01 Who I am
This site belongs to Doaa Aref. The services offered through it — Ops in a Box, Runbase Kits and Shadow CEO — are provided by [legal entity] under the name Runbase.
For anything in this policy you can reach me directly at i@doaaaref.com.
Two documents in one place: what happens to your data, and what the terms are if we work together. Both are written to be read rather than skipped.
Plain answers to the only questions that matter: what I collect, why I have it, who else sees it, and how you get it back or get rid of it.
This site belongs to Doaa Aref. The services offered through it — Ops in a Box, Runbase Kits and Shadow CEO — are provided by [legal entity] under the name Runbase.
For anything in this policy you can reach me directly at i@doaaaref.com.
It covers the personal data collected through this website and through the work that follows from it: enquiries, booked calls, kit purchases and client engagements.
It does not cover other websites you may reach from here. Once you leave, that site is governed by its own policy.
I do not collect national ID numbers, health data, or any other sensitive category, and I ask you not to send them.
I do not use your data to build advertising profiles, and I do not make automated decisions about you.
Depending on the situation: your consent, the performance of a contract with you, a legal obligation such as tax records, or my legitimate interest in running and improving the business.
Where I rely on consent, you can withdraw it at any time. Withdrawing it does not undo what was done before.
Only the service providers needed to run the business, and only for that purpose:
I do not sell your data, rent it, or share it for advertising. It may also be disclosed if a Saudi authority or a court legally requires it.
Some of the providers above operate outside Saudi Arabia, so your data may be processed abroad under their own safeguards. I pick providers that offer a reasonable standard of protection, but the moment data sits with them it is also governed by their terms.
Under the Saudi Personal Data Protection Law you can ask me to:
Write to i@doaaaref.com and I will respond within 30 days. If you are not satisfied, you can raise it with the Saudi Data and Artificial Intelligence Authority (SDAIA).
The site uses a small number of cookies: the essential ones that make pages work, and analytics cookies that show which pages are read. No advertising cookies.
You can block or delete cookies from your browser settings. Blocking the essential ones may break parts of the site.
Access is limited to me and to anyone directly working on your engagement, accounts are protected with strong authentication, and files are kept in reputable services. No system is perfect, so if a breach ever affects your data I will tell you and the regulator as the law requires.
This site and these services are meant for businesses and the adults who run them. I do not knowingly collect data from anyone under 18.
If this policy changes, the updated version is posted here with a new date at the top. For a material change affecting existing clients, I will say so by email.
How the three services actually work: what you get, what it costs, who owns the output, and how either of us can walk away.
These terms apply to the services offered through this site under the name Runbase, provided by [legal entity], represented by Doaa Aref.
By booking a call, buying a kit, or signing an engagement, you accept these terms.
For advisory and retainer work we sign a separate scope of work. Where that document and these terms disagree, the scope of work wins.
Prices are not published. Every advisory or retainer engagement is quoted after the first call, and a written quote stays valid for 14 days.
Work begins once you accept in writing and any first payment has cleared. Anything outside the agreed scope is quoted separately before it starts — no surprise line items.
If an invoice passes 30 days overdue I may pause the work until it is settled. I will tell you before I do.
A kit is delivered as a download immediately after payment. You get a non-exclusive, perpetual licence to use and adapt it inside your own business, for your own team.
You may not resell it, redistribute it, publish it as your own product or template, or share it outside your company.
Because the files are delivered instantly, a completed purchase is not refundable once downloaded. If a file is broken, incomplete, or not what the page described, tell me within 14 days and I will fix it or refund it in full.
The role is advisory. You keep the title, the authority and the final decision on everything.
The work depends on accurate information and timely access. That means one named decision maker, access to the people and the numbers we agreed on, and replies within a reasonable time.
Where delays come from your side, the timeline moves accordingly and the fees stay as agreed.
Anything you share with me about your business stays confidential, and anything I share with you about my methods and materials stays confidential too. This holds during the engagement and after it ends.
It does not apply to information that is already public, that you or I knew beforehand, or that a competent authority legally requires to be disclosed.
Deliverables produced specifically for you — your procedures, your service levels, your owner map, your documents — become yours once the engagement is paid in full.
The methods, frameworks, templates and tools I brought with me stay mine, and I keep the right to reuse them with others. Nothing in a deliverable gives you ownership of those underlying materials.
I bring twenty years of operating experience and honest judgment. I do not promise a revenue number, a funding round, a valuation, or any other business outcome — those depend on your market, your team and decisions that remain yours.
Nothing I provide is legal, tax, accounting, or investment advice. For those, use a licensed professional.
My total liability for any claim connected to an engagement is capped at the fees you paid in the three months before the claim arose.
I am not liable for indirect or consequential loss — lost profit, lost data, lost opportunity, or loss of reputation. Nothing here limits liability that the law does not allow to be limited.
I may mention that we worked together and describe the kind of work in general terms. I will not publish your figures, your documents, or anything confidential without your written permission, and if you would rather I did not mention you at all, tell me and I will not.
Either side can end an engagement with 30 days written notice. Work completed and hours used up to that point are payable, and I will hand over everything produced so far in a usable form.
Either side may end it immediately for a serious breach that is not fixed within 14 days of being raised in writing.
These terms are governed by the laws of the Kingdom of Saudi Arabia, and any dispute is settled by the competent courts in Riyadh. Before anyone files anything, we talk — most of it is solvable in a call.
These terms may be updated, and the current version is always the one on this page with the date at the top. The terms that apply to your engagement are the ones in force on the day you accepted the quote.
Ask before you sign anything. I answer these myself, usually the same day.
Email me →If anything here is unclear, or you want to see, correct or delete what I hold about you, one email is enough.