Sub-processor List — Linebooth

Effective date: 2026-09-04
Version: 1.0 (see the change log at the end)
Published at: linebooth.com

Service provider: an individual seller (name not yet published) · بائع فرد (الاسم غير منشور بعد) — an individual working under a Freelance Certificate. Certificate number: not yet published — registration details will be published here. Address: not yet published — registration details will be published here.
Contact: support@linebooth.com (a phone number will be published here; email is the monitored channel)

This page is kept up to date as our suppliers change. The version published at linebooth.com is always the current one, and it prevails over any copy you have saved or printed.

The marks used on this page.

• [TO BE COMPLETED] — the cell has not been filled in yet. Every one of these must be filled in before this page is published and before the paid service launches.
• — a point that needs a lawyer's check before publication.
• [OWNER TO CONFIRM: …] — a fact only the owner can verify. The sentence it sits on must not be published until it has been confirmed as true.

1. What this page is

To run Linebooth we rely on a small number of outside companies — for example the company that hosts the website, the company that stores the database, and the company that provides the AI features. Some of them can access personal data belonging to you.

This page lists those companies, what each one does for us, what kinds of personal data each one can access, and where each one hosts that data.

We publish it so that:

• you can see who handles your data before you subscribe; and
• we meet our transparency duty under the Personal Data Protection Law (PDPL) and its Implementing Regulations, including Article 33 of the Implementing Regulations, on engaging other parties to process personal data.

Our responsibility does not move. Using these companies does not transfer our responsibility to them. The seller — an individual seller (name not yet published) — remains responsible to you for the personal data handled on our behalf. We choose each company, we instruct it, and we keep it under review.

Who else sees your data. We do not disclose your personal data to anyone outside the companies listed on this page, and then only as far as is needed to provide the service shown next to that company. We may also disclose data where a Saudi authority or a court requires it.

Cookies and identifiers. Several companies in the table below handle device or session identifiers, request logs and email-delivery records. For the scope of our use of cookies and similar identifiers, see the cookie section of our Privacy Policy at linebooth.com (this disclosure is required by Article 6 of the Implementing Regulations of the E-Commerce Law).

2. Where these companies are, and the basis for sending data abroad

Please read this section before you subscribe.

• Every company we use today is located outside the Kingdom of Saudi Arabia. Each company's hosting region is stated in the table below. If a company we use is ever hosted inside the Kingdom, its row will say so.
• Your account data, and the scripts you save in the app, are stored and processed outside the Kingdom.
• Basis for the transfer. There is no published list of countries treated as providing an adequate level of protection. Before the paid service launches we will prepare, date and keep a written transfer risk assessment, and we will refresh it whenever a company on this list changes. Once it is in place, this page will say so and give its date.
• The transfer rules extend to onward transfers. Article 5 of the Personal Data Transfer Outside the Kingdom Regulation applies the transfer rules to any further transfer that one of these companies makes to its own sub-processors. In plainer words, the protections that apply to the company we chose must also apply to the companies it uses. We do not engage a company to handle personal data unless its written terms carry those protections through to its own sub-processors; where a company's written terms do not, we do not use it for personal data. We also aim to look at what each company publishes about its own sub-processors whenever we update this page.
• We use a small number of companies.

3. The service is for adults only (18 or over)

Policy issued by the Saudi Data and Artificial Intelligence Authority (SDAIA) requires the personal data of minors to be stored and processed inside the Kingdom. Our systems store data outside the Kingdom, so we cannot lawfully serve minors.

For that reason Linebooth is available only to people aged 18 or over. The sign-in screen and the checkout screen each ask you to confirm that you are 18 or over before they will go any further, and the date and time of that confirmation is recorded.

Under the Civil Transactions Law the age of majority is 18, and a subscription taken by a person under 18 does not validly bind that person. If we learn that an account belongs to someone under 18, we close the account, refund in full everything collected for it, and delete that person's personal data from our systems and from the companies listed on this page.

4. The list

How to read the table

• "Categories of personal data accessed" describes what the company can access in order to do its job.
• "Not currently used" means we do not use a company of that type at all today. If we start, this page is updated first.
• We are not registered for VAT. No tax number, VAT number or VAT amount appears on this page, and none appears on any invoice or payment receipt we issue.

5A. The one record we keep verbatim, including after you delete your account

Every payment notification Paddle sends us is stored in our own systems exactly as it arrives, without editing or trimming. Such a notification can contain the billing name, billing address and billing email address you gave Paddle.

We do that for two reasons, and we would rather state them plainly than let you assume the record is anonymous:

1. It is the accounting record of your purchase. A seller must be able to show what was sold, to whom, for how much and when, and must keep that record for the period the law sets.
2. It is our only copy of the customer list. Paddle is under no obligation to hand it back if our account with Paddle were ever closed or frozen. Without it, a customer who has paid could lose access to what they paid for.

What this means when you ask us to delete your account. Your email address is erased from the customer record, every sign-in session and outstanding sign-in link is destroyed, and nothing in the account joins you to the payment record any more. The payment record itself stays, with the billing details Paddle sent, for as long as the law requires a seller to keep it. An account that never paid us anything leaves nothing behind but an irreversible hash and the fact that the free rehearsal days were used. The Privacy Policy at linebooth.com sets this out in full.

5. How long these companies hold data, and what happens when we drop one

Each company keeps personal data only for as long as it needs it to provide its service to us. The retention periods that apply to your data are set out in our Privacy Policy at linebooth.com.

When we stop using a company on this list, or replace it, we will require it to delete or return the personal data it holds for us, and we will record the change in the change log at the end of this page.

6. A note about the scripts you write

The scripts you paste or type into Linebooth are not stored by any company on this list. They are held in your own browser's storage, on your own device, and there is no cloud sync. The same is true of every take you record: the audio is written to your browser's storage and the finished file is assembled and exported on your device.

So there is nothing here for us to disclose, hand over or lose in a breach of our systems — and nothing for us to restore for you either. Delete a script or a project from inside the app at any time, and export the work you want to keep before you clear your browser storage.

The one exception is the AI script-conversion feature: if it is switched on, the text you choose to send to it goes to the AI provider named in the table above. That feature is not connected to any provider today.

7. Changes to this list, and how to raise a concern

We update this page first. Except in the urgent cases described below, we update this page before a new company starts handling personal data, and we raise the version number and record the date of the change in the change log.

Notice. Where it is practical, we aim to email registered subscribers before a new company starts handling personal data, and we may also post the change at linebooth.com.

Urgent changes. If we have to move quickly — for example because a company stops operating, or for a security reason — we may make the change first and tell you afterwards, with the reason.

How to raise a concern. Email support@linebooth.com with "Sub-processor" in the subject line, telling us which company concerns you and why. We will look into it and reply. We cannot run the service without the companies listed here, so if you are not comfortable with a company on this list you can cancel your subscription. Cancellation, and any refund, are dealt with in the Terms of Service at linebooth.com, together with your statutory withdrawal right under Article 13(1) of the E-Commerce Law.

These notices are not marketing. Messages about this list are service messages about your account. We only send marketing messages if you have separately opted in beforehand (Article 25 of the PDPL). You can withdraw that consent at any time, as easily as you gave it (Article 12 of the Implementing Regulations), and we stop sending immediately. Every marketing email we send is marked clearly as advertising and carries a way to unsubscribe (Article 10 of the Implementing Regulations of the E-Commerce Law).

8. Your rights, security incidents, and complaints

Your rights. You can ask us to tell you how your personal data is being used, ask what personal data we hold about you, ask for a copy of it, ask us to correct it, and ask us to destroy it. Where our processing is based on your consent, you can withdraw that consent at any time, as easily as you gave it. Write to support@linebooth.com. We answer within 30 days, and where we need more time we may extend once by a further 30 days.

Security incidents. If personal data is leaked, damaged, destroyed, altered, or accessed without authorisation, and the incident could harm the data, harm you, or conflict with your rights, we notify the Saudi Data and Artificial Intelligence Authority (SDAIA) within 72 hours of becoming aware of it. Where the incident may cause you damage, we also notify you without undue delay. Separately, we notify the Ministry of Commerce within 3 days of becoming aware of it.

Complaints. This is our complaints procedure, and it is the same procedure referred to in our other legal pages:

1. Email support@linebooth.com with "Complaint" in the subject line (a phone number will be published here; email is the monitored channel).
2. Tell us what happened, and how you would like it put right.
3. We record your complaint, look into it ourselves, and reply to you in writing at the email address you wrote from. We acknowledge within 2 business days, and resolve it or tell you the next steps and a realistic date within 10 days.
4. If you are not satisfied with our reply, you may raise the matter with SDAIA (for personal-data issues) or with the Ministry of Commerce (for e-commerce issues).

9. Change log

10. Language and governing law

This page is published in Arabic and English. The two versions were prepared to say the same thing. For customers in the Kingdom of Saudi Arabia, the Arabic version governs if there is any difference between them.

This page and the service are governed by the laws of the Kingdom of Saudi Arabia. Payment, cancellation and refund terms are in the Terms of Service at linebooth.com.

NOT FOR PUBLICATION — delete this block before the page goes live

Closed since version 1.1 — the four [OWNER TO CONFIRM] points are resolved and the sentences that carried them now state the fact: the 18-or-over confirmation is live on both the sign-in and the checkout screen and its timestamp is recorded; scripts and recordings are never stored on a server; the payment integration is Paddle as merchant of record, with card details entered only in Paddle's own fields; deleting a script inside the app is what removes it, because we never had a copy.

This page must still not be published while any of the following is outstanding:

1. The two remaining [TO BE COMPLETED] cells — the region and the terms link for {{AI_VENDOR}}, which are filled in only if and when an AI provider is connected. Every other cell is filled.
2. The written transfer risk assessment — until it exists, section 2 must stay in the future tense exactly as drafted.
3. The signed data-processing agreements with Cloudflare, Paddle and Resend, and the check that each carries the onward-transfer safeguards in its written terms (section 2).
4. The owner's legal name in English and in Arabic, the postal address, the Freelance Certificate number and a telephone number — all of them still shown as "not yet published" in the identity block at the foot of every one of these pages. They are held in tools/identity.json; filling them in there and re-running tools/apply-identity.js updates every page.
5. Every flag.