Legal
Privacy policy.
What personal data bynh collects, why, how long we keep it, and the rights you have under Saudi Arabia’s Personal Data Protection Law (PDPL).
Version 1.3
The short version
- 01We collect only what we need to run bynh, and we never sell personal data.
- 02Customer data is stored with Amazon Web Services in Frankfurt, Germany, outside the Kingdom, under the PDPL transfer rules.
- 03You can see, correct or delete your data, and withdraw consent, from your account or by email.
- 04We use strictly necessary cookies only. No advertising, no cross-site tracking.
- 05If we don’t resolve a concern, you can complain to SDAIA, the national data regulator.
Who we are
Dokan Application Co. (commercial registration 4030396188), Ar Riyadh District, Jeddah 23839, is the controller for the personal data in this policy: people who visit bynh.io, sign up, or use the app. We are registered with SDAIA’s national data governance platform.
For the content our customers publish on their own trust centers, the customer is the controller and we process it on their instructions under our data processing agreement.
What we collect
| Category | Examples | |
|---|---|---|
| AccountYou | Name, work email, workspace role, language | You |
| Trust center visitsAutomatic | IP address, approximate location (country and city), device and browser, language, referring page and campaign tags, pages viewed, documents opened and time spent, recorded without cookies | Automatic |
| BillingYou | Company name, VAT number, billing contact | You |
| Access requestsViewer | Viewer name, email, company, NDA acceptance time | Viewer |
| Usage and securityAutomatic | IP address, device, sign-in times, audit log events | Automatic |
We don’t collect sensitive data such as health, religion or biometrics, and we ask you not to upload it as evidence.
Purposes and legal basis
- 3.1To provide the service you signed up for. Basis: our contract with you.
- 3.2To issue ZATCA e-invoices and keep accounting records. Basis: legal obligation.
- 3.3To keep bynh secure and stop abuse. Basis: our legitimate interest, balanced against your rights.
- 3.4To send product news. Basis: your consent, which you can withdraw with one click.
How long we keep it
Account data lives as long as your account, then 30 days for export and up to 60 days for deletion. A deleted workspace can be restored for 30 days, then it’s removed with its files. Invoices and payment records are kept permanently as tax records, even after a workspace is deleted. Trust center visit records, including visitors’ IP addresses, are kept for 400 days and shown to the workspace that owns the trust center and monitor checks for 90 days. Accounts that were never verified are deleted after 7 days.
The audit log is the exception. It records who changed what, when and from which IP address, and it’s kept as a permanent record, because that record is the evidence your customers and auditors rely on.
Transfers outside the Kingdom
Customer data is hosted outside the Kingdom, with Amazon Web Services in Frankfurt, Germany. Some services we use, such as error reporting and smart features, process limited data in the United States; the subprocessor list says which, and what reaches them. We transfer personal data only under the PDPL Implementing Regulation and SDAIA’s transfer rules: to a country with adequate protection, or with appropriate safeguards such as standard contractual clauses, and only the minimum needed. The data stays encrypted in transit and at rest.
Your rights
Under the PDPL you can ask us to do any of the following. We reply within 30 days, and it costs you nothing.
Be informed
Know what we hold, why, and who we share it with.
Access
Get a copy of your personal data in a readable format.
Correction
Fix anything that’s wrong or incomplete.
Deletion
Have it erased once we no longer need it.
Withdraw consent
Where we rely on consent, you can take it back at any time. It doesn’t affect what we did before.
Subprocessors
We use a small number of vetted providers for hosting, email, payments and, only when a workspace turns them on, smart features. Here is who they are, what they do and where they process data. The list is public and dated, and we update it before we add anyone.
- Since 30 Sept 2026
Writing and reading assistance for smart features: drafts, summaries, answers with sources, and reading uploaded files. · United States
- Since 30 Sept 2026
Fast decisions for smart features: sorting, routing and checks, such as how severe a report is or whether a question is on topic. · United States
- Since 1 Oct 2026
Reading a company’s public website during Smart setup, to pre-fill its profile, brand and likely subprocessors for a person to confirm. · United States
Runs the bynh app and API, and stores workspace data and uploaded files. · Germany (Frankfurt)
Serves bynh.io and the docs, protects traffic and issues certificates for custom domains. · Global edge network
Delivers email: sign-in codes, invitations, notifications and status page updates. · To confirm
Takes card payments for subscriptions. · To confirm
Tells our engineers when something in bynh breaks, and where in the code. · United States
Security
Data is encrypted in transit and at rest, access is limited to staff who need it, and every access is logged. If a breach puts your data at risk, we notify SDAIA within 72 hours and tell you without undue delay.
Children
bynh is a business service and isn’t meant for anyone under 18. We don’t knowingly collect their data.
Changes to this policy
We email account holders 30 days before a material change and keep every earlier version public.
Contact our DPO
Our data protection officer handles every privacy request and question. Write to dpo@bynh.io and we’ll confirm we have your request, then answer it within 30 days.
Complaints to SDAIA
Please talk to us first so we can put it right. If you’re not satisfied with our answer, you can complain to the Saudi Data and AI Authority (SDAIA), which supervises the PDPL, through its official complaints channel at sdaia.gov.sa.