Legal
Privacy policy
Draft · Being reviewed · Not yet in force
Last updated [date]
1. Who is responsible for your data
[Efforma legal entity name], commercial registration [CR number], [Registered address], Kingdom of Bahrain(“Efforma”, “we”), is the data manager (controller) for the personal data described here. We follow the Personal Data Protection Law of the Kingdom of Bahrain (Law No. 30 of 2018). If you are in the European Union or the United Kingdom, the GDPR also applies and gives you the same rights described below.
2. What we collect
- Account details: your name and email address, and your Google profile name and picture if you sign in with Google.
- Workspace content: the files you upload, the files Efforma makes, the roles you give layers, and the corrections you approve.
- Billing: your plan, billing country and payment status. Card details go to Paddle and never reach us.
- Usage and security: how many adapts you have used, sign-in times, IP address and browser, kept to run the service and protect accounts.
- Forms on the website: your email if you ask to hear about Take Zero or Brief, and the details you send in a partner application.
We do not collect sensitive personal data, and we do not need it to provide Efforma.
3. Why we use it, and on what basis
- To provide the service you signed up for and bill you: necessary to perform our contract with you.
- To keep the service and your account secure: our legitimate interest, and our legal obligations.
- To keep financial and tax records: our legal obligations.
- To tell you when Take Zero or Brief is ready: your consent, which you can withdraw at any time.
4. What we don’t do
- We do not train any model on your files, outputs or workspace content.
- We do not sell your data or share it for advertising.
- This website sets no tracking cookies. Our analytics are cookieless and count visits, not people.
5. Where it’s kept, and transfers outside Bahrain
Your files and account data are stored and processed in the European Union (Frankfurt, Germany). This is a transfer of personal data outside the Kingdom of Bahrain. We make it [on the basis that the destination provides an adequate level of protection, as recognised under the Personal Data Protection Law, and with your consent given when you create an account]. Our service providers are bound by contract to protect your data and use it only on our instructions.
6. Who processes it for us
| Service | What for | Where |
|---|---|---|
| Neon | Database | EU (Frankfurt, Germany) |
| Fly.io | Runs the app, and processes and stores files | EU (Frankfurt, Germany) |
| Cloudflare | Website, cookieless analytics, email forwarding | Global network; no files |
| Paddle | Payments, invoices and tax, as Merchant of Record | Under Paddle's own privacy policy |
| Resend | Sends account and receipt emails | EU sending region |
| Sentry | Error reports from the app: the page and the error, never file contents or personal details | EU (Frankfurt, Germany) |
| Sign-in, only if you choose Sign in with Google | Under Google's own privacy policy |
7. How long we keep it
- Uploaded files and results: as your workspace’s retention setting says (deleted an hour after you last work on them, after 24 hours, or after 30 days).
- Account details: while your account exists. Delete it from your account settings at any time.
- Deleted workspaces and accounts: removed from primary storage within the hour and from backups within 30 days.
- Billing records: as long as tax and accounting law requires.
8. How we protect it
Data is encrypted in transit and at rest. Passwords are stored only as secure hashes. Our team can open a file only when you ask us to investigate a specific problem, and that access is logged.
9. Your rights
Under the Personal Data Protection Law, and the GDPR where it applies, you can:
- ask whether we process your personal data, and get a copy of it;
- ask us to correct data that is wrong or incomplete;
- ask us to erase or block your data where the law allows;
- object to processing, including for direct marketing;
- withdraw consent you have given, without affecting what was done before.
Much of this you can do yourself in your account settings. For anything else, write to [email protected] from your account’s email address. We answer within 30 days. If you are not satisfied, you can complain to the Personal Data Protection Authority in the Kingdom of Bahrain, or to your local data protection authority.
10. Children
Efforma is not for anyone under 18, and we don’t knowingly collect their data.
11. Cookies
The app uses one essential cookie to keep you signed in and one to remember your current workspace. This website uses none.
12. Changes
If we change this policy in a way that matters, we will email you before it takes effect.
13. Contact
[Efforma legal entity name], [Registered address], Kingdom of Bahrain. Privacy questions and requests: [email protected].