Privacy Policy

1. Introduction

Requify is owned and operated by Array Dynamic FZE LLC ("we," "our," or "us"). We are committed to protecting your personal data and respecting your privacy. This Privacy Policy explains how we collect, use, store, and protect your personal information in accordance with the General Data Protection Regulation (GDPR) and other applicable data protection laws.

2. Data Controller

For the purposes of GDPR, the data controller is:

3. Legal Basis for Processing

We process your personal data on the following legal bases:

• Contract: Processing is necessary for performing our contract with you (providing our service)
• Consent: You have given explicit consent for specific processing activities (e.g., marketing communications, optional cookies)
• Legitimate Interest: Processing is necessary for our legitimate business interests (e.g., fraud prevention, security)
• Legal Obligation: Processing is required to comply with legal obligations

4. Personal Data We Collect

4.1 Information You Provide

• Account Information: Name and email address. Your password is handled by our sign-in provider (Clerk); we never see or store it
• Organization Data: Organization name, member information
• Project Data: Project details, documents, sections, assignments
• Payment Information: Processed securely by Stripe (we do not store full payment card details)

4.2 Automatically Collected Information

• Usage Data: IP address, browser type, device information, access times
• Cookies: See our Cookie Policy section below
• Log Data: Server logs, error reports, performance metrics

5. How We Use Your Data

• Provide and maintain our service
• Process your transactions and manage subscriptions
• Send service-related communications and notifications
• Respond to your inquiries and support requests
• Improve and optimize our service
• Detect and prevent fraud, abuse, and security incidents
• Comply with legal obligations
• Send marketing communications (only with your consent, which you can withdraw at any time)

6. Data Sharing and Disclosure

We share your personal data only with:

6.1 Third-Party Service Providers (Processors)

The same list is Annex 2 of our Data Processing Agreement.

6.2 Legal Requirements

We may disclose your information if required by law or in response to valid legal requests.

7. International Data Transfers

Your data may be transferred to and processed in countries outside the European Economic Area (EEA), including the United States and, when you use AI features, the People's Republic of China (see DeepSeek above). China is not covered by an EU adequacy decision. Workspace owners and admins can switch AI processing to the EU region (Mistral AI) in Settings → AI usage to avoid these transfers for AI features. We ensure adequate protection through:

• Standard Contractual Clauses (SCCs): EU-approved contracts with our US-based processors
• Adequacy Decisions: Processing in countries deemed adequate by the EU Commission

8. Your Rights Under GDPR

You have the following rights regarding your personal data:

9. Data Retention

We retain your personal data only as long as necessary:

• Account Data: Until you delete your account. Copies that exist only in our database provider's backups are removed when those backups expire
• Project Data: Until you delete the project or your account
• Payment Records: As long as tax and accounting law requires
• Audit Logs: Deleted automatically after 90 days
• Marketing Data: Until you unsubscribe or withdraw consent

10. Cookie Policy

We use cookies in compliance with ePrivacy Directive:

Essential Cookies (Always Active)

• Authentication and session management
• Security and fraud prevention

Optional Cookies (Require Consent)

• Analytics: Our own usage statistics (the pages you view, a session ID kept in your browser, your IP address and browser type; deleted after 90 days) and Google Analytics where it is enabled. Both only if you agree
• Marketing: We set no marketing cookies at present. If that changes, they will need your consent
• Preferences: User preferences and settings

You can manage your cookie preferences at any time through our cookie banner or in your account settings.

11. Data Security

We protect your data with technical and organizational measures, including:

• Encrypted connections (HTTPS) for all access, and encryption of stored data by our hosting providers
• Database, file storage and application servers in Frankfurt, Germany
• Access checks on every request, so organizations cannot see each other's data
• Roles and per-project permissions that limit who can read and change what
• An audit log of important actions and automatic health monitoring

The full list is Annex 1 of our Data Processing Agreement.

12. Data Breach Notification

In the event of a data breach that poses a risk to your rights and freedoms, we will:

• Notify the relevant supervisory authority within 72 hours
• Notify affected individuals without undue delay if there is a high risk
• Document all data breaches in our breach register
• Take immediate measures to mitigate the breach

13. Children's Privacy

Our service is not intended for children under 16. We do not knowingly collect personal data from children under 16. If you believe we have collected data from a child, please contact us immediately.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by email or through a prominent notice on our website. Your continued use of the service after changes constitutes acceptance of the updated policy.

15. Contact Information