Privacy Policy

1. Who is responsible for your data

Website visitors and workspace owners. Qiyas is the controller of the personal data you provide when you browse our site or contact us.

Employees of our customers. When your employer uses the Service, your employer is the controller of the employee data held in its workspace and Qiyas processes that data as a processor on the employer’s instructions. Questions about how your employer uses your data should be directed to your employer; we will support them in responding.

2. Data we collect

• Account data — name, work email, role and language preference; passwords are stored only as salted hashes.
• Workspace data — the employee records, organization structure, KPIs, objectives and business data our customers enter or upload. This may include names, job titles, contact details, education, work history, competency and performance information.
• Interview data — for a strategy interview: the interviewee’s name, email and position, the answers or transcript and, for a voice interview, its audio recording.
• Usage data — sign-in events, the actions recorded in the workspace audit log, device and browser type, IP address and error logs.
• Communications — messages you send us and support requests.
• Cookies — as described in our Cookie Policy.

3. How we use personal data

• to operate your workspace, authenticate users and provide the features of the Service;
• to compute performance status and generate AI summaries and recommendations within the workspace;
• to provide support, respond to requests and send service communications such as security alerts and billing notices;
• to secure the Service, prevent abuse and keep audit logs;
• to comply with legal obligations.

4. AI processing

AI features — drafts, suggestions and voice interviews — send the content they need to OpenAI. Translation of workspace content into Arabic or English, summaries of interview transcripts and other long texts, and dashboard overviews go through the Qiyas AI service, run by Qiyas, which passes them to Groq and, for translation and summaries when Groq is unavailable, to OpenAI; translation into any other language goes to OpenAI. Translation sends the texts being translated (names of people and companies are never translated); summaries send the text, with an interviewee’s position but not their name; overviews send the dashboard’s figures and the names of its KPIs, objectives, initiatives and departments, never people’s names. OpenAI and Groq process this content outside the Kingdom; compensation data is never sent. Customer Data is not used to train models that serve other customers, and every AI output is presented as a draft for human review. Automated processing in the Service does not produce decisions with legal or similarly significant effects on individuals without human involvement.

5. Legal bases

We rely on the following legal bases: performance of a contract (providing the Service you or your employer signed up for); your consent where we ask for it; our legitimate interests (securing and improving the Service, preventing fraud), balanced against your rights; and compliance with legal obligations.

6. Sharing personal data

We do not sell personal data. We share it only with:

• Sub-processors that host or support the Service — Google Cloud (hosting), OpenAI (AI features), Groq (translation, summaries and dashboard overviews, through the Qiyas AI service), Brevo (email) and, when error reporting is turned on, Sentry (error reports) — bound by written agreements;
• Your organization — workspace owners and administrators can see data in their tenant according to their roles;
• Authorities where required by law or to protect rights, safety and property;
• Successors in a merger or acquisition, subject to this Policy.

7. Data residency and international transfers

The Service’s database, its files (interview recordings included) and its backups are stored in Google Cloud’s Dammam region, in the Kingdom of Saudi Arabia. Some processing takes place outside the Kingdom: AI features send the content they need to OpenAI and, through the Qiyas AI service, to Groq, emails are sent through Brevo, and, when error reporting is turned on, error reports (without request bodies or headers) go to Sentry.

8. Retention

Account and workspace data, interview recordings included, are kept for as long as the workspace exists; the Service does not delete them automatically when a subscription ends. To ask for their deletion, contact privacy@qiyas.ai. Backups are kept for up to 35 days.

9. Security

We protect personal data with encryption in transit and at rest, tenant isolation enforced by the database, role-based access control and continuous monitoring. No system is completely secure; if a breach affecting your data occurs we will notify you and the competent authority as required by law.

10. Your rights

Under Saudi data protection law you have the right to be informed about how your data is processed, to access and obtain a copy of it, to request correction or completion, to request deletion where processing is no longer necessary, and to withdraw consent where processing is based on consent. To exercise these rights, contact us at privacy@qiyas.ai. If you are an employee of a customer, we will route your request to your employer as controller. You may also lodge a complaint with the Saudi Data & AI Authority (SDAIA).

11. Children

The Service is intended for organizations and their adult employees. We do not knowingly collect personal data from anyone under 18.

12. Changes to this Policy

We will post any changes on this page and, for material changes, notify workspace owners by email or in-product notice at least 30 days before they take effect.

13. Contact

Data protection contact: privacy@qiyas.ai · Qiyas Technologies, Riyadh, Kingdom of Saudi Arabia.