Privacy Policy

1. Who is responsible for your data

Website visitors and workspace owners. Qiyas is the controller of the personal data you provide when you browse our site or contact us.

Employees of our customers. When your employer uses the Service, your employer is the controller of the employee data held in its workspace and Qiyas processes that data as a processor on the employer’s instructions. Questions about how your employer uses your data should be directed to your employer; we will support them in responding.

2. Data we collect

• Account data — name, work email, role and language preference; passwords are stored only as salted hashes.
• Workspace data — the employee records, organization structure, attendance, tasks, daily logs, requests and payroll data our customers enter or upload. This may include names, job titles, contact details, salary and attendance information.
• Voice log data — when an employee records a daily log by voice: the transcript of what they said, used to draft their log entries.
• Usage data — sign-in events, the actions recorded in the workspace audit log, device and browser type, IP address and error logs.
• Communications — messages you send us and support requests.
• Cookies — as described in our Cookie Policy.

3. How we use personal data

• to operate your workspace, authenticate users and provide the features of the Service;
• to compute hours, attendance status, team insights and payroll within the workspace, and to draft daily-log entries from a voice log;
• to provide support, respond to requests and send service communications such as security alerts and billing notices;
• to secure the Service, prevent abuse and keep audit logs;
• to comply with legal obligations.

4. AI processing

AI features are limited to two. A voice daily log sends its transcript to OpenAI, which returns draft entries for the employee to review. Translation of text typed into the workspace between Arabic and English goes through the Qiyas AI service, run by Qiyas, which passes it to Groq; names of people and companies are never translated. OpenAI and Groq process this content outside the Kingdom; salary and payroll data are never sent. Customer Data is not used to train models that serve other customers, and every AI output is a draft for human review. Automated processing in the Service does not produce decisions with legal or similarly significant effects on individuals without human involvement.

5. Legal bases

We rely on the following legal bases: performance of a contract (providing the Service you or your employer signed up for); your consent where we ask for it; our legitimate interests (securing and improving the Service, preventing fraud), balanced against your rights; and compliance with legal obligations.

6. Sharing personal data

We do not sell personal data. We share it only with:

• Sub-processors that host or support the Service — Google Cloud (hosting), OpenAI (voice daily logs), Groq (translation, through the Qiyas AI service), Brevo (email) and, when error reporting is turned on, Sentry (error reports) — bound by written agreements;
• Your organization — workspace owners and administrators can see data in their tenant according to their roles;
• Authorities where required by law or to protect rights, safety and property;
• Successors in a merger or acquisition, subject to this Policy.

7. Data residency and international transfers

The Service’s database, its files and its backups are stored in Google Cloud’s Dammam region, in the Kingdom of Saudi Arabia. Some processing takes place outside the Kingdom: voice daily logs are sent to OpenAI and translation goes through the Qiyas AI service to Groq, emails are sent through Brevo, and, when error reporting is turned on, error reports (without request bodies or headers) go to Sentry.

8. Retention

Account and workspace data are kept for as long as the workspace exists; the Service does not delete them automatically when a subscription ends. To ask for their deletion, contact privacy@qiyas.ai. Backups are kept for up to 35 days.

9. Security

We protect personal data with encryption in transit and at rest, tenant isolation enforced by the database, role-based access control and continuous monitoring. No system is completely secure; if a breach affecting your data occurs we will notify you and the competent authority as required by law.

10. Your rights

Under Saudi data protection law you have the right to be informed about how your data is processed, to access and obtain a copy of it, to request correction or completion, to request deletion where processing is no longer necessary, and to withdraw consent where processing is based on consent. To exercise these rights, contact us at privacy@qiyas.ai. If you are an employee of a customer, we will route your request to your employer as controller. You may also lodge a complaint with the Saudi Data & AI Authority (SDAIA).

11. Children

The Service is intended for organizations and their adult employees. We do not knowingly collect personal data from anyone under 18.

12. Changes to this Policy

We will post any changes on this page and, for material changes, notify workspace owners by email or in-product notice at least 30 days before they take effect.

13. Contact

Data protection contact: privacy@qiyas.ai · Qiyas Technologies, Riyadh, Kingdom of Saudi Arabia.