Privacy & Data Protection Policy

Last updated: November 2026

1. Introduction & Overview

TORJOMAN ("we", "our", or "us") is committed to safeguarding the privacy and security of professional data, and aims to comply with the Saudi Personal Data Protection Law (PDPL) and its Implementing Regulations. This Privacy Policy sets out how data is collected, handled, and protected on the platform.

2. Information We Process

Bureau Profile Data: Email address, bureau name, certified translator name, licence number, commercial registry details, and pricing preferences.
Translation Pipeline Data: Extracted text and terminology required to produce structured bilingual DOCX and PDF deliverables.
Security & Operational Logs: Encrypted audit logs including IP addresses, timestamps, and system actions for fraud prevention and integrity monitoring.

Key Privacy Guarantee: Original scan images are processed transiently in memory solely during extraction and are never permanently stored in our document databases.

3. Purpose of Processing

We process information solely to:

Deliver specialized AI extraction, legal translation, and formatting tools.
Manage bureau accounts, quota limits, and billing fee calculations.
Facilitate cryptographic QR verification without revealing underlying sensitive document content.
Maintain system security, compliance, and disaster recovery preparedness.

We never monetize, sell, or license user or client data to advertisers or third-party brokers.

4. Data Security & Multi-Tenant Isolation

We implement defense-in-depth security measures, including:

Encryption in transit (TLS).
Strict per-bureau logical isolation ensuring no cross-bureau data exposure.
Backups encrypted before they leave our servers.

Where Data Is Processed and Stored

The platform is hosted, and documents are stored, on servers operated by Hetzner in Germany (European Union), outside the Kingdom of Saudi Arabia.
Document images are sent to a third-party AI provider for text extraction and translation (currently OpenAI, United States).
Original scans and translations are kept so the bureau can review them, and are deleted when the bureau deletes the document.
By using the platform, the bureau confirms it is authorized to have these documents processed and transferred in this way.

5. Data Subject Rights (PDPL Compliance)

In accordance with the Saudi Personal Data Protection Law, authorized users have the right to access, rectify, export, or request permanent deletion of their account records and associated translations.

To exercise any privacy rights or request account closure, contact our Data Protection team at: support@torjoman.aqd-legal.com