Privacy Policy

We collect your account data (email, name, phone) via Zayenha Hub single sign-on — no separate password for this app. Your analysis results and answers are stored in this app's database (Cloudflare D1) and are never shared with a third party without your consent. This policy is meant to be read alongside our Terms & conditions, which governs your use of the app.

The data we collect

Beyond your Zayenha Hub account data, we collect what you produce inside the app directly: your answers on every instrument, the results and interpretations generated from them, your actual performance inside simulation exercises, and any rating you request from someone who knows you (shown only with your explicit consent). We also log limited operational data — sign-in time, device and browser type — to keep your account secure and detect unusual activity promptly.

Classifying your sensitive data

Personality inferences derived from your answers are classified as sensitive data under Saudi PDPL — not just the raw answers. We apply the highest protection to them: isolation from identity fields, encryption, and a full deletion right on request. The same classification applies to any rating another person submits about you — it is sensitive data about you, not about its author, and carries the same protection and the same deletion right.

How we use your data

We use your data for specific purposes only: scoring every instrument with psychometric accuracy, building your living profile that accumulates with every new measurement and simulation, and generating interpretations and recommendations grounded in your measured data (every AI-generated output is explicitly labeled as such, and never used to make a decision about you without showing it to you first). We never use your sensitive data to train general-purpose AI models, and we never sell or rent it to anyone. Any statistical analysis we run to improve the platform relies on aggregated, anonymized data that cannot be linked back to your personal account.

Who can access your data

Zayenha Hub holds your identity and billing data exclusively, and cannot access your detailed answers or analysis results. No third party receives your data without your explicit consent — except purely technical infrastructure providers (server hosting on Cloudflare), who cannot read your protected data by design in the first place. When a technical error occurs, a brief report is sent to a unified error observatory inside Zayenha Hub — it carries no secrets and no personal data, only what's needed to diagnose and fix the fault.

Protecting your data

We apply layered protection: every database query runs through parameterized statements, never string concatenation, so SQL injection has no room to occur. IP addresses are stored hashed, never raw, so no one can recover your real address from our logs. Session cookies are protected with HttpOnly, Secure, and SameSite attributes to prevent theft or cross-site abuse. Deleting any record in our system is an immediate logical delete — invisible to you or anyone else afterward — followed by permanent deletion per our internal retention policy. We never print or log any secret or sensitive data into general operational logs.

Cookies

We use only necessary session cookies to keep you signed in and to protect forms against cross-site request forgery (CSRF) — no advertising cookies, and no third-party measurement without your consent (see the end of this paragraph). Session cookies expire automatically, and you can clear them manually from your browser settings at any time, noting that doing so signs you out of your account. We also use two additional, narrowly-scoped first-party cookies: one that remembers your visit's source (UTM) for up to thirty days so a later sign-up can be attributed to the campaign it came from, and an anonymous statistics cookie (zp_vid) used only to count visits and measure their duration — it expires automatically after thirty minutes of inactivity, is never linked to your identity or account, and is never shared with any outside party. Both are HttpOnly — unreadable by any script in your browser — and neither is set, nor any statistical visit recorded, until you explicitly accept analytics cookies in the consent banner. Only with that same analytics consent do we load Google Tag Manager, which runs Google Analytics 4 to measure visits in aggregate (_ga cookies): your name, email, answers and results are never sent to it, it is never loaded on your account and results pages, and advertising signals always stay denied. You can withdraw at any time from the “Cookie settings” link at the bottom of every page.

Notifications and marketing communication

If you subscribe to the newsletter or enable browser notifications, we send you updates about new tools and genuine offers only — we never share your email with external marketing parties. You can unsubscribe via the link in every message, or turn off notifications from your account or browser settings at any time, without affecting your use of the app.

Your data when you contact us

When you send a message through our Contact us page, we collect your name, email, and message text solely so we can reply to you, and we keep it only as long as needed to handle your inquiry. The form is protected by Cloudflare Turnstile to block automated messages, and your message content is never used for any purpose beyond responding to it.

Signing in from more than one device

You can use your account from more than one device at the same time, and each sign-in session has its own independent cookie. If you lose a device or suspect unauthorized access, change your Zayenha Hub password immediately to end all other active sessions.

Requests from official authorities

We may disclose limited data in response to an official request from a competent authority in the Kingdom of Saudi Arabia, following proper legal procedure, and only to the narrowest extent that satisfies the request. We notify you of this whenever legally permitted, and we verify the legitimacy of every request before responding to it.

Your rights under the Personal Data Protection Law

You always have the right to: view all your account data, correct any error in it, request its complete deletion from this app (while your identity and billing records remain in Zayenha Hub, since it owns them, not us), object to any use of your data that doesn't match what's described here, and withdraw your consent for any rating you requested from someone else at any time — it then disappears from your profile immediately. To exercise any of these rights, email us at the address below and we'll respond within a reasonable period.

The competent supervisory authority for personal data protection in the Kingdom is the Saudi Data & AI Authority (SDAIA), and you have the right to lodge a complaint with it if you believe the processing of your data breaches the law.

Who answers a Mirror 360 invitation

In the Mirror 360 products the user sends an invitation link to people who know them, and the invitee answers without creating an account. Before the first question the invitee sees a disclosure stating who invited them, for what purpose, and how their answers are used, and their answers are stored only after their explicit agreement. We do not store the invitee's name, email, or device address with their answers, and they receive no report in return. In the anonymous aggregate mode their answers are never shown on their own to the inviter, and nothing is shown before the minimum number of raters has completed (and even then only the average is shown). In the named mode the inviter knows the invitee is the one who answered, and the invitee's name does not appear inside the report. Raters' answers are deleted when the inviter's account is deleted.

Accounts and minors

This app is used through your unified Zayenha Hub account, and Zayenha Hub is the party that manages registration and identity verification. This app does not independently collect a birth date or age-verification data separate from Zayenha Hub.

Data retention and deletion

We keep your account data for as long as your account is active, or as required by law (such as billing records, which Zayenha Hub manages under its own policies). When you request deletion of your account or your data, your answers, results, and any rating about you are fully removed from our database — not merely hidden while remaining intact.

Updates to this policy

We may update this policy when our practices or applicable regulations change. The last-updated date always appears at the top of the page, and continuing to use the app after an update is published means you accept the new version.

Contact about your data

For data inquiries: z@zayenha.com.