Areef — Privacy Policy

Version 1.0 · Effective 14 October 2026

Areef is operated by Khaloud Digital Solution Company SPC, a company registered in the Sultanate of Oman ("Areef", "we", "us").

This policy explains what information Areef holds, why, and what you can ask us to do about it. It forms part of the Terms of Service, which govern your use of the platform. Where a term is defined in the Terms, it carries the same meaning here.

To ask anything about this policy, or to make a request about your information, use the contact form on our website.

---

1. Our role, and yours

Areef sits in two positions depending on the information.

We are the controller of the information we need to run the business: the accounts we create, the record of who accepted which version of our documents, and our usage and billing records.

We are a processor of everything you put into your workspace and everything the platform produces for you. You decide what goes in, what it is for, and how long it stays. We act on your administrators' instructions. Where that information includes personal data, you are the controller and you are responsible for having a lawful basis for it.

This distinction matters most for one feature. Areef can produce a brief about a named individual — typically a decision-maker at a company you are pursuing — assembled from publicly available sources. That individual is not our user and has not come to us. You decide to run that analysis, so you are the controller of it, and the obligations that come with it are yours. Section 5 sets out what we do about it and what we expect of you.

2. What we hold

Account information. The email address your administrator invited, the name you give when you create your account, the organisation and role you are assigned, the dates on which you sign in, and the record of which version of our documents you accepted and when. Passwords are stored only as a one-way cryptographic hash and cannot be read by anyone, including us.

Your workspace content. The records, notes and documents you or your colleagues put into Areef, and everything the platform produces from them. Some of this will contain business contact information about third parties, because that is what the platform is for.

Enquiries. If you contact us through our website, we hold what you send so that we can reply.

Technical information. Your session is held in your browser and identifies nothing but that session. Our systems generate operational records — timestamps, errors and similar — used to diagnose faults and detect abuse. Areef sets no advertising or tracking cookies, and our emails do not report whether you opened them.

What we do not want. Areef is not built to hold special-category personal data — health, religion, political opinion, biometric or genetic information, sexual life — nor government identity numbers, nor payment-card details. The Terms prohibit putting them in. If you find that something of this kind has reached the platform, tell us and we will remove it.

3. Why we use it

We use this information to create and authenticate accounts and apply the right permissions; to produce the results you ask for; to meter your plan and bill for the service; to keep the platform secure and investigate faults and abuse; to keep a record of what was agreed; and to reply to you when you contact us.

We may also produce statistics about how the platform is used — volumes, error rates and similar — provided they identify no person and no organisation.

We do not use your information for advertising, we do not sell it, and we do not share it with other customers.

4. Artificial intelligence

Areef produces its results with the help of third-party artificial-intelligence and information-retrieval services. Doing so means sending them the subject of your request, the material gathered for it, and the parts of your workspace content that the request needs — including any document you have attached.

We send only what the request needs, and only when you or a colleague make that request. There is no background processing of your workspace. Each provider is engaged under written terms that limit what it may do with what it receives.

The Terms explain what the results are and are not, and why they must be verified before you rely on them. That is the most important thing to understand about this platform, and it is set out there rather than repeated here.

5. Individuals who are not our users

Areef holds information about people who have never used it: individuals named in a brief, business contacts recorded against a company, and the recipients of documents you generate.

What we hold. For a brief about an individual: their name, their employer and role as publicly reported, and an account of their professional position drawn from publicly available sources, with a citation for each factual claim. We do not seek out private-life information and we do not use information about health, beliefs, family or finances.

How long. Such a brief stays in the customer's workspace until the customer deletes it, or until the customer's subscription ends.

Their rights. An individual may contact us through our website to ask what we hold about them, to have it corrected, to object to it, or to have it deleted. Because our customer is the controller of such a brief, we will identify the workspaces concerned, pass the request on without delay, act on the instruction we receive, and tell the individual what has been done. We will not refuse a deletion request on the ground that the information was publicly available.

What we expect of our customers. If you produce briefs about individuals, you must satisfy yourself that you have a lawful basis, keep the brief to the person's professional role and to genuine business purposes, and comply with the Terms.

6. Who can see your information

Access inside Areef is restricted by organisation and by role, and is enforced at the data layer rather than only in the interface, so one customer cannot reach another customer's information.

A small number of our personnel hold administrative rights that allow them to see service usage and configuration and, where necessary to operate, support or secure the platform, to enter a customer's workspace. That access is held by named individuals, is read-only in respect of customer content, and is subject to the confidentiality obligations in the Terms.

We also use a limited number of service providers to deliver the platform — for hosting and data storage, for artificial-intelligence and retrieval services, and for sending email. Each is engaged under written terms that require it to act only on our instructions, keep what it receives confidential, protect it with appropriate security and assist us with your requests. We remain responsible to you for the service they provide. A current list of these providers is available to customers on request, and we will tell you before we make a change that materially affects how your information is protected.

7. Where your information is held

The platform and your information are hosted with established infrastructure providers in secure data centres. Some of the providers described above operate from outside the Sultanate of Oman; each is engaged under terms that require appropriate protection wherever it operates.

8. How long we keep it

9. Security

• Information is encrypted in transit and at rest.
• Passwords are stored only as one-way cryptographic hashes.
• Access is restricted by organisation and by role, enforced at the data layer.
• Accounts cannot be created by self-registration. An account can be created only for an address that an administrator has invited.
• Uploaded documents are held in private storage, reachable only through a time-limited link issued to an authorised user.
• Administrative access to production systems is limited to named individuals.

No system is perfectly secure. If a breach affects your personal data and is likely to cause you harm, we will tell you and the relevant authority as the law requires, and without undue delay.

10. Your rights

Subject to the law that applies to you, you may ask us to tell you what we hold about you and why; give you a copy in a portable form; correct anything inaccurate; delete what we hold, where we have no overriding obligation to keep it; restrict or object to a particular use; or withdraw consent where consent is the basis, which does not affect what was lawful before.

Areef makes no decision about you by automated means that has a legal or similarly significant effect on you.

Contact us through our website. We will respond within 30 days, and may need to confirm your identity first. If you use a customer's workspace, we will normally pass your request to that customer's administrators, since they control that information, and tell you that we have done so.

If you are unhappy with our response, you may complain to the competent data-protection authority in the Sultanate of Oman or, where it applies to you, to your local authority.

11. Children

Areef is a business tool, is not directed at anyone under 18, and we do not knowingly hold information about children.

12. Changes

We may update this policy. For a material change we will give at least 30 days' notice by email to your administrators and in the application, and users will be asked to accept the new version at next sign-in. The version number and effective date at the top of this page always reflect the policy in force.

13. Contact

Khaloud Digital Solution Company SPC Registered in the Sultanate of Oman

Please use the contact form on our website.