Legal
Privacy policy
Draft for legal review — not yet in force.
This draft describes how thexsys processes personal data across the workspace, the partner portal and the API. It is written for thexsys as a Qatar-based company and is being prepared for review against Qatar’s Personal Data Privacy Protection Law (PDPPL) before it takes effect.
Data we process
Account data for workspace users, partner users and platform staff (name, email, phone, role); tenant business data entered into apps (customers, invoices, employees, and similar records your company controls); usage and security data (sign-ins, device sessions, API calls, audit events); and, where you enable them, AI feature inputs and outputs.
Purposes
Providing and securing the service you signed up for; billing; support you request; security monitoring and fraud prevention; product improvement in aggregate; and, only where a tenant opts in, AI features that process the data needed to answer the request.
Sub-processors
A current list of sub-processors (infrastructure, email delivery, payments, AI providers) with their purpose and location will be published here; the vendor inventory this page summarises is maintained internally today at docs/security/vendor-management-policy.md.
Retention
Tenant business data is kept for the life of the subscription and a defined period after closure, per the retention schedule; security and audit events are kept longer for compliance; nothing that belongs to a tenant, a partner or their customers is deleted by a development action — only by an explicit, tenant-initiated request or a documented retention rule.
Your rights and how to ask
Depending on the applicable law, you may have the right to access, correct, export or request deletion of your personal data. Tenant business data is controlled by the tenant company; individuals should start with their workspace administrator. For platform-level requests, email privacy@thexsys.com.
Cookies
The marketing site and workspace use strictly necessary cookies (session, locale, theme) and, where enabled, privacy-respecting analytics. No third-party advertising cookies are used.