Who we are
Aseef is operated by Aseef, established in the Kingdom of Saudi Arabia. Aseef is the controller of the personal data described in this Policy, which means we decide why and how it is processed.
You can reach us about anything in this Policy at hi@jehaad.com.
Data we collect
The table below lists every category of personal data the Service processes, where it comes from, and why.
Category: Account
- Examples
- Name, email address, profile image, sign-in provider identifier
- Source
- You, through Google or Apple sign-in
- Purpose
- Create and secure your account
Category: Content
- Examples
- Spaces, ideas, blocks, comments, polls, decisions, actions, uploaded files
- Source
- You and your collaborators
- Purpose
- Provide the Service
Category: Collaboration
- Examples
- Memberships, roles, invitations, presence, activity log, notifications
- Source
- Generated as you use the Service
- Purpose
- Show who did what, deliver notifications
Category: Preferences
- Examples
- Language, theme, density, text size, analytics choice
- Source
- You
- Purpose
- Remember your settings across devices
Category: Device and technical
- Examples
- IP address, browser and device type, app version, timestamps
- Source
- Collected automatically
- Purpose
- Security, abuse prevention, reliability
Category: Push tokens
- Examples
- The notification token of each device you allow
- Source
- Your device, with your permission
- Purpose
- Deliver notifications
Category: Analytics and crash reports
- Examples
- Masked usage events, error messages and stack traces
- Source
- Collected automatically, only after you accept analytics
- Purpose
- Understand usage, fix crashes
Category: Support messages
- Examples
- What you write to us and your contact address
- Source
- You
- Purpose
- Answer your request
Category: Pro announcement list
- Examples
- Email address, language, the page you signed up on, and when
- Source
- You, on the pricing page, with or without an account
- Purpose
- Tell you when Pro launches
Why we may process it
Each purpose rests on a legal basis under the General Data Protection Regulation (GDPR) and the Saudi Personal Data Protection Law (PDPL).
Purpose: Providing the Service, including invitations and notifications
- GDPR basis
- Performance of a contract, Art. 6(1)(b)
- PDPL basis
- Necessary to perform an agreement you are party to
Purpose: Security, abuse prevention and service reliability
- GDPR basis
- Legitimate interests, Art. 6(1)(f)
- PDPL basis
- Legitimate interest of the controller
Purpose: Product analytics and crash reports
- GDPR basis
- Consent, Art. 6(1)(a)
- PDPL basis
- Consent
Purpose: Telling you when Pro launches, if you asked
- GDPR basis
- Consent, Art. 6(1)(a)
- PDPL basis
- Consent
Purpose: Meeting legal obligations and answering authorities
- GDPR basis
- Legal obligation, Art. 6(1)(c)
- PDPL basis
- Required by law
Who we share it with
We share personal data only with the service providers below, who process it on our documented instructions and under data processing terms. We do not sell personal data.
Other participants in a space see what the product shows them: your display name, avatar, contributions and presence, according to the host's settings. Do not share in a space what you would not want its members to read.
We may disclose data when the law requires it, to protect the rights and safety of users, or as part of a merger or acquisition, in which case this Policy continues to apply.
Provider: Vercel
- Purpose
- Hosts and serves the website and web app.
- Data
- IP address, request metadata
- Region
- United States, global edge
Provider: Convex
- Purpose
- Stores spaces, ideas, blocks and files, and carries the realtime connection.
- Data
- Account profile, content, collaboration metadata
- Region
- United States
Provider: Clerk
- Purpose
- Sign-in, sessions and account identity. No password ever reaches Aseef.
- Data
- Name, email, profile image, session data
- Region
- United States
Provider: Google and Apple sign-in
- Purpose
- The identity providers you choose to sign in with.
- Data
- Name, email, profile image
- Region
- United States
Provider: Cloudflare Turnstile
- Purpose
- Bot protection on sign-in, run through Clerk.
- Data
- IP address, browser signals
- Region
- Global
Provider: Resend
- Purpose
- Sends invitation and notification emails.
- Data
- Email address, message content
- Region
- United States
Provider: Expo
- Purpose
- Builds the mobile apps and relays push notifications.
- Data
- Push token, notification text
- Region
- United States
Provider: Apple Push Notification service
- Purpose
- Delivers notifications to iPhone and iPad.
- Data
- Push token, notification text
- Region
- Global
Provider: Firebase Cloud Messaging
- Purpose
- Delivers notifications to Android and to web browsers.
- Data
- Push token, notification text
- Region
- Global
Provider: PostHog
- Purpose
- Product analytics and crash reports, only after you accept analytics.
- Data
- Masked usage events, device type, error details
- Region
- United States or European Union, per configuration
Provider: Polar
- Purpose
- Payments, if paid plans are ever offered. Only when enabled. Payments are off in Aseef 1.0.
- Data
- Billing details you give Polar directly
- Region
- European Union
Provider: OpenAI
- Purpose
- The AI assistant, if it is ever switched on. Only when enabled. The assistant is off in Aseef 1.0.
- Data
- The messages you send to the assistant
- Region
- United States
How long we keep it
We keep personal data only as long as the purpose requires:
- Account and content: for as long as your account is active.
- Trash: a deleted idea or space stays recoverable for 30 days, then it is permanently deleted.
- Account deletion: when you confirm, your account is scheduled for deletion 7 days later, and you can cancel at any time before then. After that, a background job erases your data from every table and removes your sign-in identity last. If you delete your sign-in account directly with our sign-in provider, deletion starts right away.
- Backups: our database provider keeps backups for up to 30 days, after which deleted data no longer exists in them.
- Analytics and crash reports: up to 12 months.
- Support messages: for as long as needed to resolve your request, then up to 12 months.
- Pro announcement list: until we send the announcement you asked for, then deleted. Ask us to remove your address at any time and we delete it sooner.
- Service status measurements contain no personal data.
Deleting your account
You can permanently delete your account at any time from Account settings inside the Service. Deletion signs you out on every device and then removes your account and profile, the spaces you host with their ideas, blocks, memberships and presentation data, and your notification destinations, preferences, avatar and unclaimed uploads.
Contributions you made in spaces hosted by someone else may remain so the discussion still makes sense, but they are no longer connected to an account.
If you cannot sign in, email hi@jehaad.com from the address on your account and ask for deletion. We will verify that you control the account before acting. Do not send passwords, sign-in codes or identity documents in a first message.
How we protect it
Data is encrypted in transit and at rest by our infrastructure providers, every read and write is authorized on the server, and sign-in never involves an Aseef password. The full posture, including what we have not done yet, is published at aseef.app/security.
Aseef is not end-to-end encrypted. Our infrastructure can technically access space content, and staff access is limited by policy and access controls.
Your rights
Depending on where you live, you have the following rights over your personal data.
Under the GDPR (EU and UK users): access, rectification, erasure, restriction, portability, objection to processing based on legitimate interests, and withdrawal of consent at any time.
Under the Saudi PDPL: to be informed, to access your data, to obtain a copy in a readable format, to have it corrected, completed or updated, to have it destroyed when it is no longer needed, and to withdraw consent.
Many of these you can exercise yourself: Export any space from its menu, change your details in Settings, and delete your account in Account settings. For anything else, email hi@jehaad.com. We answer within 30 days and may need to verify your identity first.
If you are unhappy with our answer, you can complain to the Saudi Data and AI Authority (SDAIA), to the data protection authority of your EU country, or to the UK Information Commissioner's Office.
International transfers
Our providers process data in the United States and other countries. Transfers from the Kingdom of Saudi Arabia follow the PDPL and its regulation on transferring personal data outside the Kingdom. Transfers from the EU and the UK rely on the European Commission's Standard Contractual Clauses and the UK Addendum, or an adequacy decision where one exists.
If something goes wrong
If a personal data breach puts your rights at risk, we will notify the competent authority, including SDAIA and the relevant EU or UK authority where required, within 72 hours of becoming aware of it, and we will tell affected users without undue delay what happened and what they can do.
Children
You must be at least 13 years old to use Aseef, or older where your local law sets a higher age for consenting to data processing. If you believe a child has given us personal data, contact us and we will delete it.
Changes to this Policy
When we make a material change, we will tell you in the app before it takes effect. Every revision is dated and summarized at the end of this page.
Contact
Aseef, operator of Aseef, Kingdom of Saudi Arabia. Email: hi@jehaad.com.
Revision history
- Listed the Pro announcement list: what it keeps, why, on what basis, and for how long.
- Named Aseef as the controller and set out Saudi PDPL and GDPR rights.
- Added the data table, legal bases, cookies and local storage, and every subprocessor.
- Stated concrete retention periods and the breach notification commitment.
- Analytics now run only after you accept them.
- First published for the public beta.