Privacy Policy

Effective date: March 2026

Last updated: March 6, 2026

1. Data Controller

IntellX LLC is the data controller responsible for your personal data collected through the PanelX analytics dashboard and the panelx.ai website. We determine the purposes and means of processing personal data for dashboard users.

All third-party service providers that process personal data on our behalf act as data processors under our instruction and are bound by data processing agreements.

Personal data collected through the Baseerah panelist mobile application is covered by a separate privacy policy. PanelX dashboard clients receive only aggregated, anonymized market data and are not data processors of any panelist personal data.

2. Personal Data We Collect

2.1 Dashboard User Data (B2B Clients)

When you register for and use the PanelX analytics dashboard, we collect the following categories of personal data:

• Identity and contact data: Your name, email address, and organization name, provided during registration.
• Authentication data: Session tokens and authentication state managed by our identity provider, Clerk. This includes the credentials you use to sign in (email and password, or single sign-on).
• Subscription and permission data: Your subscription tier, the data categories your subscription covers, and your access permissions within the dashboard.
• Usage logs: Pages viewed, queries run, reports generated, and exports downloaded. Used for platform improvement and support.

2.2 Website Visitors

When you visit panelx.ai, we collect standard web analytics data including IP address, browser type, operating system, pages viewed, time on page, and referral source. This data is used to understand website usage and improve content.

3. Legal Basis for Processing

We process personal data on the following legal bases under the PDPL:

• Contractual necessity: Processing your name, email, organization, authentication data, subscription data, and usage logs is necessary to provide the PanelX analytics service under the subscription agreement.
• Legitimate interest: Processing technical data (IP address, device, browser) for security monitoring and error detection is in our legitimate interest to maintain a secure and reliable service.
• Consent (PDPL Article 10): Where we use cookies or tracking technologies beyond those strictly necessary for the service, we obtain your consent. See Section 5.

4. Purposes of Processing

We process personal data for the following purposes, as disclosed at the time of collection per PDPL Article 13:

• Providing access to the PanelX analytics dashboard under the subscription agreement.
• Managing your account: authentication, permissions, and subscription tier enforcement.
• Delivering aggregated and anonymized market intelligence to subscribed clients. No individual panelist data is included in any client-facing output.
• Communicating with you about your subscription, service updates, and support requests.
• Detecting and preventing unauthorized access, fraud, and security incidents.
• Monitoring platform performance, diagnosing errors, and improving the service.
• Generating aggregated, anonymized usage statistics to understand how the platform is used.

We do not sell personal data to third parties. We do not use your personal data for advertising or marketing purposes beyond communicating with you about PanelX services you have subscribed to or expressed interest in.

5. Cookies and Tracking

We use cookies and similar tracking technologies on panelx.ai and the PanelX dashboard. Cookies are small data files stored on your device.

5.1 Strictly Necessary Cookies

These cookies are required for the service to function and cannot be disabled. They include:

• Authentication cookies: Set by Clerk to maintain your signed-in session. Without these, you cannot access the dashboard.
• Security cookies: Used to protect against cross-site request forgery (CSRF) attacks.

5.2 Analytics and Performance Cookies

We collect standard web analytics data (pages viewed, referral source, session duration, browser type) to understand how visitors use panelx.ai. This data is aggregated and does not identify you individually. No third-party advertising or behavioral tracking technologies are used on panelx.ai.

Error monitoring is provided by Sentry (see Section 7). Sentry may capture your user ID and technical session data in the context of an error report. This is used solely for diagnosing and fixing platform issues.

6. Cross-Border Data Transfers

In accordance with PDPL Article 29, we disclose the following cross-border data transfers that apply to dashboard user data. Processing is based on contractual necessity and adequate safeguards are in place for each transfer.

6.1 Clerk (United States)

Clerk manages authentication for PanelX dashboard users. Clerk stores your email address, name, and session tokens. Legal basis: contractual necessity (PDPL Article 29(1)(c)). Safeguard: Data Processing Agreement with Clerk incorporating Standard Contractual Clauses.

6.2 Vercel (Mumbai, India)

The PanelX dashboard application is hosted on Vercel. Server-side rendering and API routes run on Vercel serverless functions deployed in the Mumbai (bom1) region. Dashboard user request payloads (authentication tokens, query parameters) transit through Vercel infrastructure. Personal data is processed transiently and is not persisted on Vercel servers beyond request handling. Legal basis: contractual necessity. Safeguard: Data Processing Agreement with Vercel incorporating Standard Contractual Clauses.

6.3 Sentry (United States)

Sentry provides error monitoring for the PanelX platform. When a platform error occurs, Sentry may capture your user ID, session context, and technical stack trace. No purchase data or market intelligence data is included in error reports. Legal basis: legitimate interest in platform security and reliability. Safeguard: Data Processing Agreement with Sentry.

6.4 Resend (United States)

Resend delivers transactional emails to dashboard users (account confirmations, subscription notices, support responses). Resend processes your email address and the content of transactional messages. Legal basis: contractual necessity. Safeguard: Data Processing Agreement with Resend.

6.5 AWS (Bahrain)

Our primary database is hosted on Amazon Web Services infrastructure in the Middle East (Bahrain) region (me-south-1). Dashboard user account data and subscription records are stored in this database. While geographically proximate to KSA, Bahrain is a separate sovereign state. We conservatively treat this as a cross-border transfer under PDPL Article 29. Legal basis: contractual necessity. Safeguard: Data Processing Agreement with AWS incorporating SDAIA-approved Standard Contractual Clauses.

7. Data Retention and Deletion

In accordance with PDPL Article 11, we retain personal data only for as long as necessary to fulfill the purposes for which it was collected. When data is no longer necessary, we cease collection and destroy it without undue delay.

7.1 Dashboard User Account Data

Your name, email, organization name, subscription data, and authentication records are retained for the duration of your subscription plus 90 days after subscription termination. The 90-day period allows for billing reconciliation, dispute resolution, and account recovery if termination was in error.

After the 90-day window, account data is permanently deleted from all primary databases and will be purged from backup cycles within 30 additional days.

7.2 Usage Logs

Dashboard usage logs (pages viewed, queries run, exports generated) are retained for 12 months from the date of the activity. After 12 months, logs are deleted or anonymized such that they can no longer be associated with your account.

7.3 Website Analytics

Aggregated website analytics data (visit counts, page views, referral sources) is retained for up to 24 months. This data is not identifiable to individual visitors.

7.4 Processing Activity Records

In accordance with PDPL Implementing Regulations Article 18, we maintain records of all processing activities for the duration of processing plus five years after completion.

8. Your Rights Under PDPL

Under PDPL Article 4, you have the following rights regarding your personal data:

• Right to access (Article 5): You may request a copy of all personal data we hold about you.
• Right to a readable copy (Article 6): You may request your data in a structured, machine-readable format (JSON or CSV).
• Right to correction (Article 7): You may request correction of inaccurate personal data we hold about you.
• Right to restrict processing (Article 7): You may request that we restrict certain processing activities.
• Right to erasure (Article 8): You may request deletion of your personal data. See Section 7 for our retention and deletion schedule.
• Right to complain to SDAIA (Article 9): You may file a complaint with the Saudi Data and Artificial Intelligence Authority if you believe your data protection rights have been violated.

To exercise any of these rights, contact our Data Protection Officer at privacy@panelx.ai. We will respond to your request within 30 days.

9. Sub-Processors

We engage the following sub-processors to process dashboard user personal data on our behalf. Each is bound by a Data Processing Agreement.

Panelist data processed through the Baseerah app involves a separate set of sub-processors (AWS, Vercel, Anthropic, Voyage AI). Those are disclosed in the Baseerah Panelist Privacy Policy.

10. Changes to This Policy

We use date-based versioning for this privacy policy (format: YYYY-MM-DD). Material changes that affect data processing (new categories of data, new processors, new transfer destinations, changes in retention periods, or changes in processing purposes) will be communicated to active dashboard users by email at least 14 days before taking effect.

Non-material changes (typo corrections, clarifications, formatting improvements) take effect immediately and do not require advance notice. The "last updated" date at the top of this policy will always reflect the most recent revision.

11. Contact Information

For questions about this privacy policy, to exercise your data subject rights, or to file a complaint about our data handling practices, contact our Data Protection Officer:

You also have the right to file a complaint with the Saudi Data and Artificial Intelligence Authority (SDAIA) if you believe your data protection rights have been violated.

This privacy policy is published in English. An Arabic translation will be made available. In the event of conflict between the Arabic and English versions, the Arabic version shall prevail.