Privacy Policy

1.1 Personal Information

When you create your account or use our services, we may collect:

• Account Data: Name, email address, phone number
• Employment Information: Job title, company name, industry, professional experience
• Employee Data (in Company Consultant mode): Names, job titles, contract details you enter to generate documents

1.2 Usage Information

We collect information about how you interact with our services:

• Chat messages with the AI assistant and search queries
• Documents you create or edit through the platform
• Files you upload for analysis or to add to your company's knowledge base
• Pages and features you use within the application

1.3 Technical Information

We automatically collect certain technical information:

• IP address, browser type, operating system, device identifiers
• Log files, performance data, and error reports
• Cookies and similar tracking technologies

1.4 Authentication Data

To secure your account and manage access:

• Google account information (when using Google OAuth sign-in)
• Encrypted and hashed passwords (for email/password-based accounts)
• Session tokens and authentication cookies
• Account preferences and language settings

2.1 Service Delivery and Operation

We use your information to:

• Provide and maintain our AI-powered HR assistant services specializing in Saudi labor regulations
• Process chat messages and retrieve relevant information from the regulatory knowledge base
• Create and manage documents (employment contracts, letters, spreadsheets) based on the data you provide
• Extract text from uploaded files to add to your company's knowledge base
• Personalize your experience based on language preferences and settings

2.2 Communications

We may use your information to:

• Send important updates about our services and terms changes
• Respond to your inquiries and provide technical support
• Send invitations to join company workspaces
• Notify you of changes to our Terms of Service or Privacy Policy

2.3 Security and Improvement

We use your information to:

• Monitor retrieval quality and improve answer accuracy
• Detect and prevent unauthorized use or suspicious activities
• Log AI model usage for performance monitoring purposes
• Comply with legal obligations and regulatory requirements

3.1 With Your Consent

We may share your information when you provide explicit consent.

3.2 With Service Providers

We work with trusted third-party service providers to operate specific aspects of our services:

• AI Model Providers: The platform relies on multiple AI models for processing conversations, analyzing text, and extracting information. These models may include — without limitation — services from OpenAI, Google, Anthropic, and other model providers including open-source models. We reserve the right to change or add model providers based on service needs and performance quality.
• Authentication Services: Google OAuth for Google account sign-in.
• Infrastructure Services: Cloud hosting, database, and file storage providers to run the platform securely and reliably.

All service providers are subject to contractual obligations preventing them from using your data for purposes other than providing the agreed-upon service.

3.3 Legal Requirements

We may disclose your information if required by law or in response to:

• Court orders or legal proceedings
• Requests from competent government authorities or official investigations
• Protecting our rights, property, and users
• Preventing fraud or illegal activities

3.4 Business Transfers

In the event of a merger, acquisition, or asset sale, your information may be transferred as part of the business transaction while maintaining the same level of protection.

We implement multi-layered security measures to protect your information:

• Transit Encryption: All communications are encrypted using TLS/HTTPS protocols
• Password Encryption: Secure hashing of passwords — never stored in plain text
• Invitation Token Security: Company invitation tokens are stored as hashed values only — the original token is never saved in the database
• Row-Level Permissions: Database security rules ensure each user can only see their own data and their company's data
• Multi-Layer Verification: Permission checks are performed at both the database and server levels
• Data Isolation: Each company's data is architecturally separated — independent knowledge base, conversations, and documents per company

While we strive to protect your information using the best available security practices, no method of internet transmission or electronic storage is 100% secure.

5.1 Access and Update

You can access and update your personal information through your account settings in the application.

5.2 Data Portability

You can request a copy of your data in a structured, machine-readable format by contacting us.

5.3 Deletion

You can request deletion of your personal information, subject to legal and operational requirements that may necessitate retaining some data.

5.4 Unsubscribe

You can unsubscribe from promotional communications by following the unsubscribe instructions in our emails.

5.5 Cookie Management

We use a consent banner that allows you to manage cookie preferences. Essential cookies are required for website operation and authentication (mandatory). Analytical cookies help us understand usage patterns and improve the service (optional). You can change your preferences at any time.

We retain your information as long as necessary to:

• Provide our services and operate your account
• Comply with legal and regulatory obligations
• Resolve disputes and enforce our agreements
• Improve service quality and answer accuracy

When you delete your account or the data is no longer needed, we delete or anonymize it in accordance with applicable requirements.

Your information may be transferred to and processed in countries other than Saudi Arabia. In accordance with Saudi Personal Data Protection Law (PDPL) requirements, we ensure transfers are conducted with appropriate safeguards including:

• Standard Contractual Clauses (SCCs) as applicable
• Transfer to countries with adequate levels of data protection
• Your explicit consent for necessary data processing

Some data may be processed outside Saudi Arabia through infrastructure service providers and AI models, subject to appropriate contractual safeguards. By using our services, you consent to this transfer.

Our services are not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If we learn that we have collected data from a child under this age, we will take immediate steps to delete it.

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of any material changes by:

• Posting the updated policy on our website
• Updating the "Last Updated" date at the top of this page
• In-app notification for material changes

Your continued use of the service after changes are posted constitutes acceptance of those changes.