Privacy Policy

FileFlow is a product owned and operated by KERN Technical Solutions (CR: 7055103423), a Saudi technology company based in Riyadh, and is accessible at fileflow.sa. We are committed to protecting your privacy in compliance with the Personal Data Protection Law (PDPL) of the Kingdom of Saudi Arabia (Royal Decree M/19, dated 9/2/1443H) and its implementing regulations. This Privacy Policy explains how we collect, use, store, and protect your personal data when you use our file management platform. In this policy, "we", "us" and "our" refer to KERN Technical Solutions, the data controller for FileFlow.

We collect information you provide directly, including your name, email address, and profile details when you create an account. We also collect data you store within the platform, such as project names, file codes, file metadata, uploaded documents, and documents you email to your filing address. When you connect another KERN app to a workspace, we record that connection: which app, which workspace, who approved it, what it may do, and what it has filed. When you subscribe to a paid plan, payment information is processed securely by our payment provider Moyasar — we do not store your full card details. We automatically collect technical data including browser type, device information, IP address, access times, and interaction patterns to operate and improve our services.

Under the PDPL, we process your personal data based on the following legal grounds: (a) Contract performance — processing necessary to provide the FileFlow service you signed up for, including account management, data storage, and feature delivery; (b) Consent — where you have given explicit consent, such as enabling Google OAuth sign-in or subscribing to service notifications; (c) Legitimate interest — for service security, fraud prevention, and service improvement, where such interests do not override your fundamental rights; (d) Legal obligation — where processing is required to comply with Saudi Arabian laws and regulations, including tax and commercial registration requirements.

We use your information to provide, maintain, and improve the FileFlow platform; authenticate your identity and secure your account; enable features such as file sharing, connections, team collaboration, and KERN apps you choose to connect; suggest where a document belongs and draft a folder structure when you ask for it; send service-related notifications; process payments and manage subscriptions; and comply with legal obligations.

Your data is stored using Supabase infrastructure with PostgreSQL databases. Supabase servers are hosted outside the Kingdom of Saudi Arabia. By using FileFlow, you consent to the transfer and processing of your data outside the Kingdom, in accordance with Article 29 of the PDPL. We ensure that adequate safeguards are in place, including encryption and contractual protections with our service providers. Sensitive file details and documents are encrypted using AES-256 encryption before storage. All data transmission is protected via TLS/SSL. Row-level security (RLS) policies ensure that each person can reach only their own data, the data of organizations they belong to (according to their role), and what others have shared with them. Text recognition (OCR) runs in your browser; the page is not sent anywhere for it. Two-factor authentication (2FA) is available for additional account security.

We use the following third-party services to operate FileFlow: Supabase (authentication, database, and file storage); Google (optional sign-in); Moyasar (payment processing for subscriptions and add-ons); Resend (sending email, and receiving documents emailed to your filing address); Cloudflare (content delivery and DNS); OpenAI (smart upload and folder-structure suggestions: when you use them, it receives the document's file name and recognized text, the names of your folders, the page image for image-based suggestions, and the description you type for a suggested structure). Each service processes data only as necessary to perform its function, and OpenAI does not use this data to train its models under its business terms. These providers have their own privacy policies, and we encourage you to review them. KERN apps you connect, such as Aqarly, receive only what you approve on the connection screen, and you can disconnect them at any time from Settings → Connected apps. We do not sell, trade, or rent your personal information to any third party.

FileFlow does not use traditional browser cookies for tracking or advertising. We use browser local storage to maintain your authentication session, store your theme and language preferences, and cache temporary data for performance. No third-party tracking cookies or analytics scripts are used. You can clear local storage through your browser settings, though this will sign you out and reset your preferences.

Under the PDPL, you have the right to: be informed about how your data is collected and used; access your personal data held by us; request correction of inaccurate data; request deletion of your data; request restriction of processing in certain circumstances; obtain a copy of your data in a portable format through the export feature; withdraw consent for optional processing (such as OAuth access) at any time; and lodge a complaint with the Saudi Data and Artificial Intelligence Authority (SDAIA) if you believe your data rights have been violated. You can exercise most of these rights directly through your account settings. For requests that cannot be handled through the platform, contact us at support@kern.sa.

Account data (profile, settings) is retained for as long as your account is active. Filing hierarchy data (projects, subjects, files) and uploaded documents are retained until you delete them or delete your account. Deleted items are moved to trash and auto-purged after 5 days. Upon account deletion, all associated data including projects, files, documents, encryption keys, tags, and settings is permanently removed within 30 days. Payment records are retained for 7 years as required by Saudi commercial and tax regulations. Anonymized, aggregated usage statistics may be retained indefinitely for service improvement.

FileFlow is not intended for use by individuals under the age of 18. We do not knowingly collect personal data from minors. If you are under 18, you may only use FileFlow with the involvement and consent of a parent or legal guardian. If we become aware that we have collected data from a minor without proper consent, we will take steps to delete that information promptly. If you believe a minor has provided us with personal data without consent, please contact us at support@kern.sa.

In the event of a personal data breach that is likely to cause harm to data subjects, we will notify the Saudi Data and Artificial Intelligence Authority (SDAIA) within 72 hours of becoming aware of the breach, as required by the PDPL. Affected users will be notified without undue delay through their registered email address, with details of the breach, its potential impact, and the measures taken to address it.

If you have questions about this Privacy Policy, wish to exercise your data rights, or have concerns about our data practices, please contact us: Email: support@kern.sa — Website: fileflow.sa — Data controller: KERN Technical Solutions (CR: 7055103423), Riyadh, Kingdom of Saudi Arabia. For complaints regarding data protection, you may also contact the Saudi Data and Artificial Intelligence Authority (SDAIA).

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the updated policy on this page and updating the "Last updated" date. Your continued use of FileFlow after changes constitutes acceptance of the updated policy.