Privacy
Privacy notice
This notice explains how Bunyan handles personal data under the Saudi Personal Data Protection Law (PDPL).
Effective from October 20, 2026
Who is responsible
For your account, sign in and billing, Bunyan is the controller. For the documents your organization uploads, your organization is the controller and Bunyan processes them on its instructions.
What we collect
Your name, work email, role, Saudi Council of Engineers number when you add it, sign in and session records, and the documents and comments your organization uploads. We do not collect card numbers; payments are taken on StreamPay's page.
Why we use it
To provide the service you signed up for, keep it secure, bill your organization and send the notices you choose. We never use your documents to train AI models.
How long we keep it
Account data is kept while your organization is subscribed. Projects can be deleted by an Owner at any time. After cancellation, organization data is deleted 30 days later. Tax invoices are kept for the period the law requires.
Where it is stored
All data is stored and processed in Saudi Arabia. Notification emails are sent through Resend, outside the Kingdom; they carry only short notices and links, never document content.
Your rights
You can see and correct your profile at any time. To ask for a copy of your personal data or for its deletion, email privacy@bunyan.si. We answer within 30 days. Signed records your organization must keep are retained, and we tell you which and why.