سياسة الخصوصيةPrivacy Policy

The operator of QVAIM is the controller of personal data collected through the platform. Add the legal name, address, registration number and Data Protection Officer details—if applicable—before public launch.

Privacy requests: [email protected].

• Account data: name, email, phone, organization and protected login information.
• Usage data: features used, technical logs, device, browser, IP address and timestamps.
• Customer content: text, images, files, links and settings you upload or create.
• Billing data: transaction status, plan, invoice and references. Full card details are not stored when processed by an independent payment provider.
• Support communications, privacy requests and marketing preferences.

We process data to provide accounts and services, perform the contract, manage billing and support, secure the platform, prevent abuse, meet legal duties, improve performance and send marketing where consent is required. Processing relies on contract, legal obligation, consent or legitimate interests as applicable and subject to data-subject rights.

When AI features are used, prompts and the minimum required context may be sent to a technical provider. Providers and safeguards will be documented before launch, and we seek contractual settings that prevent customer content from training public models where available. Do not submit sensitive data or trade secrets unless a feature is designed for that purpose.

We may share the minimum necessary data with hosting, cloud, AI, payment, email, analytics and support providers, and with competent authorities where a valid legal obligation applies. We do not sell personal data to advertisers.

Processors are contractually bound to confidentiality, security and defined purposes where required.

Where service delivery requires personal data transfers outside Saudi Arabia, transfers will follow applicable rules, including purpose assessment, protection level and suitable contractual or legal safeguards. Regions and providers will be documented before production use.

Data is retained as needed to provide the service, meet legal obligations, resolve disputes and secure systems. When no longer needed, it is deleted or anonymized unless retention is legally required. Detailed retention schedules will be maintained in the processing register before launch.

Subject to applicable law, you may be informed about processing, access and obtain a copy of your data, request correction or completion, request destruction where conditions apply, withdraw consent where it is the legal basis, and complain to the competent authority.

We respond within 30 days and may extend once by a similar period for unexpected effort, with notice and reasons. Identity verification may be required.

The platform uses necessary cookies for login, security and preferences. Non-essential analytics or marketing cookies will only be enabled under applicable consent settings. A preference center will be provided when these tools are added.

We apply proportionate organizational and technical measures including encryption in transit, access controls, backups, monitoring and patching. No method is completely risk-free, so controls are reviewed continuously.

When a reportable breach occurs, we follow statutory timelines and notify affected individuals without undue delay where harm may result.

This policy may be updated when services, providers or laws change. We will post the revised version and date and communicate material changes through available channels.