Privacy Policy

01Who we are and what this covers

Iktinah is a service operated by Amayx, a business established in Saudi Arabia. Amayx is responsible for personal data processed through iktinah.com, Iktinah accounts, hosted sync, support, and billing. Contact [email protected].

This policy does not cover research data kept only in Zotero or on your device, an AI provider you contact directly with your own key, or third-party sites. Those parties apply their own terms and privacy notices.

02Personal data we collect

• Account: name, email, verified status, password hash, profile image, connected Google or ORCID identifier, and account status.
• Service and Community content: workspaces, collaboration posts and applications, profile fields and visibility choices, research identifiers, affiliations, comments, reactions, reports, encrypted message control records, Agent Skill packages and review findings, synced research content, encrypted settings-vault payloads, files you choose to upload, sharing settings, and device identifiers. Device-local caches are not synced. When you use settings-vault synchronization, supported provider credentials can be included in its client-encrypted payload.
• Participant-call verification: ethics approval or exemption evidence supplied by a publisher. This evidence is private to authorised moderators, malware-scanned, and never displayed in the public call. Iktinah does not collect participant consent, screening answers, or study health data through Community.
• Operations and security: IP address, user agent, session and device records, timestamps, audit events, error and abuse signals, and service-usage totals.
• Billing: contact and billing details, plan and transaction records, tokenized payment references, masked card details, receipts, refunds, and tax evidence. Iktinah does not store full card numbers or card security codes.
• Support: your contact details, request content, attachments you choose to provide, and our response history.

We receive data from you, your device, collaborators who invite you, authentication providers you select, and payment or infrastructure providers used to deliver the service.

03Why and on what basis we use data

Under Saudi Arabia's Personal Data Protection Law (PDPL), we process data only for specified purposes and with an applicable legal basis. For people covered by the GDPR or UK GDPR, the bases above apply. We do not sell personal data or use it for cross-context behavioural advertising.

04Research content and AI providers

The open-source Zotero plugin can work locally. When you enable cloud features, only content you direct the service to sync or upload is sent to Iktinah. General Personal and Team cloud content is not end-to-end encrypted: the hosted service can read and process it to provide synchronization and collaboration. Encryption in transit protects data while moving. The encrypted settings vault remains client-side encrypted. Team, direct, and community messages are encrypted in transit and at rest under service-managed keys so every signed-in member device of the conversation can read them.

When you configure your own AI provider, the plugin sends selected content directly to that provider under your account and that provider's policy. If you synchronize provider settings through the settings vault, a client-encrypted copy of supported provider credentials can be stored by Iktinah for your paired devices. Managed AI is not included in this release; paid cloud-sync plans do not include AI-provider usage.

We do not use private workspace content to train general-purpose AI models.

05Service providers and disclosure

We disclose the minimum necessary data to processors that operate the service: hosting and database infrastructure in Germany; Cloudflare for network delivery and security; Resend and its delivery partners for transactional email; Tap Payments for payment processing; and Google or ORCID only when you choose those sign-in methods. Providers may change when needed; material changes will be reflected here.

We may also disclose data when required by law, to protect users and the service, in a corporate reorganisation subject to equivalent safeguards, or at your direction. We do not permit processors to use service data for their independent advertising.

06Where data is processed

Iktinah serves users internationally. Data may therefore be processed in Saudi Arabia, Germany, the United States, or another country where a listed provider operates. Where Saudi, EEA, or UK rules restrict an international transfer, Amayx uses an authorised transfer mechanism and supplementary safeguards as required, such as contractual clauses and access controls.

You may ask for information about the safeguard relevant to your data by emailing the privacy address above.

07Retention and deletion

• Account and active workspace data: while the account is active.
• Deleted workspace data: removed from active systems promptly and from rolling backups as those backups expire, ordinarily within 90 days.
• Security, access, and audit logs: ordinarily up to 12 months, longer when needed to investigate an incident or legal claim.
• Support records: ordinarily 24 months after closure.
• Billing, invoice, refund, and tax records: for the period required by Saudi accounting, tax, anti-fraud, and dispute laws, even after account deletion.

We may retain a limited record longer when law requires it, a dispute is active, or deletion would compromise security. We then restrict use to that reason.

08Your privacy rights

Depending on where you live, you may ask to be informed about processing; access or receive a copy of data; correct it; have it deleted or destroyed; restrict or object to processing; withdraw consent; receive portable data; or challenge certain automated decisions. We do not currently make decisions with legal or similarly significant effects solely by automated processing.

Send a request from your account email to [email protected]. We may verify identity and authority before acting. We aim to respond to PDPL requests within 30 days and may extend once by up to 30 further days where permitted and necessary. GDPR and UK GDPR requests are handled within the applicable statutory period.

You may complain to the Saudi Data & AI Authority (SDAIA), or to the data-protection authority where you live if EU or UK law applies. Contacting us first gives us an opportunity to resolve the concern but does not limit that right.

09Security and incidents

We use access controls, encrypted transport, credential hashing, tokenisation of payment data, environment-separated secrets, audit logging, backups, and least-privilege operational practices. No online service can guarantee absolute security. Keep credentials confidential and report suspected compromise to [email protected].

We investigate personal-data incidents and notify affected people and regulators when applicable law requires it.

10Age limit, changes, and contact

Iktinah accounts are for people aged 18 or older. We do not knowingly create accounts for children. Contact us if you believe a child supplied personal data.

We may update this policy as the service or law changes. We will post the new version and effective date and, for a material change, provide an appropriate in-service or email notice before it takes effect where practicable.

Privacy: [email protected]. General support: [email protected]. Operator information: Legal information.