Privacy policy

Who we are

Termobiz AI is a platform that helps companies in Saudi Arabia, and the consultancies that work with them, prepare sustainability reports. It is run by Termobiz AI ("we", "us").

You can reach us about this policy, or about your personal data, through the contact page on this site.

When we decide, and when a company does

For your account (your name, work email, sign-ins and settings) and for what you send us through this site, we are the controller: we decide how that data is used, and this policy applies.

For what a company puts in its reports, and for what it collects through Termobiz AI from people outside it (stakeholders answering a survey, approvers, assurers, suppliers, colleagues sending figures), that company is the controller and we process the data on its behalf, under our data processing agreement with it. Each private link names the company and shows its privacy notice. Questions about that data go to the company first; we help it answer them.

What we collect

• Account details: your name, work email address, an optional photo, the companies and consultancies you belong to and your role in each.
• Sign-in records: when you signed in, how (an emailed code or your company's single sign-on), your IP address and your browser and device.
• What you do in the app: the activity log a company keeps of changes to its reports, figures, files and members.
• Content: the reports, figures, files and comments you add, and your conversations with the AI assistant.
• Through private links, for the company that sent them: the name, email and title of the person asked, their answers and comments, the name typed to approve a report, and when the link was opened.
• Messages you send us: the contact form and upgrade requests, and, if you choose WhatsApp notifications, your mobile number and when you agreed.

Why we use it, and on what basis

• To provide the service you or your company signed up for: sign-in, reports, the assistant, notifications and private links (performing our agreement).
• To keep the service and your account secure, find misuse and keep the records a company's security settings ask for (our legitimate interest, and the law).
• To answer your messages and requests (your request).
• To improve the product from counts and patterns that name nobody (our legitimate interest).
• For WhatsApp notifications, only with your consent, which you can withdraw at any time by replying STOP or removing the number.

We don't sell personal data, use it for advertising, or let the AI services we use train on it.

The AI assistant

When you use the assistant, read a file or translate an answer, the text it needs is sent to an AI model. We ask only for providers that keep nothing after answering and don't train on the data. A company can turn the assistant off, or keep files with personal data away from it, in Settings › Security. Drafts the AI writes are marked until a person accepts them.

Where it is kept, and transfers outside the Kingdom

These are the services that keep or process data for this deployment of Termobiz AI, and whether each is inside Saudi Arabia:

Where data leaves the Kingdom, we do so only as the PDPL and its regulations on transfers allow, with the safeguards they require, such as standard contractual clauses with each provider. Enterprise customers can have their data kept and processed inside the Kingdom.

How long we keep it

• Your account: while it is open. Deleting it (Settings › Account) removes your profile; a company's records keep your name where you did something in them.
• A company's data, private-link answers included: until the company deletes it. A deleted company is closed for 30 days, so it can be restored, then purged.
• Backups: up to 35 days, then they are deleted.
• Messages to our team: one year.

Who sees it

• The people in your company, as its roles allow, and a consultancy it works with, as the company allows.
• The service providers listed above, only to run the service and under contract.
• Authorities, when the law requires it.

How we protect it

Data is encrypted in transit. Private links keep only a hash of their key, and expire. Access follows each person's role, companies can require single sign-on and limit sessions, and an activity log records changes. Backups are encrypted and tested.

Your rights

Under the PDPL you have the right to:

• know how your data is collected and used, as this policy explains;
• see your data and get a copy of it;
• have it corrected;
• have it deleted when we no longer need it;
• withdraw a consent you gave, such as for WhatsApp;
• complain to the Saudi Data and AI Authority (SDAIA).

You can change your name and email and delete your account in Settings › Account; owners can export or delete a company's data in Settings. For anything else, write to us through the contact page on this site. We answer within 30 days. If a company sent you a private link, write to that company: we help it answer.

Cookies

We use only the cookies the service needs: one that keeps you signed in and one that remembers your language. The public pages count visits with Cloudflare Web Analytics, which sets no cookie; private links aren't counted.

Changes to this policy

When we change this policy, we change its version date at the top. If a change matters to you, we tell account holders by email or in the app before it applies.