Privacy Policy

VR Decorations is a brand owned by the company registered as اكسبرتس هاوس المحدودة (Commercial Registration 7034690904), 3431 Al Jamiah St, Al Malaz, Riyadh 12642, Saudi Arabia. Data questions: sales@vrdecorations.com or +966 54 129 8863.

• “Start your project” requests: project type, location, scope, area, stage, services needed, the material you already have, preferred style, timing and budget if you give them, plus your name, mobile number, email if entered and client type; for a company, its legal name, registration and VAT numbers if entered.
• Files you upload with your request (plans, photos, PDFs): up to 10 files, 15 MB each, 60 MB in total.
• Technical and security data: to prevent abuse and spam we briefly keep a one-way hash of your IP address (never the address itself, and it cannot be recovered from it); our hosting provider keeps ordinary access logs (IP address, requested page including search words, browser type).
• The Orabi chat assistant: you can type free text (up to 400 characters per message). Each message is sent over an encrypted connection to our server, matched against set rules and published content, and answered; we do not save the text of your messages, do not write it to our application logs, and do not send it to any outside service. Opening Orabi starts the same strictly necessary session described in the cookie notice, which holds a security token and, after you register a request, its reference number for the rest of the session. To limit abuse we keep a count against a one-way hash of your IP address (never the message). If you choose to register a request through Orabi and confirm sending, we store your name, phone number and/or email, the project type you chose, an optional message of up to 500 characters and the date and time, under a reference number; those details are also emailed to our sales team at sales@vrdecorations.com, and the same retention and sharing rules as a project request apply. Orabi works from set rules and published content; it is not a person and not a generative AI. Please do not type sensitive personal data into the chat.
• When you contact us by phone, WhatsApp or email, we receive what you send through that channel.

We use no advertising or analytics cookies and no third-party trackers.

• To study and answer your request and contact you about it — based on your consent when you submit, and to take steps you ask for before any contract.
• To protect the website and the form from abuse and spam and keep our systems secure.
• To meet legal obligations that apply to projects that become contracts.

We never use your files or request for marketing, never publish or sell them, and never use them to train AI systems.

• Our authorised team only, by role; every view and file download is recorded in an audit log.
• Our hosting provider, which runs the website and its database.
• Cloudflare Turnstile, when enabled: a check that a submission comes from a person rather than a bot. It handles your browser's connection and processing may take place outside Saudi Arabia. We do not send it your request.
• WhatsApp, if you choose to contact us there, under its provider's policies.

We share your data with no one else unless the law requires it.

• Requests that do not become a project: 12 months from receipt, then their personal data is erased.
• Their files: 90 days from upload.
• Requests that become a project: the records needed for the relationship and legal obligations up to 10 years; uploaded files are deleted 24 months after conversion unless there is a justified need.
• Abuse-prevention records: one day to 90 days at most. Internal audit log: 7 years.
• An unsent draft stays on the server only for the session (about two hours of inactivity); its files are deleted within two days if the request is not sent.

Under the PDPL you may be informed about how your data is processed, access it and get a copy, correct it, ask for it to be destroyed and withdraw your consent. Write to sales@vrdecorations.com with your request reference if you have one; we may verify your identity first and will answer within the periods set by the law. When you ask for deletion we delete the request and its files without delay unless the law requires us to keep them, and keep only its reference number as proof. You may also complain to the Saudi personal-data protection authority (the Saudi Data and AI Authority, SDAIA).

Connections to the site are encrypted; your files are kept in private storage outside the public part of the site under random names; access is limited to specific roles with mandatory two-step verification; every view and download is logged; and data is deleted automatically under the retention periods.

We may update this policy when the website or the applicable law changes. Each request records the policy version you agreed to. Current version: privacy-2026-10-01.