Privacy Policy

1. Who we are

Qubit is a business data analytics platform operated from the Kingdom of Saudi Arabia. Businesses use Qubit to bring data from their existing systems into one place and analyze it.

This policy applies to qubit.sa and to the Qubit application. It describes how we handle personal data belonging to the people who use Qubit, and how we handle the business data our customers choose to connect.

We process personal data in accordance with the Personal Data Protection Law of the Kingdom of Saudi Arabia and its implementing regulations. Where our customers are subject to other data protection laws, we support them in meeting their obligations under those laws as well.

2. Information we collect

We collect three kinds of information.

• Account information you give us, such as your name, work email address, and the workspace you belong to. If you sign in through a third party such as Google, we receive your basic profile and email address from that provider.
• Connected data, which is the business data you instruct Qubit to load from systems you connect, such as databases, spreadsheets, CRM systems, and advertising accounts. This is your data, and you decide which sources to connect.
• Usage and technical data generated when you use the platform, such as pages visited, features used, approximate location derived from IP address, browser and device type, and error diagnostics.

3. How we use information

We use the information described above to:

• Provide the platform, including loading your connected data, running the analyses you request, and displaying the results.
• Authenticate you, secure your workspace, and keep an audit record of significant actions.
• Support you when you contact us, and diagnose faults.
• Improve reliability and performance, and develop features.
• Meet legal, accounting, and regulatory obligations.

We do not sell personal data, and we do not use your connected business data to serve advertising.

4. Google user data

If you connect a Google service to Qubit, you authorize us through Google’s own consent screen. We never receive or store your Google password.

When you connect Google Ads, we request read access to your advertising data. We use it to retrieve the accounts your login can reach, and then, for the account you select, your campaign, ad group, and ad structure together with performance metrics such as impressions, clicks, cost, and conversions.

We use Google Ads data to provide the reporting and analysis you request in your workspace. We do not create, edit, pause, or delete your campaigns. Google Ads uses the same OAuth permission for reading and managing advertising data, so its consent screen describes broader access than the reporting operations Qubit performs.

If you choose another Google connection, the data accessed depends on the service and source you select:

• Google Analytics: accessible property information and reports about traffic, acquisition, pages, events, and geographic and device dimensions.
• Google Sheets: spreadsheet metadata, worksheet names, and cell values from the spreadsheet URL you supply. Qubit does not request access to browse all your Drive files or edit your spreadsheet.
• Google Search Console: accessible website properties and search-performance reports, including queries, clicks, and impressions.
• BigQuery: accessible projects, datasets, table schemas, and query results from the dataset you select. Queries remain subject to your Google Cloud permissions.
• Google Cloud Storage: object listings and the contents of supported data files in the bucket and optional prefix you specify. Qubit does not upload, overwrite, or delete your source objects.

Qubit imports connected records into your workspace warehouse or queries the selected source to produce the analyses you request. Qubit uses Fireworks AI, a third-party model hosting and inference provider, to power AI features such as answers, summaries, reports, and visualizations. These features send relevant information to Fireworks AI for processing through its API; they do not operate exclusively through an in-house or offline language model.

Information sent for AI processing can include your question and conversation context, relevant table and column definitions, query results, and document passages needed for the feature. This can include connected Google user data, including individual records, aggregated results, and derived information. Workspace permissions limit which connected records a user can retrieve for analysis. External AI processing may take place outside Saudi Arabia; see International transfers below.

Fireworks AI publishes a zero data retention policy for standard open-model inference: prompt and generated content are not written to persistent storage by default, although request metadata such as token counts is retained and prompt caching may temporarily hold content in volatile memory. Retention differs for optional storage features: its Responses API stores conversations for 30 days by default unless storage is disabled. Zero retention at the inference provider does not mean Qubit deletes your imported data, saved conversations, reports, or audit records; see How long we keep it below. See Fireworks AI data handling and its Privacy Policy.

We use connected Google data for inference only: to provide the analysis and other user-facing features you request or configure. We do not use it to train or fine-tune models, and we do not authorize AI providers to use it for that purpose. This restriction covers raw, aggregated, anonymized, and derived Google user data. We do not use or transfer this data to create, train, or improve foundational, generalized, or non-personalized AI or machine-learning models, and we do not opt it into provider model-training programs.

Google authorization credentials are stored encrypted at rest and used to access your selected source and refresh authorization for on-demand or scheduled operations. Imported records are stored in your workspace data warehouse and made available according to workspace access permissions.

We share Google user data with service providers only as needed to deliver the user-facing features described in this policy, including infrastructure hosting and the Fireworks AI inference processing described above, subject to the Limited Use requirements. We do not sell it, use it for advertising or retargeting, or use it to assess credit-worthiness. Qubit personnel do not read it, except where you have specifically asked us to look at something, where it is necessary to investigate abuse or a security incident, or where the law requires it.

Qubit’s use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements.

You can revoke Qubit’s authorization through your Google Account’s connected apps. You can also remove a connection in Qubit. Revoking Google authorization prevents subsequent authorized retrieval; it does not by itself erase information already imported into Qubit. See the retention section for deletion and contact us at [email protected] to request removal of retained information.

5. How we share information

We do not sell your information. We share it only in these situations:

• With service providers who run parts of our infrastructure, such as cloud hosting, database and storage providers, error monitoring, and email delivery. They may process data only on our instructions and only to provide their service to us.
• With Fireworks AI to process the questions, context, and connected data needed for AI features, as described in Google user data above. The same inference-only and no-model-training commitments apply to other connected business data processed by these features.
• Within your workspace, where data you connect is visible to the members and administrators of that workspace, according to the permissions you set.
• Where the law requires it, or to establish, exercise, or defend legal claims.
• In connection with a merger, acquisition, or sale of assets, in which case we will give notice before your information becomes subject to a different policy.

6. How long we keep it

We keep account information and connected data while needed to provide your workspace services. Removing a connection deactivates its connection record and initiates cleanup of its synchronization pipeline and imported warehouse data. The connection record, including stored credentials, may remain in our database; removal is not an immediate erasure of every copy. Cleanup failures may require follow-up. Revoke access in your Google Account to invalidate the authorization separately.

Saved conversations, reports, and other workspace content may contain previously retrieved results and are not automatically erased by removing their source connection. Contact [email protected] to request deletion of retained connection information and derived content. We will confirm the scope of your request and explain any remaining retention, including applicable backups or legal and accounting obligations. The response process is described under Your rights and choices.

7. Security

Credentials for connected sources are encrypted at rest. Access to production systems is restricted to personnel who need it, and significant actions in the platform are recorded in an audit log. Optional two factor authentication is available, and workspace administrators can restrict access by IP address.

No system is completely secure, and we cannot guarantee absolute security. If we become aware of a breach affecting your personal data, we notify the competent authority within 72 hours of becoming aware of it, as the Personal Data Protection Law requires, and we notify you where the breach is likely to cause you harm.

8. Your rights and choices

You have the right to be informed of how your personal data is used, to access it, to request that it be corrected or destroyed, to withdraw consent you have given, and to receive a copy in a readable format. You can exercise these rights by contacting us at the address below.

We respond to requests within 30 days. Where a request is complex we may extend that by a further 30 days, and we will tell you if we do.

If you are in the Kingdom of Saudi Arabia and you are not satisfied with how we have handled your data or your request, you may complain to the Saudi Data and Artificial Intelligence Authority (SDAIA), which supervises the Personal Data Protection Law. If you are elsewhere, you may complain to your local data protection authority.

Where Qubit processes data on behalf of a customer, requests are directed to that customer as the party responsible for the data, and we assist them in responding.

9. International transfers

We and our service providers may process data in countries other than your own. Where personal data collected in the Kingdom of Saudi Arabia is transferred outside it, we do so only on the grounds permitted by the Personal Data Protection Law and its implementing regulations, and we transfer no more than the processing requires. In every case we take steps to ensure the data remains protected to a standard consistent with this policy.

10. Children

Qubit is a product for businesses and is not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, contact us and we will delete it.

11. Changes to this policy

We may update this policy as the product changes or the law requires. When we make a material change we will update the date at the top of this page and, where appropriate, notify you in the product or by email. Continuing to use Qubit after a change means you accept the updated policy.

12. Contact us

If you have a question about this policy or about how we handle your data, write to us at [email protected].