Privacy Policy

1. Who we are

Qubit is a business data analytics platform operated from the Kingdom of Saudi Arabia. Businesses use Qubit to bring data from their existing systems into one place and analyze it.

This policy applies to qubit.sa and to the Qubit application. It describes how we handle personal data belonging to the people who use Qubit, and how we handle the business data our customers choose to connect.

We process personal data in accordance with the Personal Data Protection Law of the Kingdom of Saudi Arabia and its implementing regulations. Where our customers are subject to other data protection laws, we support them in meeting their obligations under those laws as well.

2. Information we collect

We collect three kinds of information.

• Account information you give us, such as your name, work email address, and the workspace you belong to. If you sign in through a third party such as Google, we receive your basic profile and email address from that provider.
• Connected data, which is the business data you instruct Qubit to load from systems you connect, such as databases, spreadsheets, CRM systems, and advertising accounts. This is your data, and you decide which sources to connect.
• Usage and technical data generated when you use the platform, such as pages visited, features used, approximate location derived from IP address, browser and device type, and error diagnostics.

3. How we use information

We use the information described above to:

• Provide the platform, including loading your connected data, running the analyses you request, and displaying the results.
• Authenticate you, secure your workspace, and keep an audit record of significant actions.
• Support you when you contact us, and diagnose faults.
• Improve reliability and performance, and develop features.
• Meet legal, accounting, and regulatory obligations.

We do not sell personal data, and we do not use your connected business data to serve advertising.

4. Google user data

If you connect a Google service to Qubit, you authorize us through Google’s own consent screen. We never receive or store your Google password.

When you connect Google Ads, we request read access to your advertising data. We use it to retrieve the accounts your login can reach, and then, for the account you select, your campaign, ad group, and ad structure together with performance metrics such as impressions, clicks, cost, and conversions.

We use Google Ads data to provide the reporting and analysis you request in your workspace. We do not create, edit, pause, or delete your campaigns. Google Ads uses the same OAuth permission for reading and managing advertising data, so its consent screen describes broader access than the reporting operations Qubit performs.

If you choose another Google connection, the data accessed depends on the service and source you select:

• Google Analytics: accessible property information and reports about traffic, acquisition, pages, events, and geographic and device dimensions.
• Google Sheets: spreadsheet metadata, worksheet names, and cell values from the spreadsheet URL you supply. Qubit does not request access to browse all your Drive files or edit your spreadsheet.
• Google Search Console: accessible website properties and search-performance reports, including queries, clicks, and impressions.
• BigQuery: accessible projects, datasets, table schemas, and query results from the dataset you select. Queries remain subject to your Google Cloud permissions.
• Google Cloud Storage: object listings and the contents of supported data files in the bucket and optional prefix you specify. Qubit does not upload, overwrite, or delete your source objects.

Qubit imports connected records into your workspace warehouse or queries the selected source to produce the analyses you request. A language model running within the Saudi-hosted deployment processes relevant questions, data structure, and query results to generate answers, summaries, and visualizations. This AI processing takes place within the Kingdom of Saudi Arabia. We do not send this data to external language-model APIs.

We use connected Google data for inference only: to answer your requests. We do not use this data to train or fine-tune models. In particular, data obtained through Google Workspace APIs is not used to develop, improve, or train non-personalized AI or machine-learning models.

Google authorization credentials are stored encrypted at rest and used to access your selected source and refresh authorization for on-demand or scheduled operations. Imported records are stored in your workspace data warehouse and made available according to workspace access permissions.

We do not transfer Google user data to third parties, other than infrastructure providers that host the Saudi service on our behalf, process this data within the Kingdom of Saudi Arabia, and are bound to protect it. We do not sell it, we do not use it for advertising or retargeting, and we do not use it to assess credit-worthiness. Qubit personnel do not read it, except where you have specifically asked us to look at something, where it is necessary to investigate abuse or a security incident, or where the law requires it.

Qubit’s use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements.

You can revoke Qubit’s authorization through your Google Account’s connected apps. You can also remove a connection in Qubit. Revoking Google authorization prevents subsequent authorized retrieval; it does not by itself erase information already imported into Qubit. See the retention section for deletion and contact us at [email protected] to request removal of retained information.

5. How we share information

We do not sell your information. We share it only in these situations:

• With service providers who run parts of our infrastructure, such as cloud hosting, database and storage providers, error monitoring, and email delivery. They may process data only on our instructions and only to provide their service to us.
• Within your workspace, where data you connect is visible to the members and administrators of that workspace, according to the permissions you set.
• Where the law requires it, or to establish, exercise, or defend legal claims.
• In connection with a merger, acquisition, or sale of assets, in which case we will give notice before your information becomes subject to a different policy.

6. How long we keep it

We keep account information and connected data while needed to provide your workspace services. Removing a connection deactivates its connection record and initiates cleanup of its synchronization pipeline and imported warehouse data. The connection record, including stored credentials, may remain in our database; removal is not an immediate erasure of every copy. Cleanup failures may require follow-up. Revoke access in your Google Account to invalidate the authorization separately.

Saved conversations, reports, and other workspace content may contain previously retrieved results and are not automatically erased by removing their source connection. Contact [email protected] to request deletion of retained connection information and derived content. We will confirm the scope of your request and explain any remaining retention, including applicable backups or legal and accounting obligations. The response process is described under Your rights and choices.

7. Security

Credentials for connected sources are encrypted at rest. Access to production systems is restricted to personnel who need it, and significant actions in the platform are recorded in an audit log. Optional two factor authentication is available, and workspace administrators can restrict access by IP address.

No system is completely secure, and we cannot guarantee absolute security. If we become aware of a breach affecting your personal data, we notify the competent authority within 72 hours of becoming aware of it, as the Personal Data Protection Law requires, and we notify you where the breach is likely to cause you harm.

8. Your rights and choices

You have the right to be informed of how your personal data is used, to access it, to request that it be corrected or destroyed, to withdraw consent you have given, and to receive a copy in a readable format. You can exercise these rights by contacting us at the address below.

We respond to requests within 30 days. Where a request is complex we may extend that by a further 30 days, and we will tell you if we do.

If you are in the Kingdom of Saudi Arabia and you are not satisfied with how we have handled your data or your request, you may complain to the Saudi Data and Artificial Intelligence Authority (SDAIA), which supervises the Personal Data Protection Law. If you are elsewhere, you may complain to your local data protection authority.

Where Qubit processes data on behalf of a customer, requests are directed to that customer as the party responsible for the data, and we assist them in responding.

9. Data residency

For the Saudi-hosted service covered by this policy, Qubit and its service providers store and process customer data within the Kingdom of Saudi Arabia, including AI processing. We do not transfer this data outside the Kingdom for storage or processing by Qubit or its service providers. The sharing arrangements described in this policy do not change this data residency commitment.

If you choose to connect an external service such as Google, Qubit communicates with that service to authenticate and retrieve the data you select. The connected service operates under its own terms and privacy policy; Qubit’s Saudi hosting commitment does not change where that independently operated source service stores or processes data.

10. Children

Qubit is a product for businesses and is not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, contact us and we will delete it.

11. Changes to this policy

We may update this policy as the product changes or the law requires. When we make a material change we will update the date at the top of this page and, where appropriate, notify you in the product or by email. Continuing to use Qubit after a change means you accept the updated policy.

12. Contact us

If you have a question about this policy or about how we handle your data, write to us at [email protected].