Privacy Policy

1. General Data Collection Principles

Across our products, we generally collect data within the following categories:

• Account data: name, email address, phone number, job role
• Organization data: information about the client firm/organization using the platform
• Operational usage data: data specific to each product's function (varies by product — refer to that product's detailed privacy policy)

We do not collect any data that does not serve a direct functional purpose, and we do not use your data for advertising purposes.

2. Data Protection

We apply consistent security standards across all our products:

• Encryption: all communications occur over encrypted HTTPS/TLS, and sensitive fields are encrypted at rest
• Data isolation: we use a per-tenant database architecture, meaning no client organization can ever access another organization's data
• Access control: fine-grained role-based permissions with full audit logging
• We comply with Zakat, Tax and Customs Authority (ZATCA) requirements for relevant financial systems

For more details on our security practices, please visit our Trust Center.

3. Third-Party Data Sharing

We do not sell your personal data to any party. Your data is only shared with third parties in the following cases:

• Where necessary with technical service providers essential to operating the platform (such as cloud hosting providers), under strict data protection agreements
• Where required to comply with legal or regulatory requirements issued by competent authorities in Saudi Arabia
• With a small number of named technical services used by the CircleLaw application: Sentry (crash reporting and performance monitoring — processed in the United States), ui-avatars.com (generates a placeholder avatar from your name), and api.qrserver.com (generates a QR code from a case link)

4. Your Rights Under the Personal Data Protection Law (PDPL)

As a user based in Saudi Arabia, you have the right to:

• Access the personal data we hold about you
• Request correction of any inaccurate data
• Request deletion of your data, subject to applicable legal record-retention requirements
• Withdraw consent to data processing at any time

To exercise any of these rights, please contact us at: [email protected]

5. Children's Privacy

Our products are intended for professional use by organizations and are not directed at children under the age of 18.

6. Changes to This Policy

We may update this policy from time to time. Any updates will be posted on this page with a revised "Last updated" date above.

7. Website Chat Assistant

Our website offers an optional chat assistant that answers questions about Circle AI and its products. When you use it:

• What we collect: the messages you type, the assistant's replies, the page language, and technical data needed to protect the service from abuse (a one-way hashed form of your IP address and message counts). We do not ask for your name or contact details in the chat.
• How it is processed: your messages are processed by an AI service provider outside the Kingdom of Saudi Arabia to generate replies. This is separate from customer data in our products, which is hosted and stored in Saudi Arabia.
• Retention: chat conversations and abuse-protection data are deleted after 30 days.
• Purpose: to answer your questions and keep the service secure. We do not use chat conversations for advertising and we do not sell them.
• Please do not share confidential information, case details or sensitive personal data in the chat.
• The chat is optional. For any request about your data, contact [email protected].