Legal

Privacy policy

What personal data Renewable Vision holds, why, on what basis, for how long, who processes it, where, and how to exercise your rights under the Saudi Personal Data Protection Law.

Last updated 2026-09-30

Who is responsible for your data

The controller of the personal data this policy describes is Renewable Vision LTD, a company registered in the Kingdom of Saudi Arabia. Write to contact@renewablevision.com.sa about anything in this policy, or use the privacy request form.

This version takes effect on 2026-09-30.

The law this policy follows

This policy follows the Personal Data Protection Law of the Kingdom of Saudi Arabia and its implementing regulations, together the PDPL. It covers this website, the membership and the API it offers, the lists it keeps and the messages it sends.

What we collect

Only what the site’s forms, sign-in and pages collect, listed by where it comes from. The service is not meant for anyone under 18, and we do not knowingly collect their data.

Members

Your full name, checked against a real-name rule when you join.
Your email address or mobile number: your sign-in identifier, and where verification codes are sent.
Your password, which the sign-in provider holds only as a salted hash. The site never stores it in readable form.
Passkeys you add: the public key, a name, the device type and when each was last used. The private key stays with you.
Your profile: organisation, job title, sector, country and the purposes you use the data for, chosen from fixed lists; your language; and whether you asked for updates by email.
If you add a work email, it is used to confirm your organisation and open data downloads; if you ask for download access without one, the short note you write is kept with the decision.
When you joined, the channel you joined through, the page you joined from, and how you reached the site (the campaign tags or referring site of your most recent visit in the 30 days before joining, taken from the site's own visit records).
When you join: the date you accepted the terms and which version of the terms that was.
Your activity while signed in: sign-ins; the pages, dashboards and maps you open, with the map view in the address and how long each page stayed open and in view; the files you download or export; the searches you run on the site; and when you were last active, each with its date and page.
When you download a PDF as a member: a copy stamped with your name, organisation and the date, kept so it can be served again and deleted with your account.
Your watchlist; the views you save (the page, its filters, the name you give each, and when each was saved and last opened); your change-alert choices, including a view an alert follows; and when an alert was last sent to you.
A request for coverage of a sector or place the site does not cover yet, if you send one; a data request you post on the requests board, with how you chose to be shown on it (as a member, by your name, or by your organisation); and your votes on requests. Each is linked to your account.
Corrections and projects you suggest: the page and field, the value you propose, its source, your note, whether you asked to be credited, and when and how it was reviewed. Credit is off unless you tick the box. If you tick it and the suggestion is accepted, the page shows your name, your organisation once your work email is verified, and the date.
If you ask to manage a company page: the company, the domain of your verified work email, the job title and note you give, and the decision on your request. If you manage a page: the announcements and the logo you send, and their review.
API keys, if you create any: a name, the first eight characters, a one-way hash of the key, its daily allowance, daily request counts, and when it was last used or revoked.
Questions you ask RV Analyst are sent to the provider named under processors to compose the answer. For 12 months the site keeps the sectors and places a question names, and the question itself with anything that looks like an email address or a phone number removed, cut to 300 characters, to learn what members need. The answer is not stored.

The RV Plus and RV X list

Your name, work email, organisation, the tier and materials you chose, your language, the page you registered from and when you consented.
Whether you are subscribed, and the delivery, open, click and bounce events the email provider reports for the messages sent to you.

Enquiries and requests

The contact form: name, email, phone if given, organisation, role, the kind of enquiry, the optional project details you choose to add, your message, your language and the page you wrote from. For an enquiry about entering a market, also the markets you target, your company’s home country, what you offer, your references in the region, what you want and the size of the work you have in mind; an automatic reply built from the site’s data is sent to you, and markets the site does not cover yet are recorded as coverage requests. Each enquiry is rated from what it says and from later use of the site under the same email address or company domain, to set its priority for the company.
If you report an error: your message, and a record of each change in its status, kept as the record that it was handled.
A message sent through a company page’s partnership form: your name, email, organisation and message, passed by email to the company’s verified representative. The site does not keep the message.
Data-licence requests: name, email, organisation, role, the licence and datasets requested, and the use described.
Expert Panel applications: name, email, phone, city, public profile page, disciplines, sectors, years of experience, a professional licence number if given, and your summary. Briefs to the panel: organisation, contact name, email, phone, the question, the deadline and the budget band.
Privacy requests: the type, your email address and the details you give.
If you buy a paid product: the order details Paddle sends us (your name, email address, organisation if you give it, country, the product, the amount and tax, any refund, and the dates), Paddle’s reference numbers for the order, the markets and sectors you choose and your language, the account you were signed in with, if any, the file made for you and when it was sent, and, for the tender and award watch, the subscription’s status, its billing dates and when each alert was sent. Card details go to Paddle only; we never receive them.

Business contacts

For business correspondence with professionals in the energy sector, the company keeps a list of names, work email addresses, job titles, employers and their details, cities and public profile pages, taken from a business-contact database.
Every message carries a removal link. An address that asks to be removed is deleted from the list and kept on a removal list with the date and nothing else, so that it is never written to again.

Visits to the site

The site counts its own visits. Each page view records the page, including the site’s own filters in its address (sectors, places, technologies and the like, from fixed lists) and, on a map, the view it opened with; the language; the referring site; any campaign tags in the address; the country, region and city the connection comes from, as the hosting provider reports them (the address itself is never stored); the device class (desktop, tablet or mobile); and how long the page stayed open and in view, where time in a hidden tab is not counted and no page counts for more than 30 minutes. Each view carries two visitor keys: one derived from the network address and browser for that day only, and one derived from the same without the date, so that the site can recognise when the same network and browser return on a later day. Neither key can be turned back into an address or a person. When a member is signed in, the page view is also linked to their account. Searches typed into the site’s search, the data explorer or the project list are kept with their number of results, lower-cased, cut to 100 characters and with anything that looks like an email address or a phone number removed, for 12 months. Pressing “I need this” on a sector or place the site does not cover yet records the request once per visitor. Views of the site’s charts embedded on other websites, with the embedding site’s address, and requests for its share images, feeds and API are counted per day. These records are used to understand which pages and data are read, how many readers return and what they look for, and to report aggregate audience figures. If you choose “Accept all” in the cookie notice, the site also sets one first-party cookie, rv_vid, a random identifier kept for 400 days, so that returning visits are recognised more reliably; it is never shared with a third party. Browsers that send the Global Privacy Control signal are not counted. Third-party analytics (Vercel Web Analytics and, where configured, Google Analytics) load only if you choose “Accept all”.

Some cookies are strictly necessary for the site to work, and are set whatever you choose in the cookie notice: the sign-in provider’s session cookies (their names begin with sb-), which keep a member signed in; rv_pk_challenge, which holds a passkey challenge for five minutes while you sign in or add a passkey; and NEXT_LOCALE, which remembers the language you last read the site in, for the browser session. They are separate from the optional rv_vid cookie, which is set only if you choose “Accept all”.

Why we use it, and on what basis

To provide the membership, dashboards, exports, API keys, alerts and watchlist you asked for, and to verify your identifier: the consent you give when you join, and the service you asked for.
To keep accounts and the site secure, with rate limits, verification codes and audit records: the company’s legitimate interest in protecting the service and the people who use it.
To answer an enquiry, a licence request, an Expert Panel application or brief, or a privacy request: your request.
To send the RV Plus and RV X materials, the weekly digest and, only if you opt in, news of new datasets: your consent, which you can withdraw at any time.
To count visits and measure how the site and the membership are used (time on pages, searches, filters, and the data members open and download), and to report aggregate audience figures: the company’s legitimate interest in running and developing the service. The optional cookie and third-party analytics: your consent, given by choosing “Accept all”.
To describe the audience in aggregate, including to partners and investors: the share of members by type of organisation, sector, seniority and country, and the organisations members work for, never with a member’s name or contact details: the company’s legitimate interest in developing the service.
To understand which organisations use which data, from the organisation a member works for, and to offer those organisations services relevant to them: the company’s legitimate interest in developing the service.
Business correspondence with professionals in the sector: the company’s legitimate interest, with a removal link in every message.
To deliver what you buy, send the alerts of a subscription you pay for, and record refunds: the contract of sale. To keep order records for as long as accounting and tax law requires: a legal obligation.
To meet a legal obligation, or a lawful request from a competent authority.

Personal data is never sold.

How long we keep it

As the site is built today. Where nothing deletes data automatically, it is kept until deletion is requested.

Member records, profiles, passkeys, watchlists, saved views, alert choices and API keys: until you delete your account from the account page, or ask us to.
Suggestions and requests to manage a company page: until the account is deleted, when they are deleted with it. A fact an accepted suggestion added stays on the page with its source, without your name. Announcements and a logo a company published stay on its page.
Account activity, including page views made while signed in, downloads and searches: when an account is deleted, its activity records lose the link to the member and remain only as anonymous counts.
The RV Plus and RV X list: until you ask for deletion. Leaving the list marks your entry unsubscribed, so that nothing more is sent to you.
Enquiries, licence requests, Expert Panel applications and briefs: until deletion is requested.
Visit records: no end date is set. They hold no name or address, and the visitor keys cannot be traced to a person; a page view made while signed in stays linked to the account until the account is deleted, when the link is removed. The optional rv_vid cookie lasts 400 days in your browser.
Searches and RV Analyst questions: 12 months, then deleted automatically.
Requests for coverage and data requests: until deletion is requested. A member’s request loses the link to the account when the account is deleted, and their votes are deleted with it.
Business contacts: until the address is removed. The removal list is kept so that the address is not contacted again.
Privacy requests: kept as the record that each request was answered.
Orders, the files made for them, and invoices: for as long as accounting and tax law requires. When an account is deleted, its orders are kept for that purpose without the link to the account.

Who processes it for us

These providers process personal data on the company’s behalf, each for the task named.

Supabase: the database, sign-in and file storage. The site’s database is hosted in Supabase’s eu-central-1 region, in Frankfurt, Germany, as recorded in the site’s configuration.
Vercel: hosting the site and running its server functions; Speed Insights, which measures how fast pages load, on every visit and without a cookie; and Vercel Web Analytics, only after “Accept all”.
Resend: sending the site’s email, and reporting delivery, opens, clicks and bounces.
Twilio: delivering verification codes by SMS, through the sign-in provider, when you verify a mobile number.
Anthropic: composing RV Analyst’s answers. A member’s question and the conversation are sent to it for that purpose.
Google: Google Analytics, only where it is configured and you choose “Accept all”; and Google sign-in, only if you choose it.
LinkedIn: sign-in, only if you choose it.
Microsoft: if you choose to sign in with it.
Paddle: selling our paid products as Merchant of Record, taking payment, calculating and collecting sales tax, and issuing invoices and refunds. Paddle receives what you enter at checkout, under its own privacy policy.

Transfers outside the Kingdom

These providers run their services on their own infrastructure, largely outside Saudi Arabia. The site’s database is hosted in the European Union, in Frankfurt, and the other providers process data in the regions they publish. Personal data held by the site is therefore transferred outside the Kingdom. The company relies on the contractual safeguards in each provider’s data-processing terms for these transfers.

Your rights

Under the PDPL you have the right:

To be told what personal data is collected, why and on what basis. This policy states it.
To access the data held about you.
To receive a copy of it in a readable, commonly used format.
To have it corrected, completed or updated.
To have it deleted when it is no longer needed, or when you ask, unless the law requires it to be kept.
To withdraw a consent you gave, at any time. This does not affect what was done before.
To complain to the Saudi Data and AI Authority.

To exercise a right, use the privacy request form or write to contact@renewablevision.com.sa. A member can delete their account at once from the account page; a subscriber can leave the list at /unsubscribe; anyone who received business correspondence can use the removal link in it. Before any data is disclosed, changed or deleted, we confirm that the request comes from the person the data is about. We answer requests within 30 days.

Make a privacy request

How it is protected

The measures that protect the data, from encrypted connections to row-level security in the database, are set out on the security page. If a breach affects your personal data, we will notify the competent authority and, where required, you.

Read the security page

Changes to this policy

When this policy changes, the new version is published on this page with its date.

2026-09-30