Privacy Notice

Roles and scope

Zohal may act as a controller for account administration, billing, security, service communications, website analytics, and support. For customer content processed inside a workspace, Zohal generally acts according to the customer's configuration and instructions.

Organization owners and admins decide who may access a workspace and which workspace settings apply.

This notice covers the Zohal website, web and iPad apps, workspaces, billing flows, support interactions, and related service operations.

What we collect

Account data such as name, email, authentication identifiers, organization membership, role, locale, and support communications.

Workspace and study data such as organization settings, chats and messages, documents you save to your account, marks, scratchpads and handwritten work, usage records, and billing status.

Usage and security data such as sign-in events, device or browser identifiers, IP-derived region, timestamps, feature usage, error logs, fraud or abuse signals, and audit events.

How you first found Zohal: the campaign tags on the link you followed, the referring website's domain, and the first page you landed on. We use this only to understand which channels help students.

Payment-related data such as subscription status, plan, invoices, payment attempts, transaction identifiers, card brand, last four digits where available, and token references returned by the payment processor.

Questions, documents, and handwriting

Questions and chat messages are stored as you write them so you can return to them. Zohal does not detect, mask, or remove personal data from what you submit.

PDFs stay on your device unless you choose to save one to your account, in which case it is kept in private storage. Text extracted from a PDF to answer a request is not stored.

Handwritten work is stored so you can continue and review it. Raw requests to and responses from AI and recognition providers are not stored.

When you speak a question, the recording is sent to an AI provider only to turn it into text, which is sent to the tutor as your question and stored with the conversation like a typed one. Zohal does not keep the recording.

If a user copies, exports, sends, or inserts content into another destination, that destination's own privacy and retention practices may apply.

Usage records

Zohal records each AI request for plan limits and reliability: the time, user, workspace, model, request length, and status, without the text of the request.

Usage records support billing, limits, and operational review.

Usage records may be visible to authorized workspace admins, organization owners, support staff with a need to know, and security personnel investigating reliability, abuse, or compliance issues.

Usage records may be considered personal data when combined with other information.

Why we use data

We use data to provide the service, authenticate users, manage workspace access, process billing, prevent abuse, support customers, maintain security, and improve product reliability.

We do not sell personal data. We do not use your questions, documents, or handwritten work for advertising.

We may use aggregated or de-identified operational information to understand reliability, feature adoption, abuse patterns, and product quality.

Where consent is required for a specific optional activity, we aim to request it separately and allow withdrawal where required by applicable law.

Legal bases and lawful purposes

Depending on the context, we process personal data to perform a contract, take pre-contractual steps, comply with legal obligations, protect legitimate business and security interests, or act on consent where consent is required.

For workspace data, the customer's lawful basis, notices, permissions, and internal approvals may determine whether the material may be submitted to Zohal or an AI provider.

We ask customers not to submit personal data, confidential material, or regulated information unless they have authority and have configured the workspace appropriately.

Payments

Card details are handled by Moyasar. Zohal receives payment status, transaction identifiers, card brand, last four digits where available, and a reusable token reference for renewals.

The reusable token reference is stored in service-role-only systems and is not exposed through browser-facing APIs.

Payment data is used to activate plans, renew subscriptions, issue receipts, resolve disputes, prevent fraud, and maintain accounting and tax records.

Sharing and processors

We share data only as needed with infrastructure, authentication, payment, security, analytics, and support providers that help operate the service.

AI providers receive your question, the recent conversation, and the relevant document excerpts or handwritten work only when you ask Zohal for tutoring, an answer, or a review, and a voice recording only when you speak a question.

We may also disclose information to professional advisors, auditors, insurers, potential transaction counterparties, regulators, courts, law enforcement, or public authorities when legally required or reasonably necessary to protect rights, safety, or service integrity.

Processors and service providers are expected to handle data under confidentiality, security, and purpose-limitation obligations appropriate to their role.

Transfers and residency

Zohal is built for Saudi workflows. Some infrastructure, AI providers, or processors operate outside Saudi Arabia when necessary to provide the service.

Where cross-border processing is used, we aim to apply appropriate safeguards, minimization, and documentation aligned with applicable Saudi data protection requirements.

Customers should consider this before submitting material that must not be processed outside the Kingdom of Saudi Arabia.

Retention and deletion

We retain account, billing, workspace, and usage records for as long as needed to provide the service, meet security and legal obligations, resolve disputes, and maintain audit integrity.

Questions, chats, saved documents, and handwritten work are kept while your account is active and are deleted when you delete your account from Settings. PDFs remembered by your browser can be cleared from Settings. You may request deletion or export of eligible account data through privacy@zohal.ai.

Backups, logs, fraud-prevention records, accounting records, and legal-hold materials may remain for limited periods after deletion from active systems.

Workspace admins may export or delete certain workspace data depending on plan, role, product capability, and legal constraints.

Your rights

Depending on applicable law, you may have rights to be informed, access personal data, request correction, request deletion, withdraw consent where consent is the basis, object to certain processing, and complain to the competent authority.

To exercise rights, contact privacy@zohal.ai. We may need to verify your identity and authority before acting on a request.

If your account is provided by an organization, we may direct requests about workspace content to that organization or coordinate with the organization before responding.

Some requests may be limited by security, confidentiality, legal privilege, audit integrity, payment records, or legal-retention obligations.

Security

We use technical and organizational safeguards such as access controls, service-role separation, data minimization, secret management, and secure payment tokenization.

No system is perfectly secure. If we identify a breach that creates legally reportable risk, we will follow applicable notification obligations.

Customers remain responsible for endpoint security, browser hygiene, access reviews, user training, workspace configuration, and controlling what users send to external destinations.

Please report suspected vulnerabilities, unauthorized access, or privacy incidents to security@zohal.ai or privacy@zohal.ai with enough detail for us to investigate.

Children and sensitive contexts

Zohal is intended for business users and is not directed to children. Customers must not allow children to create accounts or use the service unless expressly permitted by law and by Zohal in writing.

The service is not a substitute for sector-specific compliance controls in healthcare, finance, employment, education, government, or other regulated environments.

Changes to this notice

We may update this notice as the service, law, providers, or data practices change. The updated date shows when the current version took effect.

For material changes, we will use reasonable channels such as in-product notice, email, or account messages where appropriate.