Privacy Notice

Who operates this website

This website (PAS.QA) is operated by Parashot Al Amanah for Artificial Intelligence Consultations and Solutions W.L.L. (براشوت الأمانة لاستشارات وحلول الذكاء الاصطناعي), a company registered in the State of Qatar under Commercial Registration No. 249184. For any question about this notice or your data, the approved channel is this website's Contact page — see "Privacy requests and complaints" below.

What data we process, and why

Browsing the site's public pages does not require an account or sign-in, and does not by itself create any request or ticket. The hosting infrastructure may process limited operational data (such as IP address and request time) solely to operate and secure the site — see "Technical logs" below. When you actually submit information through the Contact form, or through submitting a challenge from the home page after filling in contact details, the information entered (name, organization, job title if provided, email or mobile number, and challenge description) is processed for one purpose: to manage and respond to your request. For the Contact and Challenge submission forms, entering information without completing the explicit submission action does not create a Contact request or ticket and does not submit those form contents as a Contact or Challenge request.

How Contact and Challenge requests are stored

On submission, your information is stored as a contact record and a request (ticket) in PAS's database to manage and follow up on it, and an internal email is also sent to the PAS team containing the information you provided. You then receive an automatic acknowledgement message. Any later reply to your request from our team is also stored as part of that same request record, so the full communication history stays intact and available to whoever at PAS is handling your request.

Who receives this data

• Vercel — the hosting provider that runs this website, and also provides a general analytics tool active on the site (see "Analytics" below).
• Neon — the Postgres database provider where contact and request records are stored; hosted on Amazon Web Services infrastructure in a United States region (us-east-1).
• Microsoft (Microsoft Graph) — used only to send internal notification emails and automatic replies; this website never reads any mailbox.
• Upstash — used only for rate-limiting (abuse prevention); it stores a hashed value derived from a request identifier, not your actual data.
• OpenAI, via the Vercel AI Gateway — in two limited cases: (1) When you use AI-assisted visitor features such as "Visualize Challenge" or "Ask PAS", PAS sends the challenge text or question needed to provide that feature. PAS does not intentionally append the Contact form's name, organization, email, or mobile fields to that AI request. However, personal information that you choose to include yourself within the free-text question or challenge may form part of the text sent for AI processing. (2) When a PAS staff member manually uses an internal "AI Draft Reply" tool on a previously submitted ticket — never automatically triggered by your submission — to produce a suggested reply for that staff member's own review before any reply is sent to you. This may include your information (name, organization, email, mobile) if it appears in that ticket's own correspondence record. In both cases the processor is OpenAI via the Vercel AI Gateway; we do not make any claim about OpenAI's retention, training use, data residency, or contractual guarantees beyond what is stated here, as that has not been independently verified.

Where processing happens (cross-border)

We do not claim that all data stays within Qatar — that would not be accurate. Per the list above, your data is processed on infrastructure operated by Vercel and Neon (United States) and Microsoft and OpenAI (global infrastructure), each under those providers' own agreements as service providers. Outside the processing described above, PAS does not intentionally disclose your personal data to other third parties, except where disclosure is required by applicable law or by a competent authority.

Technical logs

The hosting infrastructure (Vercel) retains baseline operational logs (such as request ID, route, status, and duration) for operational and security purposes only. This site does not use a separate external error-monitoring tool; application logs are written to the Vercel platform itself and are not deliberately populated with the full content of your messages.

What is stored on your device

• Day/night theme preference.
• The language you last viewed the site in.
• Accessibility Center settings (text size, contrast, and similar).
• Non-sensitive progress within the homepage's "challenge journey" experience (such as the current step), never the challenge text itself or contact details.
• Presentation playback preferences (narration speed, auto-advance, transcript visibility).
• When switching language while typing a challenge, the challenge text is held briefly in session-only storage so it carries over to the new page, and is deleted immediately after being read back.

Analytics

This website uses Vercel Web Analytics, which is actively enabled in the production environment. This tool measures general, aggregate usage statistics (such as visit counts and page views) and does not receive Contact-form content, challenge text, your name, email, or mobile number.

Purpose and data minimization

We collect only what is necessary to respond to your request or to operate and secure the site. Please do not enter any sensitive or special-nature personal data through this website, including: identity or bank account numbers or payment cards, confidential documents, health information, children's data, racial or ethnic origin or religious beliefs, marital status, or any information related to criminal matters or confidential data belonging to other parties. This website is not a dedicated channel for such data, and no technical safeguard guarantees it cannot be entered by mistake — if such data does reach us, its handling and review is internally restricted.

Data retention

Your request (ticket) and the correspondence tied to it are stored to manage and respond to it. PAS has not yet adopted a formally approved retention schedule or an automated deletion mechanism; we will not claim a specific duration or automatic deletion that does not actually exist. This is under internal review. For any deletion request or question about your data, see "Privacy requests and complaints" below.

Your rights

• Access your data held by us and obtain a copy of it.
• Request correction of inaccurate data.
• Request deletion of your data, subject to any legal or contractual obligation requiring us to retain it longer.
• Object to a particular processing of your data.
• Withdraw your consent at any time, where processing relies on consent.
• Raise a complaint about how we have handled your data.

Privacy requests and complaints

To exercise any of the rights above, or for any privacy-related question or complaint, contact us through this website's Contact page and note that your request relates to privacy. We receive, review, and respond to every request; we may ask for what is necessary to verify your identity before acting on an access or deletion request. We do not promise that every deletion request will be carried out immediately without exception — an existing legal or contractual obligation may require retaining some data for longer. You may also raise a complaint with the competent data protection authority in the State of Qatar.

Security

Technical security approach detail is covered on the Security page — including input validation, no secrets in client-side code, and logging discipline. No information system is entirely immune to every risk; what is described there is what is actually implemented, not an absolute promise of zero risk.

Changes to this notice

Version 2.0 — effective as of 2026-09-15. When a material change is made to this notice, the effective date above will be updated.