Privacy Policy

Version: 1.2
Effective date: 20 October 2026
Last updated: 20 October 2026

This Privacy Policy explains how CodeDev (شركة كود التطوير لتقنية المعلومات) ("Bora", "we", "us") collects, uses, shares and protects personal data when you use the Bora website, web application and mobile applications (the "Service"). It is written to comply with the Saudi Personal Data Protection Law (PDPL) and its implementing regulations.

If you have any question about this policy, contact us at info@codedev.sa.

1. Our role

• Bora as controller. For your account data (for example your name, email, password and sign-in history), Bora decides how and why the data is used.
• Bora as service provider (processor). For the business data your organization puts into its workspace (for example employee records, customers, projects and documents), your organization is responsible for that data. Bora processes it on your organization's behalf to provide the Service. Questions about that data should go to your organization first.

2. Data we collect

Data you give us

• Account details: first and last name, work email, password (stored only as a secure hash), nationality, phone number and profile photo if you add them.
• Workspace data: company profile, tenders and opportunities, projects, contracts, payments, expenses, tasks, comments, stories, documents and attachments.
• HR data (if your organization uses HR features): employee profiles, roles, leave balances and requests, performance information and attendance records.
• Support messages you send us.

Data collected automatically

• Device and usage data: IP address, device type, operating system, app version, browser, sign-in times and active sessions.
• Location: only when you check in or check out for attendance, and only while the app is open, to verify that you are at your assigned work location. We do not track your location in the background. You can deny location permission in your device settings; location-based check-in will then not be available.
• Push notification token, if you allow notifications.
• App security checks: to protect your account and data, the mobile app checks whether the device is jailbroken or rooted, whether the app has been modified, and whether it is running in an emulator. These security signals, with basic device details (device model, operating system and app version), are shared with our app-security provider. The app may not open on a device that fails these checks.
• Error reports: if the Service fails, we may collect technical details about the error (for example the screen, app version and device type) to fix it.
• Essential cookies on the web, used to keep you signed in securely. We do not use advertising cookies.

Data from third parties

• If you sign in with Google, we receive your name, email address and profile photo from Google.
• Public tender information from official government portals.

3. Why we use your data

We do not sell your personal data, and we do not use it for third-party advertising.

4. AI data sharing

AI features are optional. When you use them, they can send your prompts, relevant business records, document contents and extracted text to AI, which processes it only to deliver AI features: chat, document classification and extraction, drafting and analysis.

• Bora asks for your personal AI-sharing choice before your first AI action. The consent dialog explains the data categories and purposes covered by the current disclosure.
• You can continue without AI and use the manual entry and file-storage functions that are available.
• Your choice applies to your account across your companies and devices. You can review or withdraw it at any time in Preferences → AI data sharing. Withdrawal blocks new AI work for your account; a request already sent to a provider cannot be recalled.
• A material change to recipients, shared data or purposes requires your renewed approval.
• Your personal choice does not authorize sharing on behalf of your colleagues. Your organization is responsible for having a lawful basis to provide employee, customer and other people's data.
• Provider retention and use depend on the provider's terms and the configuration of Bora's provider accounts. We do not promise a particular provider retention period or exclusion from model training here.

5. Who we share data with

We share personal data only when needed, and only with:

• Members of your workspace, according to the roles and permissions your organization sets.
• Service providers that help us run the Service, under contracts that require them to protect the data: cloud hosting and storage, email delivery, push notifications, payment processing, and AI providers (only with your consent).
• Government authorities, when the law requires it or to protect rights, safety and security.
• A buyer or successor, if Bora is involved in a merger or acquisition. This policy will continue to protect your data.

6. Where your data is stored

Our main infrastructure is hosted in the Kingdom of Saudi Arabia (Riyadh region). Service providers that process data on our behalf do so under contracts and safeguards required by the PDPL.

7. How long we keep data

• Account data: while your account is active. After you delete your account, we delete or anonymize it, except what we must keep by law.
• Workspace data: for as long as your organization keeps its workspace and subscription. Your organization can delete records or close the workspace.
• Security and audit logs: for the period required by applicable cybersecurity and legal requirements.
• Billing records: for the period required by tax and commercial laws.

Withdrawing AI consent does not delete records already stored in Bora or data already processed by a provider.

8. How we protect data

We use technical and organizational measures aligned with National Cybersecurity Authority (NCA) requirements, including encryption in transit (TLS) and at rest, password hashing, multi-factor authentication for privileged roles, short-lived access tokens, per-tenant data isolation, role-based access control and audit logging. No system is perfectly secure; if a personal data breach affects you, we will notify you and the competent authority as the law requires.

9. Your rights

Under the PDPL you have the right to:

• Be informed about how your data is collected and used (this policy);
• Access your personal data and get a copy of it in a readable format;
• Correct inaccurate or incomplete data;
• Delete your data when it is no longer needed, subject to legal retention;
• Withdraw consent at any time, where processing is based on consent (for example AI sharing).

You can update most profile data in the app. You can request account deletion from your account settings. For any other request, email info@codedev.sa. We will respond within the period set by law, normally within 30 days. If the data belongs to your organization's workspace, we may refer your request to your organization.

If you are not satisfied with our response, you can file a complaint with the Saudi Data & AI Authority (SDAIA).

10. Children

The Service is intended for business users aged 18 or older. We do not knowingly collect data from children. If you believe a child has given us personal data, contact us and we will delete it.

11. Changes to this policy

We may update this policy from time to time. When we make a material change, we will notify you in the Service or by email before it takes effect and, where the law requires, ask for your consent again. The version number and dates at the top show which version applies.

12. Contact us

CodeDev
Email: info@codedev.sa
Address: Abu Bakr Al-Siddiq Road, Al Yasmin 13325, Riyadh, Kingdom of Saudi Arabia