Privacy Policy

1. Information we handle

• Account and profile information, including your name, email, optional phone number and sign-in information.
• Company, employee and project records; advances, expenses, review decisions and activity history.
• Uploaded receipts and transfer evidence, including image or PDF contents, file metadata and extracted fields.
• Technical information used for access, security and service operation, and the information you include in a support request.

2. Why it is used

We use information to provide account access, organize your requested workflows, process documents, respond to support requests and protect the service. We also retain information where necessary for legal obligations and dispute resolution. Processing must have an applicable lawful basis; consent is used where required.

Your company determines which employee and business records to submit and who may access them. Ask your company administrator about its use of your information, and contact ClenoraOps for requests concerning the platform.

3. Automated document reading

When automated reading is used, the submitted document is sent to OpenAI's API to suggest fields such as merchant, date and amount. The document may contain personal or financial information. Submit only the information needed for the business purpose.

Suggestions can be inaccurate. Review the fields and request a correction when needed. Unread fields can be completed manually. A manually entered amount or a requested correction requires manager matching before approval. Automated reading does not approve an expense or transfer funds.

4. Service providers and sharing

The service uses OpenAI Sites and its Cloudflare infrastructure for hosting and storage, OpenAI for document reading, and Resend for service emails. Previously created paid subscriptions are processed by Paddle, which handles payment information under its own policy. ClenoraOps does not receive or store full payment-card details.

Authorized company users can access records according to their role. We do not sell personal information. Information may be disclosed where required by law, to protect rights and safety, or in a business transfer subject to applicable safeguards.

5. Retention and protection

Retention depends on the purpose of the record and applicable accounting, legal, security and dispute requirements. Ending employee access is separate from deleting a company's financial records. Contact us to request deletion or clarification of retention for a particular record; identity and authority may need to be verified.

Original files are served through authenticated requests scoped to the company and user permissions. Access controls reduce risk but do not guarantee absolute security. Keep the original records required by your business.

6. Your requests and complaints

You may request access to or a copy of your personal information, correction or deletion, and withdraw consent where processing relies on it, subject to applicable law. Use Contact and choose Privacy. We may ask for information needed to verify your identity and assess the request.

You can also raise a privacy complaint with the competent authority. In Saudi Arabia, the Saudi Data and AI Authority (SDAIA) receives personal-data protection complaints.

7. Processing locations and local preferences

Providers may process information outside your country. Do not assume that all data is stored in Saudi Arabia. Applicable transfer requirements and provider arrangements must be considered when using the service for your business.

The site uses session cookies for sign-in and cookies or local storage for preferences such as language. ClenoraOps is a business service and is not directed to children under 18.

8. Updates and contact

This page shows its latest revision date. Material changes will be communicated through the service or account contact information when reasonably possible. Use Contact for privacy questions, requests or complaints.