Privacy Policy

1. Who is responsible for your data

Website visitors and workspace owners. Qiyas is the controller of the personal data you provide when you browse our site, ask our team about Pulse or create a workspace.

Respondents. When an organization sends you a survey or interview through Pulse — as an employee, customer, supplier or other participant — that organization is the controller of your answers and Qiyas processes them as a processor on its instructions. Questions about how an organization uses your answers should be directed to that organization; we will support them in responding.

2. Data we collect

• Account data — name, work email, mobile number, company name, size, industry, country and city, role and language preference; passwords are stored only as salted hashes.
• Audience data — the people our customers add, upload or import, such as employees, with names, email addresses, phone numbers, departments and job details.
• Responses and workspace files — survey answers, AI-interview recordings and transcripts, and the documents, spreadsheets and past reports customers upload for analysis.
• Usage data — sign-in events, the actions recorded in the workspace audit log, device and browser type, IP address and error logs.
• Communications — messages you send us and support requests.
• Cookies — as described in our Cookie Policy.

3. How we use personal data

• to operate your workspace, authenticate users and provide the features of the Service;
• to analyze responses and files, generate themes, summaries and recommendations, and fill reports within the workspace;
• to provide support, respond to requests and send service communications such as security alerts and billing notices;
• to secure the Service, prevent abuse and keep audit logs;
• to comply with legal obligations.

4. AI processing

AI features — Basira’s analysis, AI interviews and drafts — send the content they need to OpenAI. Translation of workspace content into Arabic or English and summaries of long texts go through the Qiyas AI service, run by Qiyas, which passes them to Groq and, when Groq is unavailable, to OpenAI; translation into any other language goes to OpenAI. Translation sends the texts being translated (names of people and companies are never translated), and summaries send the text without the names of the people it is about. OpenAI and Groq process this content outside the Kingdom; compensation data is never sent. Customer Data is not used to train models that serve other customers, and every AI output is presented as a draft for human review. Automated processing in the Service does not produce decisions with legal or similarly significant effects on individuals without human involvement.

5. Legal bases

We rely on the following legal bases: performance of a contract (providing the Service you or your organization signed up for); consent where we ask for it, and where an organization relies on it for a survey; our legitimate interests (securing and improving the Service, preventing fraud), balanced against your rights; and compliance with legal obligations.

6. Sharing personal data

We do not sell personal data. We share it only with:

• Sub-processors that host or support the Service — Google Cloud (hosting), OpenAI (AI features), Groq (translation, summaries and dashboard overviews, through the Qiyas AI service), Brevo (email) and, when error reporting is turned on, Sentry (error reports) — bound by written agreements;
• The organization that invited you — its authorised users see results according to their roles and, in a campaign, its anonymity settings;
• Authorities where required by law or to protect rights, safety and property;
• Successors in a merger or acquisition, subject to this Policy.

7. Data residency and international transfers

The Service’s database, its files (interview recordings included) and its backups are stored in Google Cloud’s Dammam region, in the Kingdom of Saudi Arabia. Some processing takes place outside the Kingdom: AI features send the content they need to OpenAI and, through the Qiyas AI service, to Groq, emails are sent through Brevo, and, when error reporting is turned on, error reports (without request bodies or headers) go to Sentry.

8. Retention

Account and workspace data, interview recordings included, are kept for as long as the workspace exists; the Service does not delete them automatically when a subscription ends. To ask for their deletion, contact privacy@qiyas.ai. Backups are kept for up to 35 days.

9. Security

We protect personal data with encryption in transit and at rest, tenant isolation enforced by the database, role-based access control and continuous monitoring. No system is completely secure; if a breach affecting your data occurs we will notify you and the competent authority as required by law.

10. Your rights

Under Saudi data protection law you have the right to be informed about how your data is processed, to access and obtain a copy of it, to request correction or completion, to request deletion where processing is no longer necessary, and to withdraw consent where processing is based on consent. To exercise these rights, contact us at privacy@qiyas.ai. If you are a respondent, we will route your request to the organization that invited you. You may also lodge a complaint with the Saudi Data & AI Authority (SDAIA).

11. Children

The Service is intended for organizations and adult participants. We do not knowingly collect personal data from anyone under 18.

12. Changes to this Policy

We will post any changes on this page and, for material changes, notify workspace owners by email or in-product notice at least 30 days before they take effect.

13. Contact

Data protection contact: privacy@qiyas.ai · Qiyas Technologies, Riyadh, Kingdom of Saudi Arabia.