Privacy Policy

1.1 The “Bayan Flow” service is operated by: [bayan flow], commercial registration no. [********], [riyadh] (the “Company” or “we”).

1.2 We comply with the Personal Data Protection Law and its Implementing Regulations in the Kingdom of Saudi Arabia, and this policy states what the Law requires data subjects to be told before their data is collected.

1.3 Our role depends on the kind of data:

• Controller: for your account, billing and security data, your contact with us and your use of the Service; we decide the purposes and means of processing it.

• Processor: for the content you process through the Service (text, documents, your customers' data and correspondence); you, or the organisation that uses the Service, are the controller, and we process this content for you, on your documented instructions and only to provide the Service, as the Terms of Service describe.

1.4 If you are a customer of an organisation that uses Bayan (for example your name or message is in content an organisation entered), that organisation is responsible for your data; direct your request to it and we will help it respond.

This policy applies to the Bayan website, application, browser extension and related services. It is part of your agreement with us together with the Terms of Service, the Cookie Policy and the AI Usage Disclosure, and some of its sections refer to those documents.

We collect the following categories, and no more than their purpose needs:

• Account data: name, e-mail address and password (we keep an irreversible fingerprint of it, not the password as written), language and time zone, a profile picture and job title if you add them, and your answer to “how did you hear about us?” if you give one. When you sign in with Google, Microsoft or LinkedIn we receive your identifier, name and e-mail from the provider.

• Workspace and content data: members, roles, teams and invitations, templates and brand voice, the documents you upload or import and what we extract from them (text passages, summaries, search indexes and suggested questions), the text you process and the Output, and your request history according to your Plan.

• Usage data: the actions performed, Credits used and when, the interface used (website or extension), technical metadata, the log of knowledge-search questions (an excerpt of the question of at most 200 characters, for a limited time) to measure what your knowledge covers and lacks, and the list of questions that a Workspace's knowledge could not answer (section 7.3).

• Security and device data: IP address, browser and device type, sign-in, session and failed-attempt records, the two-factor secret (encrypted) and known-device tokens, and audit records of sensitive actions.

• Billing data: the Plan, invoices, amounts, the last digits of the payment method and transaction references from the payment provider, and tax-invoice details (legal name, tax number, address and country). We do not keep your card numbers; payment pages run at the payment provider.

• Contact and support data: contact-form messages, tickets and what you write to us.

• Data from linked external services: the access token you grant to a cloud-storage service (kept encrypted) and metadata of the imported files.

• Cookies and local storage: as set out in the Cookie Policy.

Mandatory and optional data: name, e-mail and password (or an identity provider) are mandatory to create an account; billing details are mandatory to complete a payment and issue the tax invoice; technical and security data are needed to run and protect the Service. A profile picture, job title, how you heard of us and the documents you upload are optional. If you withhold what is mandatory, the account cannot be created, the payment completed or the Service used.

We do not intend to collect sensitive data. If you enter it in your content, you are responsible for having a lawful basis for it, and we treat it as a processor as set out above.

We collect data directly from you when you register, use the Service, enter your content and contact us; automatically through your use of the Service (usage, security and device); from the identity providers you choose to sign in with; from the payment provider, which confirms the result of your transaction; from a Workspace owner or administrator when they invite you (your e-mail and role); and from the storage services you link, with your permission. We do not collect data about you from public sources for marketing.

We process your data for the following purposes and on the bases shown:

• Providing the Service and managing your account, Workspaces, Credits and Seats: performance of the contract you are party to.

• Payment, billing, issuing electronic tax invoices and our accounting and tax obligations: performance of the contract, and compliance with the Law.

• Security of the Service, protecting accounts and preventing fraud and abuse: our legitimate interest in protecting the Service and its users, and compliance with the Law.

• Support and answering your enquiries: performance of the contract and our legitimate interest.

• Improving, measuring and developing the Service, with aggregated or de-identified data where possible: our legitimate interest.

• Optional website analytics (if we turn them on): your consent or your browser settings as the Cookie Policy describes.

• Marketing messages: your consent.

• Responding to competent authorities and establishing and defending our rights: compliance with the Law and our legitimate interest.

We do not rely on legitimate interest where the processing involves sensitive data, or where your interests and rights prevail. We do not process your data for a purpose not stated here except with your consent or in the cases the Law allows.

6.1 Where we rely on your consent, we ask for it expressly and separately, and we do not make it a condition of providing the Service unless the processing is directly tied to the Service.

6.2 We record your acceptance of the Terms of Service and this Privacy Policy: the version you accepted, its date, language and the way you accepted, so that we can prove it.

6.3 You may withdraw your consent at any time as easily as you gave it, from your account settings or by contacting us. Withdrawal does not affect the lawfulness of processing before it, and may mean that features that depend on that consent stop.

6.4 If you are below the legal age, your guardian's consent is required; the Service is not directed at anyone under eighteen (see section 17).

7.1 To generate results we send AI model providers only what each request needs: the text you selected, the template and brand-voice instructions, and the relevant excerpts of your enabled documents.

7.2 We do not use your content or your Output to train general AI models. We choose providers and require, as far as their terms allow, that they do not use what we send them to train their general models.

7.3 Your request history is private to you within the Workspace: administrators see usage statistics, not the content of your requests, and any access to private content requires explicit, logged controls. One exception is stated here so that it is not a surprise: when you use the Workspace's knowledge to draft a reply and the knowledge cannot answer the question, an excerpt of that question (at most 200 characters, from which e-mail addresses, phone numbers and long numbers are masked automatically) is added to the Workspace's list of unanswered questions, which people who may manage the Workspace's knowledge read so that they can fill the gap. The list shows the excerpt, how many times it was asked and by how many people, and does not show who asked; it is kept for as long as the knowledge-search question log is kept, and at most ninety days. Alerts about unanswered questions carry numbers only, never the question. The masking is automatic and does not recognise every personal detail, so do not put personal data in the questions you ask the knowledge.

7.4 Retrieval uses your enabled documents for you and not for others, and we keep each organisation's knowledge separate from every other's. For detail see the AI Usage Disclosure.

7.5 The Service also runs two automatic checks in the background, not when you ask for anything, on the list of unanswered questions. Unless the Workspace's managers have switched the alerts for these questions off, the question excerpts described in 7.3 (masked as described there), together with the short passages of the Workspace's enabled documents that the knowledge found for them, may be sent to an AI model provider so that it can judge whether the passages really answer the question, and short excerpts of several unanswered questions may be sent so that it can name the group they belong to. What comes back is a short verdict, a short reason and a general topic name, which the people who may manage the knowledge see beside the question; none of it is used to train general models (7.2). The Service bears the cost of these checks and they are not deducted from your credits. The Workspace's owner and the administrators who may manage the knowledge also receive a weekly summary by e-mail and an in-app notification: it carries counts, percentages and general topic names, never the text of a question.

We disclose personal data, only as far as needed, to these categories:

• AI model providers (processors): to generate Output and to run the automatic checks described in 7.5.

• Hosting, cloud infrastructure, storage and database providers (processors): to run the Service and keep its data.

• Payment providers (including Stripe, Moyasar, Tap, PayTabs, HyperPay and PayPal, depending on the payment method you choose): to process your payments; they process payment data under their own legal and financial obligations.

• E-mail providers (including Mailchimp, MailerLite and MailerSend, if we turn on e-mail campaigns or sending through them): to send account, security and billing messages, and to send product updates and offers to those who have not objected; you may object at any time from the unsubscribe link or the notification settings. Your name, e-mail address and language may be processed outside the Kingdom under the Law’s rules on transfers.

• Identity providers (Google, Microsoft and LinkedIn): when you choose to sign in with them.

• Cloud storage services (Google Drive and OneDrive): when you link them to your account.

• A machine-translation service: contact-form and live-chat messages you send us may be machine-translated for our team to read (only when a team member asks for it).

• Usage-analytics tools: if we turn them on, as the Cookie Policy describes.

• The Zakat, Tax and Customs Authority: the electronic tax-invoice data the Law requires to be sent (buyer details and invoice particulars).

• Government and judicial authorities: on a valid legal request.

• Professional advisers and auditors: bound by confidentiality.

• A successor to the Service: in a merger, acquisition or sale of assets, with this policy's protection continuing and notice to you.

• Inside a Workspace: administrators see what the Service makes available to them, such as the member list, usage statistics and the audit log, and people who may manage the knowledge see excerpts of the questions the knowledge did not cover (section 7.3).

We do not sell, rent or share your personal data for advertising. We choose processors with care, require sufficient safeguards for the protection of data, monitor their compliance, and remain responsible to you for them.

9.1 Your data may be processed, stored or accessed outside the Kingdom of Saudi Arabia by some of the parties in section 8 (AI model, hosting, payment, e-mail, analytics and translation providers), in order to provide the Service to you.

9.2 We make such transfers within what the Law and its Regulations allow: to the extent needed to perform the contract with you or for another purpose the Law permits; after verifying that the receiving party provides an adequate level of protection, no lower at a minimum than the Law guarantees, or with contractual and technical safeguards as the Regulations specify; limited to the minimum personal data needed; and without prejudice to national security or the vital interests of the Kingdom.

9.3 You may ask us for more information about who receives your data and in which countries, through the channels in section 15.

We keep data only as long as its purpose needs, and in general:

• Account data: for as long as your account exists, and then we start destroying or de-identifying it under section 11.

• Content and documents: until you delete them or the account or Workspace is deleted. A deleted document leaves retrieval at once and is removed from storage in the clean-up cycle.

• Request history: for the period set in your Plan.

• Knowledge-search question log: thirty days by default.

• List of questions the knowledge did not cover (the excerpt of the question): for as long as the question log is kept, at most ninety days after the question was last asked, and never longer than the question log's retention period. The verdicts, reasons and topics derived from it are removed with it.

• Sessions: for a limited time, at most sixty days from creation.

• Security and audit records: as long as needed for the security of the Service, accountability and legal obligations.

• Billing data and tax invoices: for the period required by tax, accounting and commercial law, which may run to years.

• Contact and support messages: for as long as needed to deal with your request and show what took place.

• The record of your acceptance of the terms and policies: throughout your relationship with us and for as long afterwards as is needed to prove it.

We keep what the Law requires after the purpose has ended, or what is tied to a case before a court, until the period or the proceedings end.

11.1 You can delete your documents, templates and history from the Service, and delete your account from its settings or by asking us.

11.2 When an account is deleted we start, within thirty days, to destroy your personal data or de-identify it so that it can no longer be linked to you, and it leaves backups when their usual cycle ends, except what must be kept under section 10.

11.3 We stop collecting data and destroy what was collected if it is no longer needed for the purpose for which it was collected.

11.4 We may keep aggregated statistics that do not identify you.

We apply appropriate organisational, administrative and technical measures to protect personal data, including: encryption of connections; encryption of secrets (provider keys, tokens and two-factor secrets) when stored; storing passwords as a strong irreversible fingerprint; keeping each organisation's data separate from every other's; least-privilege access controls, with two-factor authentication available to you; audit records of sensitive actions; request-rate limits to prevent abuse; vulnerability-management and backup procedures; and confidentiality binding our staff even after their relationship with us ends. No system is completely secure, so we encourage you to use a strong, unique password, turn on two-factor authentication and not share your account.

If we learn of a leak, damage or unlawful access to personal data we control, we notify the competent authority as the Regulations provide, and we notify you where it would damage your data or prejudice your rights and interests. If the incident concerns data we process for your organisation, we notify it without undue delay so that it can meet its own obligations.

Under the Law you have these rights in respect of the data we control:

• To be informed: of the legal basis and purpose of the collection of your data, which this policy sets out.

• Access: to your personal data that we hold.

• To obtain a copy: of your data in a readable and clear format.

• Correction, completion and updating: of your data.

• Destruction: of your data when it is no longer needed for its purpose, subject to what the Law requires us to keep.

• To withdraw consent: at any time (section 6).

• To object to marketing messages: and have them stopped (section 16).

• To complain: to the competent authority (section 15).

We may restrict the exercise of some rights in the cases the Law permits, such as protecting others from harm or respecting others' privacy, and we tell you why.

15.1 The quickest way is your account settings, where you edit your data, delete your content and your account, and manage your consents.

15.2 For what the interface does not cover, use the “Contact us” page of the website and put “Data protection” in your message, saying which right you wish to exercise. We may ask you to verify your identity to protect your data.

15.3 We answer your request within the period set by the Law's Implementing Regulations and in the way they provide.

15.4 If you believe we have not respected your rights, you may complain to the authority competent to oversee the Personal Data Protection Law, currently the Saudi Data and Artificial Intelligence Authority (SDAIA), without prejudice to your right to compensation before the competent court for material or moral damage. We would be glad of the chance to put it right first.

16.1 Service messages (e-mail confirmation, password recovery, security notices, invoices, account notices and material changes to the Service and its terms) are necessary to run the Service and reach you while your account exists.

16.2 We send marketing messages by e-mail or other personal means of contact only with your prior consent, and every message carries a clear, easy way to stop receiving them.

16.3 We do not use sensitive data for marketing.

The Service is not directed at anyone under eighteen, and we do not knowingly collect data from a minor. If we learn that we collected a minor's data without a guardian's consent, we will delete it. If you believe a minor has sent us their data, tell us.

If you join the affiliate programme, we store the payout account you connect (for example a PayPal address or an IBAN) encrypted, and use it only to pay your commissions. Only the platform owner can read it in full, each such access is logged, and screens and e-mails show it masked. We keep a record of the payouts made to you because financial records must be kept; deleting your account deletes the payout account itself. People you refer appear to you only as a masked e-mail address, and they are never told who referred them. We keep in the audit log the programme terms you accepted and their version.

The website or the Service may send you to sites and services we do not own, such as payment pages, identity providers and storage services. They have their own privacy policies and we are not responsible for them; read them before you give them your data.

20.1 The pages of our public website offer a live chat: you talk first to an AI assistant that answers from our documentation, and you may ask to talk to a member of our team. A chat starts only after you have seen this notice and agreed to it in the chat window, and you may stop at any time. We are the controller of the data of this chat.

20.2 What the chat window itself tells you, and what we hold ourselves to:

• The first answers come from an AI assistant. Your messages are sent to an AI service to write the answer, and the answer may be wrong: check anything important with our team.

• Your messages are stored for 90 days after the last message, then deleted. You can delete your chat yourself at any time from the chat window.

• We keep your network address only as a scrambled (keyed hash) value, to stop abuse. We do not store your browser details or the full address of the page you are on.

• One essential cookie (a random identifier, 30 days) keeps your chat together. The chat uses no tracking or advertising cookies.

• Your name and e-mail are optional. If you give them, only our support team sees them, and only to answer you.

• Our support team can read this conversation. If you leave a message for the team while nobody is online, it is kept in the team’s contact inbox, and deleting your chat deletes it as well.

• Nothing you write here is used for advertising or sold.

20.3 What we store, in detail: the messages of the conversation (yours, the assistant's and our team's) and the time of each, the path of the page you started from (without anything after a question mark), your language, the name and e-mail address if you give them, your rating if you give one, and your network address only as a keyed hash. We do not store your browser or device details, your IP address as it is, or the full address of the page.

20.4 The cookie: one essential cookie (bayan_chat, or __Host-bayan_chat on https) holding a random identifier valid for 30 days; only our server reads it, and it contains neither your name nor your e-mail. Its details are in the Cookie Policy.

20.5 Retention and deletion: conversations are deleted automatically after the period above from the last message (a conversation in which you wrote nothing, after one day), together with the name and e-mail you gave. The “delete my data” button in the chat window deletes your conversations, the messages you left for the team while nobody was online, and the name and e-mail you gave, at once. If we block a visitor for abusing the chat, we keep the block record (an identifier of the browser, not your name) until we lift it, and we remove the name, e-mail, reason and address hash after 90 days.

20.6 AI processing: your message, with the relevant passages of our documentation, is sent to the AI service provider to write the answer, which may happen outside the Kingdom as set out in section 9; we do not use chat messages to train models. The answer is automatic and may be wrong, and is not a promise or commitment by us.

20.7 We do not use the chat for advertising and do not track you with it outside this website. You exercise your other rights over chat data as set out in section 15.

We may update this policy to reflect a change in the Service or the Law. Its version and date are at the top of the page. For material changes we notify you before they take effect by a suitable means, and ask for your consent again where the Law requires it.