancellation or changes. Assistant messages are used to generate a response about Tetra’s public content.
We request your consent at the enquiry and booking forms, before sending an AI message, and before optional embedded previews. Where processing is necessary to perform an agreement with you, comply with a legal duty or prevent security abuse, we rely on the applicable basis permitted by Saudi personal data protection law. We do not treat a visit, scrolling or silence as consent to optional features.
Submitting an enquiry, booking a call or using the assistant does not subscribe you to marketing. We do not sell personal data or use the website’s assistant to make decisions with legal or similarly significant effects about you. We currently run no analytics or advertising trackers.
04 — Who receives the information
Relevant Tetra personnel receive enquiries and appointment information to respond to you. Service providers process the information needed for their role; they do not all receive every category listed above.
- Vercel hosts the website and its server endpoints and processes operational and security request data.
- Resend delivers website enquiries to Tetra’s Microsoft 365 mailbox. The email contains the details you submit; the website’s enquiry database does not store the full message.
- Cal.com manages scheduling and exchanges appointment information with Microsoft 365 Outlook. Invitees receive the meeting invitation and the details included in it.
- Neon provides the website database for encrypted booking records, enquiry delivery metadata and temporary security counters.
- Groq generates AI responses using GPT-OSS 120B. Your messages reach Groq only after you agree to use the AI feature. Tetra’s assistant cannot access our mailboxes, private calendar contents or customer records.
- When you choose an interactive project preview or follow an external link, that website receives requests directly from your browser. Its own privacy practices apply. AI-provider links in the footer open those providers; they do not automatically transmit your enquiry or booking form.
- We may disclose information where legally required or reasonably necessary to address fraud, a security incident or a legal claim, subject to applicable law.
05 — Processing outside Saudi Arabia
The providers above operate internationally. Information may be processed outside Saudi Arabia, including in the United States for Groq. Hosting locations and provider subprocessors can change; we do not represent that all processing stays within the Kingdom.
Cross-border processing remains subject to the Saudi requirements that apply to the relevant transfer, including appropriate safeguards where required. Using a provider does not by itself establish that every transfer meets those requirements. Contact us before submitting information that requires a particular hosting location, confidentiality arrangement or sector-specific treatment; the public forms and assistant are not designed for those materials.
06 — How long information remains
Retention depends on the purpose and the system holding the record. Deleting a website record does not automatically delete email or a provider’s separate scheduling record.
- Enquiry delivery metadata: the website retains the reference, payload HMAC, delivery state and timestamps for 30 days. Expired entries are removed when subsequent form requests trigger cleanup. Full enquiry text is delivered by email and is not stored in that metadata table.
- Booking records: the booking notice displays the configured website retention period, normally 90 days after the meeting. Scheduled maintenance removes eligible completed, cancelled and failed records after that period; unresolved bookings may remain while their status is reconciled. Cal.com and Outlook retain separate records under their settings and policies.
- Enquiry emails and ongoing business correspondence: retained while needed to respond, manage a relationship or meet applicable legal and recordkeeping duties. There is no verified automatic 30-day mailbox deletion rule. Ask us to review information you want removed.
- Assistant conversations: kept in page memory and cleared on reload or starting again. Tetra does not store transcripts in its database or application logs. Groq states that inference inputs and outputs are not retained by default, but may be kept for up to 30 days for reliability or abuse monitoring, or longer where legally required. We do not claim a separately verified zero-retention arrangement.
- Security counters: some remain for up to 35 days; cleanup runs on subsequent requests after expiry. Hosting providers may keep their own operational logs under their policies.
- Privacy choice: saved in a first-party cookie for 180 days unless you change or clear it sooner. A session page-position record ends with the browser session. Legal preservation requirements can justify retaining particular records longer.
07 — Your choices and rights
Subject to applicable law and its exceptions, you can ask to be informed about processing, access or obtain a copy of your personal data, correct it, or have it destroyed when it is no longer required. You can withdraw consent for processing based on consent. Withdrawal does not undo processing already lawfully carried out; some information may need to remain for another applicable legal reason.
Email info@tetra.sa with a description of your request and the relevant enquiry or booking reference if available. Do not include identity documents in your first message. We may request proportionate verification to avoid disclosing someone else’s information. There is normally no charge to exercise your rights.
We aim to respond within the applicable statutory period, normally 30 days. Where the law permits an extension, we will explain the reason and timing; an extension may be up to a further 30 days. You may also raise a personal data protection complaint with the Saudi Data & AI Authority through its official personal data governance platform.
Cookie preferences can be changed at any time from “Cookie settings”. Cancel or change an appointment using the secure management link provided with your booking where available. For other requests, contact the team. Turning off previews prevents further embedded loading but cannot reverse data already received or erase storage on another website’s origin.
08 — Security and minimisation
We use HTTPS, server-side provider connections, input validation, abuse limits, protected operational endpoints and encrypted website booking records. Credentials and private records are not included in the public content directory. These measures reduce risk; no website or transmission can be guaranteed completely secure.
Please avoid entering confidential or sensitive information into public forms or AI prompts. If you believe you have found a security or privacy issue, contact info@tetra.sa with a concise description and no unnecessary personal data. Do not attempt to access other people’s records.
09 — Audience and updates
This is a business-services website intended for adults acting for themselves or an organisation. It is not directed at children. If you believe a child has submitted personal information, contact us so we can review and address it.
This notice was updated on 25 October 2026. Material changes will be reflected here; if a new optional purpose needs consent, we will request it before enabling that purpose. This notice describes the website and does not replace additional obligations in a signed client agreement.