Privacy policy
- Who is responsible
- What we collect
- Why, and on what basis
- Who receives your data
- Where it is processed
- How long we keep it
- Your rights
- Security
- Automated processing and AI
- Children
- Cookies and local storage
- Changes and contact
1Who is responsible
[not yet set — SUHAIL_LEGAL_ENTITY] is the controller of the personal data described here and can be reached at [not yet set — SUHAIL_LEGAL_CONTACT]. This policy covers Suhail at this address and any app installed from it. A plain description of what leaves our server and what stays, generated from our live configuration, is at /data; where this policy and that page ever differ, tell us.
2What we collect
| What | Where it comes from |
|---|---|
| Your email address and password (hashed), or your Google account identifier and verified email if you sign in with Google; your language and region settings | You, when you create and use your account |
| The tasks you write, any notes you add during a run, and any files or images you attach | You |
| Everything Suhail sees while working: a screenshot of every page it opens, that page's text and structure, its address and title, and what Suhail did on it. These pages may contain personal data about you and about other people — names, bookings, balances, messages — because they are your own accounts. | The websites Suhail operates on your behalf |
| Passwords and other secrets you choose to store | You, into an encrypted vault |
| Cookies and sign-in state for websites Suhail has signed into for you | Those websites, kept in a browser profile on our server so you need not sign in every time |
| Documents, spreadsheets and other files Suhail produces for you | Suhail |
| Your credit balance, top-ups, and what each run cost; the last four digits and expiry of a saved card and a Stripe customer identifier. We never hold your full card number — you enter it on Stripe's page, not ours. | You, and Stripe |
| Voice notes, if you use the microphone | You, transcribed and then processed as a task |
| A push-notification subscription for each device you turn notifications on | Your browser |
| Technical logs: request times, errors, the IP address a request came from | Your device |
3Why, and on what basis
- To provide Suhail — running your tasks, keeping your history so you can replay a run, holding your credentials so it can sign in, billing you. This is performance of our contract with you.
- To keep Suhail safe — detecting abuse, securing accounts, keeping the record of what was done in your name. This is our legitimate interest and, for the record of approvals, our legal obligation.
- With your consent — sending your data to model providers outside the GCC (§5), notifications to your phone, and voice transcription. You give this consent when you create an account or turn the feature on, and you can withdraw it (§7).
We do not sell personal data, use it for advertising, or profile you.
4Who receives your data
- OpenRouter, Inc. (United States) — receives your task, the screenshot, text and structure of every page Suhail opens, and any file you attach. This is how Suhail sees; there is no mode in which it works without sending them.
- Through OpenRouter, the model vendor it routes your request to. We send
data_collection=deny, so OpenRouter routes only to vendors that do not retain your data or train on it. - OpenAI (United States) — voice notes only, for transcription, and only if you use the microphone.
- A web-search provider — the search terms Suhail composes from your task, only when it searches.
- Stripe (United States / Ireland) — payment details and billing identifiers, under Stripe's own privacy policy.
- Our hosting provider — the server everything above runs on and is stored on, in the country named in §5.
We share data with no one else, except where the law requires us to or to enforce our terms. Our providers are bound by contract to use your data only to provide their service to us.
5Where it is processed
Our server is in KW. Model providers and Stripe process data in the United States. This means your data leaves the State of Kuwait and the GCC. Kuwait's data-privacy regulations and the data-protection laws of Saudi Arabia, the UAE, Qatar, Bahrain and Oman each place conditions on transfers abroad. We rely on your explicit consent, given when you create an account and repeated here, and on contractual protections with each provider. If you do not want your data transferred abroad, Suhail cannot be used, as it has no way to operate without its model provider.
6How long we keep it
| Data | Kept for |
|---|---|
| Run records — screenshots, transcripts, what was done | 90 days after the run ends, then deleted, unless you ask us to keep or delete a run sooner |
| Files you upload and files Suhail produces | 90 days after the run they belong to ends |
| Stored credentials and website sign-in state | Until you delete them or close your account |
| Account details | Until 30 days after you close your account |
| Billing records — credit granted, top-ups, run costs | As long as accounting and tax law requires, after which they are deleted or anonymised |
| Technical logs | 30 days |
Deletion on these schedules is automatic: a sweep runs once a day and removes run records and files past their period. To have a run deleted sooner, or kept longer, write to [not yet set — SUHAIL_LEGAL_CONTACT] and we will confirm within 30 days.
7Your rights
You may ask us for a copy of your personal data; to correct it; to delete it; to restrict or object to how we use it; to withdraw consent you have given; and, where the law provides it, to receive your data in a portable form. Deleting a stored credential, a run, or your account can be done in Suhail; for anything else, write to [not yet set — SUHAIL_LEGAL_CONTACT]. We will answer within 30 days and will not charge you unless a request is manifestly excessive.
You may also complain to the data-protection authority where you live: in Kuwait, the Communication and Information Technology Regulatory Authority (CITRA); in Saudi Arabia, the Saudi Data and Artificial Intelligence Authority (SDAIA); in the UAE, the UAE Data Office; in Qatar, the National Cyber Governance and Assurance Affairs; in Bahrain, the Personal Data Protection Authority; in Oman, the Ministry of Transport, Communications and Information Technology.
8Security
Stored credentials are encrypted at rest with a key held separately from the database and are never shown to the model, written to a transcript or captured in a screenshot. All traffic to Suhail uses TLS. Access to stored data is limited to the people who operate Suhail, and the model providers never receive your credentials. If we learn of a breach affecting your data we will tell you and, where required, the relevant authority, without undue delay.
Because Suhail photographs the pages it works on, a run's record can contain personal data about other people who appear on your pages. Treat shared run links accordingly.
9Automated processing and AI
A large language model reads your task and the pages Suhail opens, and decides what to click and type next. This is automated processing of your data, done only to carry out the task you gave. It is not used to profile you or to make decisions about you as a person. Any step with a legal or financial effect — paying, submitting to a government service, sending a message — is paused for your explicit approval and is never taken by the model alone.
10Children
Suhail is for adults. We do not knowingly collect data from anyone under 18; if you believe we have, write to [not yet set — SUHAIL_LEGAL_CONTACT] and we will delete it.
11Cookies and local storage
Suhail sets one cookie, to keep you signed in, valid for 14 days. It uses your browser's local storage to remember preferences such as whether the live view is open. There are no advertising or analytics cookies.
12Changes and contact
If we change this policy in a way that affects you, we will tell you by email or in Suhail before the change takes effect. The effective date of the current wording is at the top of this page. Questions and requests: [not yet set — SUHAIL_LEGAL_ENTITY], [not yet set — SUHAIL_LEGAL_CONTACT].
Terms of service · Privacy policy · What happens to your data · Suhail