Privacy Notice

Roles and scope

Zohal may act as a controller for account administration, billing, security, service communications, website analytics, and support. For customer content processed inside a workspace, Zohal generally acts according to the customer's configuration and instructions.

Organization owners and admins decide who may access a workspace, what policies apply, what destinations are allowed, and whether optional server-side protection paths are enabled.

This notice covers the Zohal website, app, workspace, billing flows, browser-extension workflows, support interactions, and related service operations.

What we collect

Account data such as name, email, authentication identifiers, organization membership, role, locale, and support communications.

Workspace data such as organization settings, policies, destinations, detector versions, sanitized thread content, evidence metadata, and billing status.

Usage and security data such as sign-in events, device or browser identifiers, IP-derived region, timestamps, feature usage, error logs, fraud or abuse signals, and audit events.

Payment-related data such as subscription status, plan, invoices, payment attempts, transaction identifiers, card brand, last four digits where available, and token references returned by the payment processor.

Prompt and document privacy

Zohal is local-first for raw prompts and original detected values. In the web workspace, token maps may be stored as client-encrypted private-vault blobs using a Private Vault Key that Zohal does not receive. PDF bytes and extracted raw PDF text are not stored in Zohal cloud by default.

When a workspace enables an optional server-side policy path, submitted text is processed only for the requested protection function and is not persisted as raw prompt content.

Browser-extension field mappings are intended to remain in the active local browser context. The private token vault applies to the Zohal web workspace, not third-party page fields.

If a user copies, exports, sends, or inserts sanitized content into another destination, that destination's own privacy and retention practices may apply.

Evidence we store

Zohal stores privacy-preserving evidence such as destination, action, risk level, category counts, confidence tiers, hashes, policy version, detector version, user, device, and timestamp.

Evidence is designed to support operational review without keeping the original sensitive values.

Evidence may be visible to authorized workspace admins, organization owners, support staff with a need to know, and security personnel investigating reliability, abuse, or compliance issues.

Hashes, counts, and confidence tiers reduce exposure but may still be considered personal data or sensitive operational data in some contexts when combined with other information.

Why we use data

We use data to provide the service, authenticate users, enforce workspace policies, process billing, prevent abuse, support customers, maintain security, and improve product reliability.

We do not sell personal data. We do not use raw prompts or original detected values for advertising.

We may use aggregated or de-identified operational information to understand reliability, feature adoption, detector performance, abuse patterns, and product quality.

Where consent is required for a specific optional activity, we aim to request it separately and allow withdrawal where required by applicable law.

Legal bases and lawful purposes

Depending on the context, we process personal data to perform a contract, take pre-contractual steps, comply with legal obligations, protect legitimate business and security interests, or act on consent where consent is required.

For workspace data, the customer's lawful basis, notices, permissions, and internal approvals may determine whether the material may be submitted to Zohal or an AI provider.

We ask customers not to submit personal data, confidential material, or regulated information unless they have authority and have configured the workspace appropriately.

Payments

Card details are handled by Moyasar. Zohal receives payment status, transaction identifiers, card brand, last four digits where available, and a reusable token reference for renewals.

The reusable token reference is stored in service-role-only systems and is not exposed through browser-facing APIs.

Payment data is used to activate plans, renew subscriptions, issue receipts, resolve disputes, prevent fraud, and maintain accounting and tax records.

Sharing and processors

We share data only as needed with infrastructure, authentication, payment, security, analytics, and support providers that help operate the service.

AI providers may receive sanitized material only when the user or workspace action sends it to that provider.

We may also disclose information to professional advisors, auditors, insurers, potential transaction counterparties, regulators, courts, law enforcement, or public authorities when legally required or reasonably necessary to protect rights, safety, or service integrity.

Processors and service providers are expected to handle data under confidentiality, security, and purpose-limitation obligations appropriate to their role.

Transfers and residency

Zohal is built for Saudi workflows and uses Saudi-region processing where configured for supported AI and NER paths. Some infrastructure or processors may operate outside Saudi Arabia when necessary to provide the service.

Where cross-border processing is used, we aim to apply appropriate safeguards, minimization, and documentation aligned with applicable Saudi data protection requirements.

Workspace admins should review destination and provider settings before sending sanitized material to services that may process data outside the Kingdom of Saudi Arabia.

Retention and deletion

We retain account, billing, workspace, and evidence records for as long as needed to provide the service, meet security and legal obligations, resolve disputes, and maintain audit integrity.

Raw prompt material and original detected values are not retained in Zohal cloud by default. Token maps may be retained only as client-encrypted vault blobs or local device mappings according to workspace policy. Local mappings can be cleared from workspace data controls or by sign-out where policy requires it; encrypted vault mappings can be reset from the private-vault controls. You may request deletion or export of eligible account data through privacy@zohal.ai.

Backups, logs, fraud-prevention records, accounting records, and legal-hold materials may remain for limited periods after deletion from active systems.

Workspace admins may export or delete certain workspace data depending on plan, role, product capability, and legal constraints.

Your rights

Depending on applicable law, you may have rights to be informed, access personal data, request correction, request deletion, withdraw consent where consent is the basis, object to certain processing, and complain to the competent authority.

To exercise rights, contact privacy@zohal.ai. We may need to verify your identity and authority before acting on a request.

If your account is provided by an organization, we may direct requests about workspace content to that organization or coordinate with the organization before responding.

Some requests may be limited by security, confidentiality, legal privilege, audit integrity, payment records, or legal-retention obligations.

Security

We use technical and organizational safeguards such as access controls, service-role separation, evidence minimization, secret management, and secure payment tokenization.

No system is perfectly secure. If we identify a breach that creates legally reportable risk, we will follow applicable notification obligations.

Customers remain responsible for endpoint security, browser hygiene, access reviews, user training, workspace configuration, and controlling what users send to external destinations.

Please report suspected vulnerabilities, unauthorized access, or privacy incidents to security@zohal.ai or privacy@zohal.ai with enough detail for us to investigate.

Children and sensitive contexts

Zohal is intended for business users and is not directed to children. Customers must not allow children to create accounts or use the service unless expressly permitted by law and by Zohal in writing.

The service may help detect sensitive categories, but it is not a substitute for sector-specific compliance controls in healthcare, finance, employment, education, government, or other regulated environments.

Changes to this notice

We may update this notice as the service, law, providers, or data practices change. The updated date shows when the current version took effect.

For material changes, we will use reasonable channels such as in-product notice, email, or account messages where appropriate.