Responsibility and data
Abdullah Al-Dahshan, operating Dahshan Labs in Riyadh, Saudi Arabia, is the controller for personal data submitted through this website and contact form.
What we receive
- Project brief
- The text you choose to submit.
- Required email
- We need an email address so we can reply. Without it, we cannot respond through the form.
- Optional phone
- Adding a phone number is your choice. Leaving it blank does not prevent submission.
- Locale and technical security data
- Your selected language plus data needed to deliver and protect the form, such as timing, request identifiers, and pseudonymous anti-abuse keys.
Use, consent, and AI
We use the submitted information only to:
- understand and evaluate your inquiry
- reply and decide on an appropriate next step
- prevent spam, replay attempts, and other abuse
By selecting Send brief, you ask us to use the information for these purposes and consent to that processing. You may withdraw your consent by email. If you withdraw before we reply, we may not be able to continue the inquiry.
No contact classifier is active today
We do not currently use an AI model or large language model to classify contact submissions. Before enabling any classifier, we will update this notice and explain what content is sent and which provider processes it.
Providers and transfers
Three service providers support the current contact flow:
- Vercel
- Hosts the website and contact API, and processes requests sent through them.
- Microsoft 365
- Delivers the contact notification and holds it in our mailbox.
- Supabase
- Stores only pseudonymous operational HMAC keys for rate limits, abuse prevention, and replay protection. Under the current design, Supabase does not receive or store the project brief, email address, or phone number.
Processing outside Saudi Arabia
These providers may process data outside the Kingdom of Saudi Arabia. The Supabase project is currently hosted in India. Vercel and Microsoft use global infrastructure, so processing may also occur in other countries. Service locations can change, and we will review this notice when the architecture changes.
Retention and security
We may keep inquiry data for up to 12 months after the last activity. If an inquiry becomes an engagement, related business or project records may be kept longer. We may also retain information for longer where law requires it.
Pseudonymous operational security keys expire after 30 days and are deleted during the next daily cleanup cycle.
How we protect the flow
Measures include encrypted transport, access controls, scoped server credentials, rate limits, cookie-free proof-of-work spam protection, and pseudonymous HMAC keys. Form content is kept out of Supabase under the current design.
No online service can guarantee complete security. Please do not send passwords, access keys, or sensitive information that we do not need to evaluate your inquiry.
Your rights and tracking
Subject to the Saudi Personal Data Protection Law, its implementing rules, and applicable exceptions, you may ask us to:
- explain how your personal data is used and give you access to it
- provide a clear copy of your personal data
- correct, complete, or update your personal data
- destroy your personal data where the right applies
- withdraw consent for this contact flow
We may ask for reasonable information to verify your identity before acting on a request. You may also raise a concern with the competent Saudi data protection authority where applicable.
For a privacy question or rights request, email hello@dahshanlabs.com.
Analytics and cookies
This site does not currently use marketing analytics or tracking cookies. Hosting platforms may still create operational and security logs needed to deliver and protect the service. Dahshan Labs does not use those logs to build marketing profiles about visitors.