Intelinic DataPrivacy Policy
Last updated: [DATE] · Version 1.0-draft
The short version. If you run Intelinic Data yourself, your data stays on your hardware and never reaches us. If we host it for you, your data sits on a box we run in the Kingdom of Saudi Arabia. In both cases, when you use the AI analyst, the model receives your table structure and the aggregated answer — never your underlying rows. We do not train AI models on your data and we never sell it.
1. Who is responsible
[COMPANY NAME], commercial registration [CR NUMBER], [REGISTERED ADDRESS]. Privacy contact: [DPO EMAIL].
For data you load into Intelinic Data, you are the controller and we act as a processor on your instructions. For your account, billing and support, we are the controller.
2. What we collect
| Category | Examples | Why |
|---|---|---|
| Account | name, work email, organisation, password hash, role | to give you an account and control access |
| Billing | plan, invoices, payment status, tax details | to charge for the service. Card details go directly to our payment processor — we never see or store them |
| Usage | rows processed, bytes stored, AI tokens, job outcomes, timestamps | to meter what you are billed for and to run the service reliably |
| Connection settings | hostnames, database names, credentials for the sources you connect | to extract your data. Encrypted at rest |
| Support | the messages you send us | to answer you |
| Error reports | what failed, where in our code it failed, and how often — the error type, the call stack, the software version, and your workspace identifier | so we can find and fix faults without waiting for you to report them. Sent from both self-hosted and managed installations. See section 2a |
| Your business data | whatever your sources contain | self-hosted: never reaches us. Managed: stored on your box, in our Saudi region |
The marketing pages set no advertising or tracking cookies. The application uses cookies strictly to keep you signed in and to remember your language and theme.
2a. Error reports, and what is stripped out of them
When something in the software fails, the installation sends us a report so the fault can be found and fixed. This happens on self-hosted installations as well as managed ones, and it is worth being exact about what that does and does not include.
A report always contains the type of error, the call stack inside our own code, the software version, and which workspace it came from. That is what identifies a bug.
On a self-hosted installation, values from your data are removed before the report leaves your hardware. Database errors often quote the exact value that caused them — a customer name, an email address, a number from a spreadsheet. Those are stripped and replaced with a placeholder. What remains describes the fault, not the row that triggered it. Table and column names are kept, because they are the structure of your workspace rather than its contents, and without them a report cannot be acted on.
On a managed installation the value is kept, because your data is already stored on infrastructure we operate and the value is frequently what explains the failure.
Never included, on either: passwords, API keys, connection strings or other credentials — these are removed wherever they appear — and no record of what you clicked, no screen recordings, and no contents of requests or responses.
You can switch it off. Set REPORTING=off on your
installation and it sends nothing at all — not error reports, and not the operational
events described above. Nothing else changes; the software works exactly as before, and
we simply find out about faults more slowly.
Error reports are held on infrastructure we operate, are used only to diagnose and fix faults, and are deleted on the schedule in section 5.
3. Where your data is stored
- Self-hosted — on your hardware, in the location you chose. We hold only your account, billing, usage totals and the encrypted credentials needed to reach your sources.
- Managed — on infrastructure operated by Amazon Web Services in the Kingdom of Saudi Arabia. Each customer has their own box and their own storage volume.
4. Who else can see it, and when
We use a small number of providers. Each is listed, with what it receives, on the sub-processors page. In summary:
- Our AI provider receives your table structure and the aggregated result being explained when you use the AI analyst. It does not receive your underlying rows.
- Our embedding provider receives the text of documents you upload on the managed tier, so those documents can be searched. If you do not upload documents, nothing is sent. On self-hosted, embedding runs on your own hardware and nothing is sent at all.
- Our payment processor receives your billing details directly.
- Our email provider receives your address to deliver account email.
Transfers outside the Kingdom. Some of these providers process data outside Saudi Arabia. Where that involves personal data, we rely on the transfer conditions permitted under the Personal Data Protection Law and its regulations, and we contract for appropriate safeguards. If you need every part of the analysis to remain in the Kingdom, ask us about the on-premise AI option, where the model runs on your own hardware and nothing leaves your building.
We also disclose data where the law requires it, and to a successor if the business is sold — in which case we will tell you first.
5. How long we keep it
| What | How long |
|---|---|
| Your business data (managed tier) | while your subscription is active, then [90] days, then permanently deleted — box, storage volume and backups |
| Connection credentials | until you delete the connection, or [30] days after your account ends |
| Account and billing records | as long as tax and commercial law require |
| Usage and audit records | [12 MONTHS] |
| Support messages | [24 MONTHS] |
Deletion is triggered by the state of your subscription, not by how often you sign in. An account that is paid for is never deleted for being quiet. We send reminders before the deletion date, and you can export your data at any time before it.
6. Your rights
Under the Personal Data Protection Law you may ask to access your personal data, to correct it, to have it deleted, to obtain a copy in a readable format, and to be told how it is processed. You may also withdraw consent where processing relies on it, and complain to the competent authority.
Ask at [DPO EMAIL]. We reply within [30] days. For data inside a workspace that belongs to an organisation, we will normally direct the request to that organisation, since they control it.
7. How we protect it
- Credentials are encrypted at rest; secrets are write-only in our console — stored, never displayed back.
- Traffic is encrypted in transit.
- Each customer's data is isolated per box; the tenant is taken from the credential presented, never from anything the browser sends.
- Actions that affect money, entitlement or access are recorded in an append-only audit log.
- Managed boxes are backed up; backups are deleted with the data they belong to.
No system is perfectly secure. If a breach affects your personal data we will notify you and the competent authority as the law requires.
8. Children
Intelinic Data is a business product and is not directed at children.
9. Changes
We will post any change here and, for material changes, email the account owner at least [30] days beforehand.
10. Contact
[COMPANY NAME] · [REGISTERED ADDRESS] · [DPO EMAIL]