Privacy Policy

The controller of your account data (your name, email and registration details) is Digital Optimization Company (DOAI).

For the documents and data your organisation uploads to the Service (supplier invoices, purchase orders, supplier details and bank accounts, payments), your organisation is the controller and we process that data on its behalf and instructions, as a processor, to the extent needed to provide the Service.

• Account data: name, email, password (hashed — we never see it), job title, mobile number if you add it, preferred language.
• Organisation data: name, commercial registration, VAT number, address, billing details, member roles.
• Organisation content: uploaded documents (invoices, purchase orders, receipts, photos from a phone) and what is extracted from them, supplier data including bank accounts, payments, notes, decisions and the approval log. These documents may contain personal data of people at your suppliers (names, phone numbers, email).
• Usage and security data: IP address, browser and device type, sign-in times and the log of actions inside the Service (who did what and when) — for security and audit purposes.
• Payment data: when you pay through the payment gateway your card details are processed by the licensed payment provider; card numbers never reach us. We keep the transaction reference, amount and date, and, if you opt into auto-renewal, the card's last four digits, its network and a secure token held by the payment provider. Bank transfers are confirmed manually from the transfer notice you send.
• Notification devices: when you turn on phone or browser notifications we record the device address and the two encryption keys your browser generates to deliver notifications to it; they are deleted when you turn notifications off in Settings.

• Providing the Service: reading documents, extraction, matching, approval chains, notifications, reports and exports.
• Security and fraud prevention: protecting accounts, detecting unusual sign-ins, verifying that you are not a bot, keeping an audit log.
• Billing, subscription management and communicating with you about the Service (alerts, renewals, material changes).
• Technical support and troubleshooting.
• Complying with the law and responding to lawful requests.
• Improving the Service through aggregated statistics that identify neither a person nor an organisation. We do not sell your data and do not use it for advertising.

To extract invoice data, the document image or text is sent to an AI model operated by a third-party provider (Anthropic) through its business API. Under the terms of that API your documents are not used to train models, and the provider retains them only for the short operational period needed to process the request, according to its policies.

AI outputs (extracted fields, confidence score, remarks, matching) assist human review and do not replace it; the final decision to approve or pay remains with your organisation.

We rely on service providers to run the platform. They may use the data only to provide their services to us and under contractual confidentiality and security obligations:

• Supabase — database, document storage and sign-in management (data centres in the European Union).
• Railway — hosting of the web application and the extraction worker (European Union).
• Cloudflare — network, protection against attacks, and bot verification.
• Anthropic — the AI model used to extract document data (United States).
• Moyasar — the online payment gateway (mada, Visa/Mastercard, Apple Pay), in the Kingdom and licensed by the Saudi Central Bank; card details are processed there and never reach us, and when you opt into auto-renewal it keeps a secure token for your card.
• Resend — delivery of the Service's notification e-mails (United States): the recipient address and the notification text.
• The browsers' push services (Google and Apple) that deliver phone notifications — the notification content is encrypted end to end and these services cannot read it.

We may disclose data where required by law, a court order or a competent authority, to protect our rights or the safety of users, or in a merger or acquisition, with prior notice to you.

Service data is stored encrypted in transit and at rest on infrastructure run by the Digital Optimization Company for Information Technology with the service providers named above — providers under contract with us that meet recognised security standards — and access is limited to the minimum needed to operate the Service.

The data centres of our database and hosting providers are in the European Union, and extraction is processed by the AI provider in the United States; that is, some of your data is transferred and stored outside the Kingdom. This is done in line with the Personal Data Protection Law and its regulation on transfers outside the Kingdom, with appropriate contractual and technical safeguards.

If your organisation requires hosting inside the Kingdom, contact us before subscribing to discuss the available options.

• Encrypted connections (TLS) between your browser and the Service, and encrypted storage at our providers.
• Each organisation's data is isolated at the database level, so a member can only reach their organisation's data, according to their role.
• Bot verification at sign-in and sign-up, limits on sign-in attempts, and sealed secret keys.
• An audit log of sensitive actions and periodic backups at the database provider.
• No system is 100% secure. If we become aware of a security incident affecting your data we will notify you and the competent authority as required by law.

We keep your account data and your organisation's content for the duration of the subscription. When a subscription lapses without renewal the account switches to read-only and the content stays visible to you until you renew or ask to close the account.

When you ask to close (or delete) the account, the organisation's data is permanently deleted 90 days after the request; during that period you can export your data. Backups are purged within a further 30 days. We may keep the minimum billing data and records the law requires.

Statutory obligations to keep invoices and accounting records for the prescribed periods rest with your organisation; the Service is a processing tool, not a statutory archive replacing your own records.

Under the Personal Data Protection Law you have the right to:

• Know what data we hold about you, access it and obtain a copy (export is available inside the Service).
• Correct or update your data (from Settings or by contacting us).
• Request deletion or destruction of your data where there is no legal need to keep it.
• Object to, or request restriction of, a particular processing, and withdraw consent where processing relies on it.
• Lodge a complaint with the competent personal-data-protection authority in the Kingdom.

To exercise any of these rights, write to support@daqiqai.com. We may ask you to verify your identity and will respond within the statutory period. If your request concerns data entered by one of our customer organisations, we will forward it to that organisation as the controller.

We use strictly necessary cookies only: the sign-in session, the preferred language, and the bot-verification cookie (Cloudflare Turnstile). We use no advertising cookies and no third-party trackers. Disabling these cookies prevents signing in.

To count visits to the public pages we use Cloudflare Web Analytics in aggregate; it sets no cookies, collects no personal identifiers and does not track you across other sites.

The Service is intended for organisations; persons under 18 may not create an account.

We may update this policy from time to time. For material changes we will notify you by email or inside the Service before they take effect; the last-updated date and version number stay at the top of this page. Continuing to use the Service after the effective date means you accept the update.

Digital Optimization Company (DOAI), Commercial Registration No. 1010958459, Riyadh, Kingdom of Saudi Arabia.

Email: support@daqiqai.com