Data policy
Draft for legal review. This page describes only what the software does today.
What happens to your file
Your file is stored on our server for processing. Each page is turned into an image and its text is read. Before anything is sent to the AI, we remove email addresses, phone numbers, web addresses, P.O. boxes, the values of labelled fields such as Client or Project, repeating letterheads and footers, the names of people and companies outside the item table, and any words you ask us to hide. The same parts are covered with solid boxes on the page image.
Prices
Rate and amount columns, totals and currency values are removed before any call to the AI. They are kept on our server and put back into your Excel by row.
Which AI provider
Page reading and line counting use OpenAI, called through the OpenAI API (not the ChatGPT app). OpenAI receives the redacted page image and the redacted page text. Its handling of API data is set by its own terms.
How long we keep it
The original file, page images, the text and images sent to the AI and the results are deleted automatically within 24 hours. You can delete them sooner with Delete now on the results page. We keep only counts that contain no document content: number of pages and lines, timing, cost and number of flags. Pilot workspaces are the one exception: price lists you import, and the product choices you approve (kept so SahlQuote can suggest them next time), stay in your workspace until you delete them. Quotes are deleted with the BOQ they came from. If you send feedback, we keep the message you type and any contact you give, until we delete it.
Limits
Redaction is automatic and can miss things. There is no Arabic name detection yet: Arabic names are hidden only when they appear in a labelled field or in your words to hide. Brand names inside item descriptions are kept because they are part of the specification. Scanned pages are refused in this version so they are never sent unredacted.
Results
Every output is a draft. Check flagged lines before use.
TODO (lawyer review): controller identity and address, legal basis, UAE PDPL and KSA PDPL wording, international transfer wording, contact for data requests, governing law.