Privacy Policy

1. Who is responsible for your data

Website visitors and workspace owners. Qiyas is the controller of the personal data you provide when you browse our site, ask our team about Pulse or create a workspace.

Respondents. When an organization sends you a survey or interview through Pulse — as an employee, customer, supplier or other participant — that organization is the controller of your answers and Qiyas processes them as a processor on its instructions. Questions about how an organization uses your answers should be directed to that organization; we will support them in responding.

2. Data we collect

• Account data — name, work email, mobile number, company name, size, industry, country and city, role and language preference; passwords are stored only as salted hashes.
• Audience data — the people our customers add, upload or import, such as employees, with names, email addresses, phone numbers, departments and job details.
• Responses and workspace files — employees’ photos today, and the CVs customers choose to read into an employee’s details (read, then not kept); survey answers, AI-interview recordings and transcripts, and the documents, spreadsheets and past reports customers upload for analysis once those features are available.
• Usage data — sign-in events, the actions recorded in the workspace audit log, device and browser type, IP address, error logs and request traces.
• Communications — messages you send us and support requests, and what you send through the website’s “Talk to sales” form (name, work email, mobile number, company and your message).
• Cookies — as described in our Cookie Policy.

3. How we use personal data

• to operate your workspace, authenticate users and provide the features of the Service;
• to analyze responses and files, generate themes, summaries and recommendations, and fill reports within the workspace;
• to provide support, respond to requests and send service communications such as security alerts and billing notices;
• to secure the Service, prevent abuse and keep audit logs;
• to comply with legal obligations.

4. AI processing

Today the Service makes three kinds of AI call, each through the Qiyas AI service, run by Qiyas, which passes the content to the AI providers it uses, Groq and OpenAI, outside the Kingdom. Translation: workspace content, such as the names and descriptions of departments and job titles, is translated into Arabic or English, never into another language (names of people and companies are never translated). Reading a CV: when a customer adds an employee from a CV (PDF or Word), the file is sent to fill in the form; the Service does not keep it. Drafting a role: the job title typed and the company’s own names for the department, team, seniority, industry and competencies are sent to draft a job description, responsibilities and competencies for the form, never a person’s name, contact details or pay. Compensation data is never sent. Basira’s analysis and AI interviews appear in the Service only as previews with sample data: they send nothing to an AI provider. Customer Data is not used to train models that serve other customers, and every AI output is presented as a draft for human review. Automated processing in the Service does not produce decisions with legal or similarly significant effects on individuals without human involvement.

5. Legal bases

We rely on the following legal bases: performance of a contract (providing the Service you or your organization signed up for); consent where we ask for it, and where an organization relies on it for a survey; our legitimate interests (securing and improving the Service, preventing fraud), balanced against your rights; and compliance with legal obligations.

6. Sharing personal data

We do not sell personal data. We share it only with:

• Sub-processors that host or support the Service — Google Cloud (hosting, backups and request traces), Google reCAPTCHA Enterprise (checking that the website’s trial and sales forms are sent by a person), Groq and OpenAI (translation, CV reading and role drafts, through the Qiyas AI service), Brevo (email) and, when error reporting is turned on, Sentry (error reports) — bound by written agreements;
• The organization that invited you — its authorised users see results according to their roles and, in a campaign, its anonymity settings;
• Authorities where required by law or to protect rights, safety and property;
• Successors in a merger or acquisition, subject to this Policy.

7. Data residency and international transfers

The Service’s database, its files and its backups are stored in Google Cloud’s Dammam region (me-central2), in the Kingdom of Saudi Arabia. Some processing takes place outside the Kingdom: the AI features send the content they need (the texts to translate, a CV to read, a role to draft), through the Qiyas AI service, to Groq or OpenAI; emails are sent through Brevo, in the European Union; on the website’s trial and sales forms, Google reCAPTCHA Enterprise receives your IP address and signals about your browser and how you use the page; request traces (the address without its query string, timings and technical ids, never the content of a request) go to Google Cloud’s tracing service, which may process them outside the Kingdom; and, when error reporting is turned on, error reports (without request bodies or headers) go to Sentry.

8. Retention

Account and workspace data are kept for as long as the workspace exists; the Service does not delete them automatically when a subscription ends. To ask for their deletion, contact privacy@qiyas.ai. What you send through the website’s “Talk to sales” form is deleted 90 days after it arrives. Backups are kept for up to 35 days.

9. Security

We protect personal data with encryption in transit and at rest, tenant isolation enforced by the database, role-based access control and continuous monitoring. No system is completely secure; if a breach affecting your data occurs we will notify you and the competent authority as required by law.

10. Your rights

Under Saudi data protection law you have the right to be informed about how your data is processed, to access and obtain a copy of it, to request correction or completion, to request deletion where processing is no longer necessary, and to withdraw consent where processing is based on consent. To exercise these rights, contact us at privacy@qiyas.ai. If you are a respondent, we will route your request to the organization that invited you. You may also lodge a complaint with the Saudi Data & AI Authority (SDAIA).

11. Children

The Service is intended for organizations and adult participants. We do not knowingly collect personal data from anyone under 18.

12. Changes to this Policy

We will post any changes on this page and, for material changes, notify workspace owners by email or in-product notice at least 30 days before they take effect.

13. Contact

Data protection contact: privacy@qiyas.ai · Qiyas Technologies, Riyadh, Kingdom of Saudi Arabia.