1
Introduction
At Khulasah, operated by YAS Company, we respect the privacy of our users and are committed to protecting their personal data.
This Policy and Privacy notice explains how your personal data is collected, used, stored, and shared when you use Khulasah, the website, or any related services.
By using Khulasah or creating an account, you acknowledge that you have read and understood this policy and agree to the processing of your data as described here, in accordance with the applicable laws and regulations in the Kingdom of Saudi Arabia.
2
Scope of this policy
This policy applies to all users of Khulasah and covers services provided through the app, the website, or any other platform connected to Khulasah services.
3
Data we collect
We may collect the following categories of data:
A. Account data
When you create an account or use the app, we may collect:
- Name.
- Email address.
- Login credentials.
- Account number or account identifier.
- Profile photo, if added by the user.
- Any information the user adds to their profile.
B. Files and content uploaded by the user
We may collect and store:
- PDF files uploaded by the user.
- File names, sizes, and upload dates.
- Text and information contained in the files.
- Summaries generated from processing the files.
- Questions asked by the user about the files.
- Answers and results provided by the app.
- Files or summaries saved in the user's account.
Files uploaded by users may contain personal or confidential data relating to the user or to other people. The user is responsible for ensuring that they have the lawful right and authority to upload and process those files through the app.
C. Usage and device data
We may automatically collect certain information when the app is used, including:
- Device type and operating system.
- App version.
- Device or app identifiers.
- IP address.
- Language and time zone.
- Dates and times of access and use.
- Pages and features used.
- Duration of app usage.
- Error and crash logs.
- Performance and diagnostic data.
- Technical data needed to protect accounts and prevent misuse.
4
Purposes for using data
We use the data we collect for the following purposes:
- Creating and managing user accounts.
- Signing users in and verifying their identity.
- Allowing users to upload PDF files and save them in their accounts.
- Analyzing files and extracting text and information from them.
- Generating summaries and answering user questions related to files.
- Saving file, summary, and question history inside the user account.
- Improving the quality and accuracy of summarization and answering services.
- Personalizing the user experience.
- Sending account or service-related notifications and messages.
- Providing technical support and responding to inquiries and complaints.
- Diagnosing technical errors and issues.
- Improving app performance and developing new features.
- Protecting the app and accounts from fraud, intrusion, or unlawful use.
- Complying with legal, judicial, or regulatory requirements.
- Preparing general statistics and reports after removing or masking user-identifying data where possible.
5
PDF file processing
When a user uploads a PDF file, the content of the file may be processed for the following purposes:
- Extracting text.
- Preparing the summary.
- Answering questions related to the file content.
- Classifying or organizing the file.
- Saving the file and related results in the user's account.
Files may be processed automatically using artificial intelligence technologies or specialized technical service providers.
Users should not upload files that contain highly sensitive or confidential information unless they have the lawful right to use them and accept their processing under this policy.
We do not use file content for purposes that materially differ from providing the app services unless we obtain the user's consent or have a lawful basis that permits such use.
6
Sharing data with external parties
We may share some data with external parties to the extent necessary to provide and operate the app services. These parties may include:
- Hosting and cloud storage providers.
- Artificial intelligence and text-processing providers.
- Text extraction service providers.
- Analytics and app performance measurement providers.
- Email and notification service providers.
- Technical support and error monitoring providers.
- Cybersecurity and fraud prevention providers.
- Legal or technical advisers when needed.
- Governmental, judicial, or regulatory authorities when there is a binding lawful request.
PDF files or extracted text may be shared with artificial intelligence or technical processing providers only to the extent needed to perform summarization, answer questions, or provide requested features.
We require service providers to process data according to our instructions, use it for specified purposes, and apply appropriate protection measures, subject to our agreements with them and applicable laws.
7
Data transfer outside the Kingdom
Khulasah may use service providers or servers located inside or outside the Kingdom of Saudi Arabia.
When providing the service requires transferring or processing personal data outside the Kingdom, we take the required procedures and safeguards under applicable laws and regulations and ensure that the transfer is limited to what is necessary to provide the service.
These safeguards may include contractual agreements, assessing the provider's level of data protection, and applying necessary technical and organizational measures.
8
Legal basis for processing
We process personal data based on one or more of the following lawful grounds:
- User consent.
- Performance of the service or agreement with the user.
- Compliance with a legal requirement.
- Protection of the vital interests of the user or another person where applicable.
- Pursuit of a legitimate interest that does not conflict with the user's rights and interests.
- Any other basis permitted by applicable laws and regulations.
Where consent is the legal basis for processing, the user may withdraw consent. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.
9
Data retention period
We retain personal data for as long as necessary to achieve the purposes described in this policy, including for as long as the user's account remains active.
PDF files, summaries, and related content remain saved inside the user's account until the user deletes them or deletes the account, unless retaining certain data is required to comply with legal requirements, protect rights, or resolve disputes.
After an account deletion request, we delete or anonymize the related data within the appropriate legal and technical period, except for data we are required to retain under a law or legal obligation.
Removing data from backup copies may take additional time according to backup cycles, while restricting its use and preventing processing for other purposes.
10
Data protection
We apply appropriate administrative, organizational, and technical measures to protect personal data, which may include:
- Encrypting communication between the app and servers.
- Restricting permissions to access data.
- Using secure sign-in methods.
- Monitoring systems and security logs.
- Backing up data.
- Updating systems and addressing vulnerabilities.
- Reviewing the service providers we work with.
- Training authorized personnel who handle data.
However, no electronic method or storage system can be guaranteed to be absolutely secure. Users should protect the confidentiality of their login credentials and avoid sharing them with others.
11
User rights
Subject to applicable laws and regulations, users may exercise the following rights:
- Know how their data is collected and used.
- Access their personal data.
- Request a copy of their data in a clear and readable format.
- Request correction of inaccurate data or completion of missing data.
- Request data updates.
- Request deletion or destruction of data where legal conditions are met.
- Withdraw consent where consent is the basis for processing.
- Object to or submit a complaint about data processing.
- Request deletion of the account and related data.
- Contact us regarding any privacy-related inquiry.
We may ask the user to provide appropriate information to verify their identity before fulfilling the request, in order to protect the account and data from unauthorized requests.
We will handle the request within the period set by applicable laws and regulations and may explain if a request cannot be fulfilled fully or partially due to a legal obligation or another legitimate reason.
12
Deleting files and accounts
Users can delete their files through the features available inside the app.
Users may also request deletion of their account and related data through:
- The Delete Account option in the app settings.
- Contacting us by email at info@yastech.com.sa.
When the account is deleted, the user loses access to the files, summaries, questions, and saved data in the account, and recovery cannot be guaranteed after deletion is complete.
We may retain limited data where a legal obligation requires retention, provided that its use is restricted and it is protected in accordance with applicable laws.
13
Children and persons lacking legal capacity
Khulasah is not intended for children or persons lacking legal capacity without the supervision and consent of a parent or legal guardian, in accordance with applicable laws.
If we discover that data of a child or person lacking legal capacity has been collected without the required consent, we will take appropriate steps to delete it or restrict its processing.
A parent or legal guardian may contact us to exercise rights related to the data of a child or person lacking legal capacity.
14
Notifications and messages
We may send users necessary messages related to:
- Account creation confirmation.
- Email verification.
- Password reset.
- Security alerts.
- Important service updates.
- Responses to support requests.
- Material changes to this Policy and Privacy notice.
We may send informational or marketing messages after obtaining the required consent, and users may unsubscribe through the method shown in the message or app settings.
15
Cookies and similar technologies
When using the website connected to Khulasah, we may use cookies or similar technologies to:
- Maintain sign-in sessions.
- Remember user settings.
- Analyze website performance.
- Detect errors.
- Protect the website from unlawful activity.
- Improve the user experience.
Users can control cookies through browser settings. Disabling some cookies may cause certain website features to function incorrectly.
16
External links and services
The app may contain links or integrations with websites or services operated by external parties.
We do not control the privacy policies of those parties, and users are advised to review their policies before providing data or using their services.
17
Legal disclosure
We may disclose data when required by law, court order, or a request from a competent authority.
We may also disclose data when necessary to:
- Protect our rights and property.
- Protect users or others.
- Prevent fraud or misuse.
- Investigate a security incident.
- Enforce agreements and terms related to app use.
Disclosure is limited to the minimum data necessary for the legal or legitimate purpose.
18
Changes to this policy
We may update this policy from time to time as a result of service development, changes in how data is processed, or new legal requirements.
The updated version will be published inside the app or on the website, with the latest update date shown.
If a material change affects user rights or how data is used, we may notify users through the app, by email, or by another appropriate method.
19
Contact us
For inquiries, complaints, or requests to exercise rights related to personal data, you can contact us through:
- Owner
- YAS Company
- App name
- Khulasah
- Address
- Makkah Al Mukarramah - Al Diyafah
Please write Privacy-related request in the message subject and include the information needed to verify the identity of the requester without sending unnecessary additional data.
20
Acknowledgment and consent
By using Khulasah, the user acknowledges that they have reviewed this Policy and Privacy notice and understand how their data is collected, used, stored, and shared as described in it.
Where explicit consent is required, we will ask the user to provide consent before starting the relevant processing.