سياسة الخصوصيةPrivacy Policy

This policy is written against Jordan's Personal Data Protection Law No. 24 of 2023. It explains what we collect, where it is stored, who can reach it, and what your rights are.

1. Our role depends on which data

We are the controller of your account data: your email, your name, your organization's name, and sign-in logs. We are a processor of your operating model content, which you enter and which may contain your staff's names, job titles and the names of document approvers. For that part your organization is the controller and decides the purpose and the means, and we process only on its instructions.

2. What we collect

• Account data: email, name, organization name in Arabic and English, and your password stored as a bcrypt hash, never as text.
• Operating model content: org units, roles, processes, policies, KPIs, risks and services, including any names and job titles inside them.
• Technical logs: IP address, request time and path, kept for security and fault diagnosis.
• Usage events: facts such as "a record was created" or "a document was generated", keyed to the organization and never to a person, carrying no name, no email and no content. We use them to see where people get stuck and how long reaching a first document takes. They are recorded only by us; we use no third-party analytics service.

We do not collect sensitive data as the law defines it. The platform never asks for a national ID number, health data, or bank details.

3. Why we process it

To perform our contract with you and run the service, to protect the platform from abuse, and to contact you about your account. We do not sell or rent data, and we do not use it for advertising.

4. Where it is stored, and does it leave Jordan

Yes, it does. The servers, the database and the backups run in Hetzner's data centre in Falkenstein, Germany. We state that plainly because Jordan's cross-border transfer rules require the receiving party to provide adequate protection, and Germany falls under the EU General Data Protection Regulation, one of the strongest regimes in force.

For entities whose data may not leave the Kingdom, the Sovereign self-hosted plan runs entirely on the entity's own servers. Talk to us before signing up.

5. Who else can reach the data

We do not add a new processor without updating this page, and subscribers get thirty days' notice of any addition that touches their data, so they can object.

6. How long we keep it

Account data and model content are kept while the account exists. After termination: thirty days to export, deletion from live systems within a further thirty days, then from backups as their cycle expires. Technical logs are kept for ninety days.

7. How we protect it

What follows is what is actually in place, not what is planned:

• All traffic is encrypted with HTTPS.
• Passwords are stored as bcrypt hashes and cannot be reversed to the original text.
• Tenant isolation is enforced at the application layer: every query is scoped to the organization's identifier.
• Any AI key you enter is stored encrypted (Fernet), not in plain text.
• Daily backups to separate storage.
• Operational access is limited to the platform operator, and only as far as running the service or fixing a fault requires.

For transparency: there is currently no two-factor authentication on accounts, and no application-level encryption at rest beyond the AI key. If your organization requires either, raise it before contracting.

8. Your rights

The law gives you the right to access your data and get a copy, correct what is wrong or incomplete, have it deleted or anonymised, restrict processing to a specific purpose, move it to another controller, withdraw consent at any time, and be told about a breach that affects you.

To exercise any of these, write to [email protected]. We reply within thirty days. If you work for a subscribing organization and your request concerns data your employer entered, that organization is the controller: we pass the request to them and help them answer it.

9. If there is a breach

If a breach of data security and integrity occurs that could cause serious harm to the data subject, we notify affected data subjects within twenty-four hours of discovering it, and the Personal Data Protection Unit within seventy-two hours, with the source of the breach, the data affected and the steps taken, as the law requires.

10. Cookies

Only what running the service requires: the sign-in session cookie (hk_session), your language preference stored in your browser, and the Cloudflare Turnstile cookie on the signup page to block automated registrations. We use no advertising or tracking cookies.

11. Children

The platform is for organizational use and we do not provide accounts to anyone under eighteen.

12. Changes to this policy

When we change it we update the effective date above, and subscribers get thirty days' email notice of any material change.

13. Complaints

Write to us first at [email protected]. You always retain the right to complain to the Personal Data Protection Council in the Hashemite Kingdom of Jordan.