Privacy policy

Who we are

The controller of your data: NCASE.

For any question or request about your data, write to the contact address at the foot of the site.

What we collect

Your account: your email address and password (kept by our sign-in provider in hashed form; we never see it).

What you ask and make: your questions and conversations, your report choices and notes, projects, rooms and their messages, notes in "Your mind", custom skills, settings and review requests.

Files you upload to Work: the text we extract from them, to check their figures.

Monitors: the email or Slack addresses you send briefs to, and their language.

Technical records: sign-in attempts and request counts used to prevent abuse, and server logs (IP address, time, page) kept for security.

Usage statistics: the pages you open (the route only, never ids or queries), how long a page is in front of you, the kind of device (phone, tablet or computer), the country our host derives from the request, where you came from (the site's name only), and what you used (questions, uploads, downloads, and what AI cost for your answers). We store no IP address and no browser fingerprint; a random visit id lives in your browser tab and goes when you close it. It is not a cookie.

Why we use it

To provide the service you asked for: answer your questions, make reports, check your files and send the briefs you set up.

To keep the service secure and prevent abuse, and to keep the record of reviews.

Usage statistics: to learn what helps customers and what does not, and to plan capacity and costs. Only the NCASE team sees them, and we share them with no one. If your browser asks not to be tracked (Global Privacy Control or Do Not Track), we do not record your pages.

We do not sell your data, we do not use your content to train AI models, and we ask AI providers not to retain it.

Who processes it for us, and where

Supabase: database and sign-in — outside the Kingdom.

Vercel: hosting — a global network, mostly in the United States.

OpenRouter and the AI model makers it routes to (Anthropic, OpenAI): your question, the earlier questions of the conversation and the figures we found, when AI writes the answer — outside the Kingdom, mostly in the United States, with zero data retention requested.

Resend: the address and content of a brief, when one is emailed — United States.

Slack: only if you set a monitor to post to Slack — United States.

Your data is processed by these providers outside the Kingdom of Saudi Arabia. We share with them only what the service needs.

How long we keep it

Conversations, projects, rooms, notes and monitors: until you delete them or close your account.

Uploaded files: we keep only the text read from them, never the file, and delete it with its check 90 days after upload.

Review requests: as the record of what an NCASE analyst decided, until you close your account.

Request counters: two days. Server logs: for a short period, for security.

Page statistics: 13 months. The usage record (questions, uploads, downloads and their cost): 24 months. Both are deleted at once when you close your account.

When you close your account we delete your organisation's data from the database at once; it leaves backups when they expire.

Your rights

You may know how we process your data, see it and get a copy (Settings → Your data → Download everything), ask us to correct it, delete it (Settings → Your data), and stop emails at any time (the link in every email).

For anything else, write to the contact address at the foot of the site. We answer requests within 30 days.

You may also complain to the Saudi Data and AI Authority (SDAIA).

People you send briefs to

If you send briefs to someone else, we ask them to confirm that they agree before any brief reaches them, and they can stop them at any time.

Cookies

We use only what is needed to keep you signed in, we remember in your browser that you finished the tour, and we keep the visit id for usage statistics (until you close the tab). No advertising cookies and no third-party tracking.

Changes

If we change this policy in a material way, we tell you in the platform before it takes effect.