Privacy Policy
Last updated: July 2026
1. Introduction
Qadiya OS ("we", "us") is a legal practice management platform used by Kuwaiti law firms. This policy explains what personal data we process, how we protect it, and the rights available to firm members and their clients under Kuwait's Personal Data Protection Regulation (CITRA Decision No. 42/2021) and applicable professional-secrecy rules under Kuwait's Advocacy Law No. 42/1964.
2. Data we process
- Firm & user data: name, email, role, authentication credentials.
- Case data: matter numbers, hearings, judgments, deadlines, documents, notes, timeline events.
- Client data: names, civil IDs, contact details, and correspondence supplied by the firm.
- Financial data: invoices, trust ledger entries, time entries.
- Operational logs: audit trail of user actions inside the firm's workspace.
3. Legal basis
We process data as a processor on behalf of the law firm (the controller). The firm is responsible for obtaining any necessary client consent under CITRA rules and Kuwait Bar Association guidance.
4. Data residency & security
Data is stored on encrypted managed infrastructure. All connections use TLS. Row-level security isolates every firm's data — no firm can read another firm's records, ever. Backups are encrypted at rest.
5. Access & sharing
We do not sell data. We do not use client or case data to train AI models. AI features (drafting, briefings, embeddings) route through the Lovable AI Gateway under a no-training data-processing agreement, with prompts scoped to the firm's own data.
6. Retention
Firm data is retained for the life of the subscription plus 90 days for recovery. On written request from a firm's administrator, we permanently delete all firm data within 30 days, except records we are legally required to retain.
7. Sub-processors
We use vetted sub-processors for hosting, email delivery, and AI inference. A current list is available on request to privacy@qadiya.app.
8. Your rights
Individuals whose data is stored in a firm's workspace may exercise access, correction, and deletion rights by contacting the firm directly. We assist firms in fulfilling these requests. Complaints may be filed with CITRA (Communication & Information Technology Regulatory Authority).
9. Contact
Data protection queries: privacy@qadiya.app.