Privacy Policy
This policy explains what STK collects when you visit stk.sa or send an enquiry, why, where it is kept and for how long. It describes what the site actually does, not what a policy usually says.
Last updated 6 October 2026
What we collect
When you send an enquiry, through the contact form or the site assistant: your name, your entity or organization (or that you are an individual), your email address and/or phone number, the type of project where you select one, the message you write, and whether it came from the form or the assistant.
Alongside the enquiry, to protect the form from abuse: a one-way hash of your IP address (the address itself is never stored), your browser's user-agent string and the page you arrived from.
When you browse: the site loads its typefaces from Google Fonts, which receives your IP address when the font files are requested, and it runs a business-visitor identification script that may set cookies and try to associate your visit with the organization you belong to. The site carries no advertising trackers.
Why we use it
To answer your enquiry and prepare a proposal, and to send you one automatic confirmation that it arrived.
To keep the enquiry form usable, by rate-limiting automated submissions and recognising abuse.
To understand which organizations show interest in the studio's work.
Under the Saudi Personal Data Protection Law, we rely on your consent when you submit an enquiry and on STK's legitimate interest in running and protecting its own site.
Where it goes
Enquiries are stored in a managed database hosted in the European Union and delivered to info@stk.sa through a transactional email service. The site itself is served from a hosting network with edge locations worldwide.
These providers process the data on STK's behalf under their own security commitments. STK does not sell personal data and does not share it with anyone else, except where the law requires.
How long we keep it
Enquiries are kept only as long as needed to answer and follow up, maintain appropriate business records, resolve disputes and meet legal requirements. They are then deleted or anonymized. You may ask us to delete your information sooner where the law permits.
Hashed network identifiers and records of blocked submissions are used to operate and protect the enquiry service. The rate limit examines activity in the trailing hour.
The site assistant
The site offers an AI assistant, Saud, that answers questions about STK and STK Lite and can help you prepare a request. What you type in the chat is sent to an AI service provider only to generate the reply; the provider processes it on STK's behalf under its own security commitments.
STK does not store your conversations and does not use them to build a profile of you. To protect the assistant from abuse, only the minimum technical data needed is kept: a one-way hash of your IP address (the address itself is never stored) and a timestamp, which are deleted after 24 hours.
The assistant never sends anything on its own. A request is created only when you review the summary it shows and press send yourself; it then becomes an enquiry and is handled and kept exactly as described in the rest of this policy.
Please do not share sensitive personal data in the chat, such as identity numbers, health or financial details, or passwords. The assistant's answers may contain mistakes, and the team's written reply is the authoritative one. If you prefer, you can use the contact form instead.
Your rights
You can ask what we hold about you, ask for it to be corrected or deleted, or object to how it is used. Write to info@stk.sa from the address you used; we acknowledge within two working days and complete the request within the period the law allows.
If you are not satisfied with our answer you may raise the matter with the Saudi Data & AI Authority (SDAIA), the competent authority under the law.
Cookies and local storage
When configured, Google Analytics runs only after you allow optional analytics in Cookie settings. It measures page visits and successful enquiries without sending contact-form contents. Advertising personalization is disabled. You can withdraw consent using Cookie settings in the footer.
The site remembers your language and optional analytics choice in local storage. With your permission, Contentsquare (Hotjar) uses cookies beginning with _cs_ or _hj to produce heatmaps and session recordings of clicks, scrolling and page interactions. Form and assistant content is masked, and STK does not send your name, email, phone number or enquiry text through the analytics events or identity APIs.
You can allow or reject Contentsquare (Hotjar) in the consent notice, or change your choice using Cookie settings in the footer. Withdrawal reloads the page to stop the recorder and clears its cookies. Analytics refusal does not affect the site or sending an enquiry. Contentsquare processes the collected interaction data under its service terms; retention depends on the configured account plan. The separate business-visitor identification script may set its own cookies.
Changes
We update this policy when the site changes. The date at the top shows the latest revision.
Contact
Questions about this policy or your data can be sent to info@stk.sa.