Privacy Policy

1. General Data Collection Principles

Across our products, we generally collect data within the following categories:

• Account data: name, email address, phone number, job role
• Organization data: information about the client firm/organization using the platform
• Operational usage data: data specific to each product's function (varies by product — refer to that product's detailed privacy policy)

We do not collect any data that does not serve a direct functional purpose, and we do not use your data for advertising purposes.

2. Data Protection

We apply consistent security standards across all our products:

• Encryption: all communications occur over encrypted HTTPS/TLS, and sensitive data is encrypted at rest
• Data isolation: we use a per-tenant database architecture, meaning no client organization can ever access another organization's data
• Access control: fine-grained role-based permissions with full audit logging
• We are currently working toward ISO 27001 certification, and comply with Zakat, Tax and Customs Authority (ZATCA) requirements for relevant financial systems

For more details on our security practices, please visit our Trust Center.

3. Third-Party Data Sharing

We do not sell your personal data to any party. Your data is only shared with third parties in the following cases:

• Where necessary with technical service providers essential to operating the platform (such as cloud hosting providers), under strict data protection agreements
• Where required to comply with legal or regulatory requirements issued by competent authorities in Saudi Arabia
• With a small number of named technical services used by the CircleLaw application: Sentry (crash reporting and performance monitoring — processed in the United States), ui-avatars.com (generates a placeholder avatar from your name), and api.qrserver.com (generates a QR code from a case link)

4. Your Rights Under the Personal Data Protection Law (PDPL)

As a user based in Saudi Arabia, you have the right to:

• Access the personal data we hold about you
• Request correction of any inaccurate data
• Request deletion of your data, subject to applicable legal record-retention requirements
• Withdraw consent to data processing at any time

To exercise any of these rights, please contact us at: info@circleai.sa

5. Children's Privacy

Our products are intended for professional use by organizations and are not directed at children under the age of 18.

6. Changes to This Policy

We may update this policy from time to time. Any updates will be posted on this page with a revised "Last updated" date above.