Privacy Policy

Idari AI Inc (“Idari,” “we,” “us,” or “our”) provides an AI “chief of staff” assistant that helps executives and their teams manage meetings, communications, scheduling, documents, and day‑to‑day work across channels such as WhatsApp, Telegram, Slack, and our web dashboard (the “Service”).

This Privacy Policy explains what personal data we collect, how and why we use it, who we share it with, where it is processed, how long we keep it, and the rights you have. It is written to comply with the Kingdom of Saudi Arabia’s Personal Data Protection Law (PDPL) and its implementing regulations, and is aligned with the EU/UK General Data Protection Regulation (GDPR).

Please read this together with our Subprocessor List, which names the third‑party providers that help us run the Service.

1. Who we are, and our role in your data

Idari AI Inc is a company incorporated in the United States (State of Wyoming).

The Service is a business product. Depending on the situation, we act in one of two roles:

• We are the “controller” (we decide why and how data is processed) for: visitors to our website; the account, identity, and billing data used to create and secure an Idari account; the people who contact us directly; and our own operational, security, and diagnostic records.
• We are a “processor” (we process data on another party’s behalf and instructions) for the content you and your organization put into the Service — your messages, voice notes, documents, emails, calendar entries, meeting transcripts, contacts, and the things you ask the assistant to remember (“Customer Content”). In this case, the organization that provides you access — your employer or the client account you belong to — is the controller of that Customer Content.
• If you subscribe to the self‑serve Chief of Staff plan as an individual, no organization stands between us: we are the controller of your Customer Content too, and you exercise your rights (Section 10) directly with us.

If you use Idari through an organization, that organization’s own privacy policy governs how it decides to use the Customer Content, and you should review it. This Policy still tells you how we handle data and explains the practices for which we are the controller. Where we act only as a processor, we will refer data‑subject requests to the relevant organization (see Section 10).

2. Who this Policy applies to

• Website visitors — people who browse our public website.
• Account users — executives, chiefs of staff, assistants, and other staff who sign in to and use the Service.
• Third parties whose data enters the Service — for example, the contacts, email correspondents, and meeting attendees referenced in your communications, and people who respond to a scheduling poll you send.

3. The personal data we collect

The “Source” column shows where data comes from; “Our role” shows whether we act as controller or processor. If you subscribe as an individual (Section 1), we are the controller for the rows marked “Processor” as well.

Idari offers two optional assistant features — a Health lens and a Prayer lens — that, only if you switch them on, process special‑category data. The Prayer lens stores your prayer‑observance preferences (for example, protecting salah windows, or Ramadan mode). The Health lens stores your health and recovery preferences and, for each health‑tracking purpose you also agree to, the data listed in the “Health tracking” row above. The assistant may notice from your messages that a lens could help and offer it once — a lightweight keyword check; we record only the offer and your yes/no. Only after your explicit opt‑in, which we record, is any such data stored and used — and only to provide that feature: health‑ and prayer‑aware schedules and briefings, and, for health tracking, keeping your log and showing it back to you over time. Each health‑tracking purpose needs its own yes: the assistant is given fixed wording to ask with, and only an answer you give in a later message counts. Nutrition, readings, medication and health admin also ask you to confirm that you are 18 or over. Health tracking is a wellness tool: it is not designed to diagnose, treat or monitor any disease or condition, or to give medication doses. No dashboard or assistant view in the Service shows your health log to anyone else. Like the rest of your Customer Content it is processed by our AI provider (Section 4) under the safeguards described in Section 7; it is never used for any other purpose or to train AI models, and it is not shared with anyone else except as Section 6 describes for all Customer Content (for example, the messaging channel you use). We do not collect biometric data that identifies you (such as face or fingerprint data), and health tracking does not connect to wearable devices.

Turning it off. You can turn either lens off at any time by telling the assistant, and, while health tracking is available to you, stop a single health‑tracking purpose the same way. Turning the Health lens off stops the processing and erases your health preferences, your health profile, the conditions you told us about and your whole health log; stopping one purpose erases that purpose’s log entries. It does not reach the places where the same information also exists because you said it in conversation: your message history, conversation summaries and facts the assistant noted about you from a conversation (kept as described in Section 8, until you delete your account), a reminder you set, a problem report you choose to send us, which includes the messages it concerns (Section 5), short‑lived technical records of the conversation (up to 7 days after it was last active), and diagnostic telemetry (Section 8). Our security audit log keeps a record of which health purposes you switched on and off, and of when you used health features — never the values you logged.

Beyond those two opt‑in lenses, we do not intentionally collect special‑category/sensitive data as a designed feature. However, because the assistant processes your free‑form communications and documents, such information may appear in Customer Content if you choose to include it. Please avoid sending sensitive data unless necessary, and note that you are responsible for ensuring you have a lawful basis to do so.

Idari’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use Google user data only to provide and improve user‑facing features of the Service. We do not sell it, use it for advertising, or use it to develop, improve, or train generalized AI or machine‑learning models. We do not let humans read it unless you first agree to let us view specific data, it is necessary for security purposes (such as investigating a bug or abuse), it is necessary to comply with law, or it is aggregated and used for internal operations.

4. How the AI assistant works with your data

• AI processing. To answer you and carry out tasks, your messages and relevant context are sent to large language models hosted on Microsoft Azure OpenAI. Your Customer Content is stored in the UAE North region; for the main conversational models, Microsoft may process the request in other Microsoft Azure data‑center regions worldwide under its global capacity routing (data in transit and processing only — nothing is stored outside UAE North). Embedding and voice‑transcription models are processed in‑region. These transfers are covered by our data‑processing agreement with Microsoft and the applicable Standard Contractual Clauses (see Section 7). Voice notes are transcribed with a speech‑to‑text model, and spoken replies are generated with a text‑to‑speech service.
• Health content. If you use health tracking (Section 3), what you tell the assistant about your health, and the entries it reads back from your health log to answer you, are sent to Microsoft Azure OpenAI like the rest of your Customer Content and on the same terms: stored in UAE North, while the main conversational models may process the request in other Microsoft regions, as described above. Averages and trends in a health summary are calculated by our own code, not by the AI model. Our diagnostic telemetry records that a health feature was used, never the values you logged.
• No training on your data. We do not use your Customer Content to train AI models, and the AI providers we rely on do not use it to train theirs — this covers both Microsoft Azure OpenAI, which generates the assistant’s replies, and Anthropic, whose tooling our engineers use when investigating a support issue (see the Subprocessor List). Your data is used to serve your request, not to improve anyone’s model.
• Memory. To maintain continuity, the assistant keeps a short rolling window of recent messages and may store concise summaries of past conversations so it can recall relevant context later. You can ask it to forget specific notes.
• A human stays in control of consequential actions. The assistant proposes outbound actions — such as sending an email, creating a calendar invite for others, or posting a message — and these require your explicit approval before they happen, unless you have switched on an auto‑approval rule for that kind of routine action. We do not make decisions producing legal or similarly significant effects about you through solely automated means without human involvement.
• Isolated code execution. When the assistant runs analysis (for example, on a spreadsheet you provide), it does so in an isolated sandbox with no outbound network access.
• Reminder phone calls. If you switch on reminder calls, we first verify the number with an automated call that reads out a one‑time code, then place reminder calls to it through a telephony provider (Twilio) and read out the reminder text you set. The number and the spoken text are shared with that provider only to place the calls. If someone presses the opt‑out key during a call, we keep that number on a do‑not‑call list, even after an account is deleted, so it is not called again.
• Web and document tools. When you ask the assistant to search the web or open a link, your query or the URL is sent to a search/extraction provider (see Section 6). When it reads a document, the text is extracted to answer you.
• Email attachments. When you ask the assistant to read or summarize a file attached to an email, it fetches that attachment from your connected mailbox, extracts its text — and, for scanned or image‑based files, generates a visual reading (OCR) — and sends that content to our AI provider (Microsoft Azure OpenAI) so it can answer you. Attachments are read only when you ask; the assistant does not open them on its own. The attachment’s content is processed transiently to answer your request and is not stored — we keep no copy of it. Reading attachments uses the mailbox access you already granted when you connected your account; no additional permission is requested.

5. Why we use your data, and our legal bases

Where we rely on consent (for example, linking your Google account), you may withdraw it at any time without affecting processing already carried out. For the optional Health and Prayer lenses and for each health‑tracking purpose (Section 3), our basis is your explicit consent, given separately for each purpose; we do not rely on legitimate interests for any of them, and you can withdraw consent for any purpose at any time by telling the assistant. We do not sell your personal data, and we do not use it for advertising or for training AI models.

6. When and with whom we share data

We share personal data only as described here, and we require our providers to protect it under written agreements consistent with this Policy and applicable law.

• Service providers (subprocessors). We use trusted third parties to host and operate the Service — cloud hosting and AI processing, database and file storage, messaging delivery, speech processing, web search, and meeting transcription. The principal ones are Microsoft Azure, Google, Anthropic (AI‑assisted engineering and support tooling), Meta or Twilio (WhatsApp), Twilio (reminder phone calls), Telegram, Slack, Recall.ai and Speechmatics (meeting recording and transcription), Serper and Jina AI (web search and page reading), Supadata (video transcripts), Linear (product feedback), and Stripe (payments for the self‑serve plan). Our public website’s contact form is processed by Web3Forms. A complete, current list with locations and purposes is in our Subprocessor List.
• Services you choose to connect. If you link an account such as Google Workspace — or other optional integrations like Asana, Jira, Notion, or Microsoft 365 — we exchange data with that service at your direction.
• Public information sources. For features like prayer times, weather, maps and directions, flight status and flight search, sports scores, market prices, and Qur’anic text, we send only a location, place name, or query (no account identifiers) to public information APIs such as Google Maps, Aladhan, Open‑Meteo (our weather provider at present), and SerpApi; OpenWeather would be used for weather instead only if we configure it. The full list is in the Subprocessor List.
• Your organization. Where you use Idari through an organization, administrators of that organization may access Customer Content and account activity associated with their account.
• Legal, safety, and protection of rights. We may disclose data where required by law or valid legal process, or to protect the rights, property, or safety of Idari, our users, or others.
• Business transfers. In a merger, acquisition, financing, or sale of assets, personal data may be transferred as part of that transaction; we will require the recipient to honor this Policy or notify you of any material change.

We do not share your personal data with third parties for their own marketing.

7. International data transfers

Idari operates across borders, so your personal data may be processed in, transferred to, and accessed from countries other than your own:

• Storage of Customer Content takes place on Microsoft Azure in the UAE North region (United Arab Emirates). Some AI‑model processing (generating replies) may be performed by Microsoft Azure OpenAI in other Microsoft regions worldwide, as described in Section 4; these transfers are covered by our data‑processing agreement with Microsoft and the applicable Standard Contractual Clauses. We are working to bring all AI processing into the region.
• We are incorporated in the United States, and our personnel may access data from the United States and Saudi Arabia to operate and support the Service. Such access is limited to what is needed for the purpose (see “Support and incident resolution” in Section 5).
• Certain subprocessors operate in other countries, including the United States (e.g. Google, Microsoft, Anthropic, Twilio, Meta, Slack, Serper, Stripe) and Europe (e.g. Recall.ai, Speechmatics, Jina AI), as detailed in the Subprocessor List.

When we transfer personal data across borders, we rely on appropriate safeguards, which may include written data‑processing agreements with each provider; the EU/UK Standard Contractual Clauses (or equivalent) where the GDPR applies; the cross‑border transfer mechanisms permitted under the PDPL (including appropriate safeguards, necessity to perform a service you requested, or your consent); and each provider’s own contractual and security commitments. Contact privacy@idari.ai for more information.

8. How long we keep your data

We keep personal data for as long as it is needed to provide the Service to you and your organization, and as required for security, legal, accounting, and dispute‑resolution purposes. In practice:

• Account and identity data is retained while your account is active.
• Customer Content (messages, transcripts, documents, meeting data, memory) is retained for the life of the account so the assistant can serve you, unless you or your organization delete it or ask us to.
• Health and prayer lens preferences are kept only while the lens is switched on — turning it off erases them. Your health log is kept until you stop the purpose it belongs to, turn the Health lens off, or delete your account — each of these erases it. What you said about your health in conversation follows the Customer Content rule above, not this one (Section 3).
• Uploaded files and chat images have shorter retention periods (currently 90 days for ingested files and 30 days for chat images, by default) and are erased after that period, normally within 30 days.
• Do‑not‑call numbers (Section 4) are kept indefinitely so they are never called again.
• Meeting recordings at our recording provider: audio and video are not stored; the transcript text is held by the provider for at most 1 hour after the meeting ends and is normally deleted as soon as we have retrieved it (Section 12).
• Email attachments read on request are not stored: their content is processed transiently to answer you and then discarded, so no retention period applies.
• Security and audit records are retained as needed to maintain a reliable, tamper‑evident record of actions for security and accountability.
• Diagnostic telemetry (content‑free events, identifiers, and error data) is retained for a limited period (currently around 90 days).
• Billing records are kept for as long as tax and accounting law requires after your subscription ends.

When personal data is no longer needed, we delete or anonymize it. You can request deletion as described in Section 10. When you ask us to delete your account, sign‑in is blocked immediately. After a 14‑day grace period, during which you can cancel the request, we permanently erase your account and Customer Content, normally within 30 days of your request. We keep the security and audit records of actions taken in your account (which can include excerpts of messages) for as long as they are needed for security and accountability, and billing records for as long as tax and accounting law requires. Where we act as a processor, deletion of Customer Content is directed by your organization, and we will delete or return it in line with our agreement with them.

9. How we protect your data

• Tenant isolation. Each customer’s data is logically segregated and protected by database row‑level security, enforced so that one customer cannot access another’s data.
• Encryption. Data is encrypted in transit (TLS 1.2+) and at rest. Sensitive credentials, such as the tokens for connected accounts, receive additional application‑level encryption (AES‑256‑GCM).
• Secrets management. Keys and credentials are held in a managed secrets vault, not in code.
• Access controls and approvals. Outbound actions require explicit human approval unless you have switched on an auto‑approval rule for that kind of action, and all assistant actions are recorded in an immutable audit log.
• Network protections. We validate and restrict outbound requests to defend against server‑side request forgery, and we run untrusted code in an isolated sandbox with no network egress.
• Channel verification. Incoming messages from each channel are cryptographically verified before they are processed.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. To protect your account, we recommend enabling multi‑factor authentication on the Google (or Microsoft) account you use to sign in. If we become aware of a personal‑data breach affecting you, we will notify you and the relevant regulator as required by applicable law.

10. Your rights and how to exercise them

Subject to applicable law, you have the right to: be informed about how your data is processed; access the personal data we hold about you; correct inaccurate or incomplete data; delete your data (right to be forgotten/destruction); restrict or object to certain processing; port your data, where applicable; and withdraw consent at any time where processing is based on consent.

To exercise any of these, email privacy@idari.ai. We may need to verify your identity before responding. We will respond within the timeframe required by law (generally within 30 days), and we will tell you if we need an extension. Exercising your rights is normally free of charge.

If your data is Customer Content controlled by an organization, we will refer your request to that organization or act on their instructions, because they control that data. Please also contact your organization directly.

Complaints. If you are in the Kingdom of Saudi Arabia, you may lodge a complaint with the Saudi Data & AI Authority (SDAIA), the supervisory authority for the PDPL. If you are in the EU/UK, you may complain to your local data‑protection authority. We would, however, appreciate the chance to address your concern first.

11. Cookies and similar technologies

Our web dashboard uses a single essential cookie to keep you signed in and maintain your session. This cookie is necessary for the Service to function and cannot be switched off through the Service. We do not use advertising cookies or third‑party advertising trackers, and we do not sell data collected via cookies.

Our public website loads web fonts from Google Fonts (which means your browser requests files from Google and Google may receive your IP address), and the contact form is submitted to Web3Forms. The website runs no advertising trackers. Our hosting provider, Cloudflare, adds a lightweight, cookieless web‑analytics script (Cloudflare Web Analytics) that measures page loads without fingerprinting you or tracking you across sites. If you subscribe to the self‑serve plan, checkout and billing pages are hosted by Stripe, which sets its own cookies for fraud prevention under its privacy policy. We use server‑side diagnostics (Microsoft Application Insights) to monitor reliability and detect errors; this is not cookie‑based advertising tracking.

When you interact with Idari through WhatsApp, Telegram, or Slack, or sign in with Google, those platforms operate under their own privacy policies and may set their own cookies or process your data independently of us.

12. Voice, recordings, and messaging channels

• Voice notes you send are transcribed so the assistant can act on them.
• Meeting recording and transcription happen only when a recording is initiated through the Service, using our recording provider (Recall.ai, EU — Frankfurt) and transcription provider (Speechmatics, Europe — EU1 region). What the recording provider keeps, and for how long: meeting audio and video are never stored by the recording provider — audio is processed live, solely to produce the transcript. The transcript text and participant names are held on the recording provider’s servers only until we have retrieved them; we then delete them from the provider immediately, and the provider is configured to delete them automatically no later than 1 hour after the meeting ends in every case. Once deleted, the provider retains no backups or archives. The transcript itself then lives in your account as Customer Content (Section 8). The Idari Scribe’s name: the Idari Scribe joins each call under your name, so participants know whose assistant is recording — your first name (with your family initial or family name when someone else in the call shares your first name), and your display name in the recording notice it posts in the meeting chat; the recording provider receives the same name. You can replace the name with your own label in Settings → Profile → Idari Scribe (or Settings → Idari Scribe → Its name in the call, where that tab is shown); the label always ends in “Idari Scribe”, links and web addresses are not accepted, and the name is never an email address or the part of one before the “@”. When the Idari Scribe joins a meeting from a link and does not see you join within 3 minutes, it leaves; we discard anything captured, and the provider’s copy is deleted under the same 1‑hour limit. You are responsible for ensuring that all participants are informed and that any consent required by the laws applicable to your meeting and its participants is obtained before recording.
• Messaging channels. WhatsApp (via Meta or Twilio), Telegram, and Slack each process the messages exchanged through them under their own terms and privacy policies, in addition to ours.

13. Children’s data

The Service is intended for use by businesses and professionals and is not directed to individuals under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us personal data, please contact privacy@idari.ai and we will take appropriate steps to delete it.

14. Personal data about other people

When you provide or reference personal data about other people — such as your contacts, email correspondents, meeting attendees, or scheduling‑poll respondents — you confirm that you are authorized to share that data with us and that we may process it to provide the Service as described in this Policy. If you send a scheduling poll, the people who respond should be made aware that their name, email, and availability are collected to arrange the meeting.

15. Changes to this Policy

We may update this Policy from time to time. When we do, we will revise the “Last updated” date above and post the new version on our website. If the changes are material, we will provide additional notice (for example, by email or an in‑Service notice) where required by law. Your continued use of the Service after an update takes effect means you acknowledge the revised Policy.

16. How to contact us

For any privacy question, request, or complaint:

If we have appointed a Data Protection Officer or a representative for a particular region, their contact details will be published here.