Effective Date 10 September 2026
Version 2.0
This Privacy Policy explains how ENFRAX SARL, Lebanon collects, uses, discloses, transfers, retains and protects personal data when you use the QUOTAH individual-user Service. ENFRAX is the controller of Account, transaction, usage, support and consent data. Contact us at info@quotah.io for privacy questions or requests.
For personal data contained in a project file, your organization or the project owner may be the controller and ENFRAX may process the data only to provide the Service. You are responsible for confirming that you may lawfully upload and process third-party personal data.
1 Scope
This Policy applies to www.quotah.io, related subdomains, the individual-user Account, file uploads, processing requests, Outputs, payments, support communications, security records and consent records. It does not govern a third-party site or service that has its own privacy notice.
2 Personal Data We Collect
| Category | Examples | Required or optional |
|---|---|---|
| Account and contact data | Name, email address, telephone number, country, language, Account identifiers, settings and authentication records. | Core Account details are required. Optional profile fields are identified when collected. |
| Transaction data | Plan, subscription, Credit balance, Order reference, invoice details, payment status, refund status, tax fields and limited payment identifiers. | Required for a paid transaction. Full card data is collected directly by the payment provider where applicable. |
| Project files and instructions | BOQs, BOMs, drawings, specifications, schedules, scans, images, notes, manual entries, processing instructions and extracted items. | Optional in the sense that you choose whether to use file processing, but required to perform the selected request. |
| Outputs | Project summaries, indicative cost ranges, classifications, RFQ drafts, spreadsheets, gap or conflict findings, assumptions and risk reports. | Created when you request the relevant processing. |
| Usage and technical data | Login and processing events, feature activity, browser, device, IP address, approximate location, session identifiers, error records, security events and cookies. | Security and core operational data are required; optional analytics and marketing data require the applicable choice or consent. |
| Support and complaint data | Messages, attachments, issue descriptions, responses, refund requests, complaint records and dispute evidence. | Required when you ask us to investigate or respond. |
| Consent and preference data | Accepted terms version, acceptance text, language, timestamp, Order reference, cookie choices, immediate-processing request and marketing preferences. | Required where necessary to record a contract or consent; optional preferences remain optional. |
Do not upload official identity documents, sensitive personal data, children's data, classified information or unrelated personal data unless it is strictly necessary, lawful and expressly permitted for the selected Service.
3 How We Collect Personal Data
- Directly from you when you register, enter information, upload files, request processing, buy a plan or Credit, contact support or make a privacy choice.
- Automatically from your use of QUOTAH through logs, security controls, cookies and similar technologies.
- From payment providers that confirm payment, refund, fraud-screening or transaction status without giving us the full card number.
- From a person or organization that lawfully authorizes your Account or provides project information for processing.
- From infrastructure, security, communications, analytics and support providers that help operate QUOTAH.
4 Why We Process Personal Data
| Purpose | Processing | Primary legal basis |
|---|---|---|
| Account operation | Register and authenticate users, maintain settings, communicate service notices and provide support. | Performance of our contract with you; legitimate interests in operating and securing the Service. |
| File processing | Upload, store, parse, extract, classify, translate, analyze and generate the Output you request. | Performance of our contract with you; your consent where a specific processing activity requires it. |
| Payments and Credit | Process transactions, allocate, reserve and deduct Credit, manage subscriptions, invoice, refund and prevent payment fraud. | Performance of our contract; legal obligations; legitimate interests in fraud prevention. |
| Security and misuse prevention | Detect unauthorized access, malware, fraud, scraping, Account compromise and policy violations. | Legal obligations and legitimate interests in protecting users, systems and legal rights. |
| Legal compliance | Maintain contract, tax, accounting, consent, complaint, security and dispute records and respond to lawful requests. | Legal obligation and establishment, exercise or defense of legal claims. |
| Service improvement | Diagnose errors and improve reliability, security, extraction and classification quality. | Legitimate interests assessed against your rights; consent where required. |
| Marketing | Send optional product or event communications. | Consent or another lawful basis expressly permitted in your jurisdiction. You may opt out at any time. |
Where we rely on consent, the consent is specific, recorded and capable of withdrawal. Withdrawal does not affect processing completed lawfully before withdrawal. Where we rely on legitimate interests, we limit the processing to what is necessary, do not use sensitive personal data for that basis and assess the impact on your rights.
5 AI Processing and Automated Functions
QUOTAH uses software rules, optical character recognition, extraction tools, classification systems, cost intelligence and AI models to process User Content and produce requested Outputs. Relevant file text, extracted information, prompts and limited technical identifiers may be sent to authorized AI or infrastructure providers only as needed for the requested function.
QUOTAH does not use confidential project files or personal data to train general public AI models without separate, explicit consent. Cross-customer learning or intelligence is used only after the information has been de-identified and the required permission has been obtained.
The individual-user Service does not make a decision that is legally binding on a supplier, contractor, employer, lender, insurer or government authority. Outputs remain preliminary and require human review.
6 Disclosure of Personal Data
We disclose personal data only to the extent necessary for the purposes described in this Policy. Recipients may include cloud and hosting providers, AI processing providers, payment providers, fraud-prevention and security providers, email or SMS providers, support tools, consent and analytics providers, professional advisers, auditors, courts, regulators and public authorities.
A service provider acting for ENFRAX must process data under contractual instructions or other lawful provider terms and apply appropriate confidentiality, security and data-protection controls. Payment providers, banks, card networks, regulators and some analytics or cookie providers may act as independent controllers for their own legal obligations.
We may disclose data as part of a lawful merger, financing, reorganization or transfer of the QUOTAH business, subject to confidentiality, applicable law and continued protection of your rights. We do not sell personal data.
7 Processing Locations and International Transfers
Primary platform hosting is located in Saudi Arabia. ENFRAX may conduct limited corporate administration and support from Lebanon. Approved providers supporting AI processing, payments, security, communications or technical operations may process limited data in Saudi Arabia, Lebanon, the European Economic Area, the United States or another disclosed service location where necessary to provide the Service.
When personal data is transferred outside Saudi Arabia or another protected jurisdiction, ENFRAX limits the transfer to necessary data and uses a lawful transfer mechanism. Depending on the transfer, this may include an adequacy decision, standard contractual clauses, a contract necessary to provide the requested service, explicit consent where valid, or another safeguard permitted by law. ENFRAX assesses transfer risks where required.
8 Retention and Deletion
We retain personal data only for the period described below or for a longer or shorter period required by an applicable law, legal hold, payment dispute or unresolved claim.
| Data | Standard retention period |
|---|---|
| Account and profile data | While the Account is active and for two years after closure, unless earlier deletion is required or a record must be retained for a legal claim. |
| Uploaded project files and Outputs | Until you delete them or close the Account. After a valid deletion request, active copies are deleted or de-identified within 30 days and residual backup copies within 90 days, unless a legal hold applies. |
| Payment invoice and tax records | Ten years after the relevant transaction, or the period required by applicable accounting and tax law if longer. |
| Contract consent and complaint records | Ten years after the later of the relevant transaction, resolution of the complaint or Account closure. |
| Routine security and technical logs | Twelve months. Records linked to fraud, abuse, a security incident or legal claim may be retained for up to five years after the matter is closed. |
| Marketing preferences | Until consent is withdrawn or the Account is closed, plus three years to retain evidence of the preference and opt-out. |
| Cookie data | For the period stated in the Cookie Notice and the live cookie settings panel. |
Deletion means secure removal from active systems or irreversible de-identification. Backup data is isolated from ordinary use and removed through the backup cycle. We may retain a minimal suppression record to respect an opt-out or prevent a deleted Account from being recreated fraudulently.
9 Security
ENFRAX applies proportionate technical and organizational measures designed to protect personal data and User Content. Measures include access control, encryption in transit and at rest where supported, environment separation, logging, backup, vulnerability management, incident response and service-provider review.
No online service can guarantee absolute security. You must protect your credentials and devices, review download recipients and notify info@quotah.io promptly if you suspect unauthorized access.
Where a personal-data breach is likely to harm your data or rights, ENFRAX will notify the competent authority and affected individuals within the time and manner required by applicable law.
10 Your Privacy Rights
Depending on the law that applies, you may request information about processing, access to personal data, a readable copy, correction, completion, updating, deletion or destruction, restriction, objection, portability, or withdrawal of consent. A right may be limited where a lawful exception applies or the request would adversely affect another person's rights.
Send a request from your registered email address to info@quotah.io and describe the right you wish to exercise. We may request proportionate information to verify identity and authority. We will respond without undue delay and, for requests governed by the Saudi Personal Data Protection Law, within 30 days. We may extend that period by no more than 30 additional days where permitted, after notifying you of the reason.
You may withdraw optional marketing or cookie consent through the available Account, unsubscribe or cookie controls. Withdrawal will be as easy as the method used to give consent where required by law.
11 Complaints
You may submit a privacy complaint to info@quotah.io. Include your Account email, a clear description of the concern, relevant dates and the remedy requested. We will investigate and respond through an appropriate channel.
You may also complain to the competent data-protection authority. Individuals protected by Saudi law may submit a complaint through the Saudi Data and Artificial Intelligence Authority's National Data Governance Platform at https://dgp.sdaia.gov.sa. Contacting us first does not remove a right to complain directly to an authority.
12 Children
QUOTAH is not intended for anyone under 18. We do not knowingly create individual-user Accounts for children. Do not upload children's personal data unless you have a lawful basis, the data is strictly necessary for an authorized project purpose and all required safeguards and permissions are in place.
13 Changes and Contact
We may update this Policy to reflect legal, technical or service changes. We will publish the current version and effective date and give additional notice or obtain consent where required for a material change.
Privacy questions, requests and notices may be sent to info@quotah.io.