Privacy Policy
Effective date: 1 March 2026 · Last updated: October 2026
OBSIDIAN ARROW LLP · BIN 250940005648 · Republic of Kazakhstan
1. Introduction and Data Controller
This Privacy Policy (the "Policy") describes how OBSIDIAN ARROW LLP (BIN 250940005648, the "Controller", "we", "us") collects, processes, stores and protects the personal data of users of the AMANAH AI platform (the "Service").
The Policy is developed in accordance with the Law of the Republic of Kazakhstan dated 21 May 2013 No. 94-V "On Personal Data and Their Protection" and other applicable regulations.
By using the Service, you consent to the processing of your personal data as described in this Policy. If you do not agree with this Policy, please do not use the Service.
2. Data We Collect
Depending on how you interact with the Service, we may collect the following categories of data:
- First and last name
- Email address
- Phone number (if provided)
- Job title (optional)
- Hashed password
- Organisation name
- Business registration number (if applicable)
- Industry / sector
- Business model description
- Document and website links
- Scoring questionnaire responses
- Financial parameters (optional)
- Uploaded documents
- Assessment results and reports
- Messages within the Service
- IP address
- Browser type and OS
- Browser language
- Date and time of visit
- Pages visited and actions taken
- Referral source
We do not collect special categories of personal data (racial or ethnic origin, religious beliefs, biometric data, health data) without explicit consent.
Business model data is submitted voluntarily by the user and is required to provide the analytical services. Failure to provide mandatory fields may prevent access to certain features of the Service.
3. Purposes of Data Processing
| Purpose | Description |
|---|---|
| Service delivery | Creating and managing accounts, processing applications, generating analytical reports, providing access to the dashboard |
| Identification and authentication | Verifying user identity at login, maintaining account security |
| Document analysis | Automated rule-based checks of uploaded documents; recognition of scans by OCR on the Controller's server or, if the Controller has enabled it, by the AI model provider (see section 7); automatic publication of the report; manual changes logged with a reason |
| Communications | Application status notifications, messages within the Service and responses to support requests |
| Sharing with a financial institution | Sharing the selected application, report and documents with a financial institution — only with your explicit consent: for each transfer you sign in your cabinet the Offer to transfer information and documents to a financial institution with a one-time code sent to your account e-mail |
| Service improvement | Analysing aggregated usage data to develop new features and improve analytical quality |
| Invoicing | Issuing invoices and recording payments made by bank transfer |
| Security | Detecting fraud, abuse, cyberattacks, and unauthorised access |
| Legal compliance | Fulfilling obligations under Kazakhstan law and responding to lawful requests from government authorities |
| Marketing communications | Informing about Service updates — only with explicit consent; you can unsubscribe at any time |
We do not use personal data for automated decision-making that materially affects users' rights without human involvement. A report is an automatic preliminary assessment of a company, not a decision on financing: the financial institution makes that decision. The user can report an error in a report and request a re-assessment; any manual change is logged with its reason.
4. Legal Bases for Processing
Personal data is processed on the following legal grounds:
- Performance of a contract: processing is necessary to provide the services ordered by the user (analytical reports, platform access);
- Consent: for sharing data with a financial institution, marketing communications and the submission of optional data;
- Legitimate interest: ensuring platform security, preventing fraud, improving the service based on aggregated analytics;
- Legal obligation: responding to lawful requests from authorised government authorities in Kazakhstan.
5. Storage and Retention
5.1. General Principle
Personal data is retained no longer than necessary for the purposes stated in this Policy, or for the period required by applicable law.
| Data Type | Retention Period | Basis |
|---|---|---|
| Account data | For 3 years after the account is deleted | Contract performance, legitimate interest |
| Analytical reports | 3 years from creation | Contract performance |
| Payment records | 5 years | Kazakhstan tax law |
| Technical logs and activity log | 12 months | Security, technical purposes |
| Correspondence with support and within the Service | 3 years | Contract performance, legitimate interest |
| Marketing consent data | Until consent is withdrawn | User consent |
| Signed offers to transfer information to a financial institution and the records of those transfers | Not deleted: kept after access is revoked and after the account is deleted | Evidence of the company’s consent; legitimate interest |
Upon expiry of the retention period, data is permanently deleted or anonymised, unless otherwise required by law.
6. Data Security
The Controller takes reasonable technical and organisational measures to protect personal data against unauthorised access, loss, modification, or disclosure, including:
- data transmission over encrypted HTTPS/TLS channels;
- storage of passwords only as irreversible salted hashes (PBKDF2-SHA256); passwords are never stored in the browser;
- server-side access checks for every application, document and message: a user sees only data of their own company or data shared with their institution;
- database access restricted on a least-privilege basis; AMANAH AI staff (analysts, administrators) see company data only to the extent their work requires;
- regular data backups;
- monitoring for suspicious activity and unauthorised access attempts.
7. Third-Party Disclosures
We do not sell, exchange, or transfer users' personal data to third parties for commercial purposes.
Limited data transfers may occur in the following cases:
| Recipient | Data | Purpose |
|---|---|---|
| Hosting provider | All platform data | Storage and processing on servers required to operate the service |
| Financial institution chosen by you | The application, report and documents you select | Assessment of possible financing — only after you sign the offer for that transfer in your dashboard. The institution is bound by confidentiality: it uses the information only for this purpose, gives access only to staff who need it, does not pass it on without your new consent (unless the law requires it), deletes or returns copies after revocation or the end of its review (except copies it must keep by law) and reports any breach. You can revoke access at any time: the institution loses access on the platform at once and is reminded to delete its copies; copies already downloaded remain under its confidentiality obligations |
| AI model provider — Anthropic (only if the Controller has enabled the AI model) | Text of uploaded documents and images of scanned pages needed for the analysis | Recognition of scans and review of contract clauses, under a data processing agreement; the data is used only to perform the analysis; AI findings are accepted only with verified quotes |
| Transactional email service | Email address, name | Sending notifications |
| Analytics services | Aggregated / anonymised data | Service usage statistics; no personal data transferred |
| Government authorities | Upon lawful request | Compliance with Kazakhstan law obligations |
| Independent Shariah scholar (at your request) | Anonymised business data | Methodological review of the report; personal data not shared without consent |
All third parties receiving data are required to maintain confidentiality and not use data for purposes other than those stated.
8. Cross-Border Data Transfers
To operate the platform, data may be processed on servers located outside the Republic of Kazakhstan. In such cases, the Controller:
- ensures that the recipient country provides an adequate level of data protection; or
- enters into appropriate data protection agreements with the recipient; or
- relies on other legal mechanisms permitted under Kazakhstan law.
Transfers to countries with an inadequate level of data protection are carried out only with explicit user consent or when required by a legal obligation.
9. Cookies and Analytics
9.1. What Are Cookies
Cookies are small text files stored by the browser to enable the website to function and to remember user preferences.
9.2. Types of Cookies We Use
| Type | Purpose | Required |
|---|---|---|
| Essential | Session cookie amanah_session (HttpOnly, 7 days) for sign-in and security |
Yes |
| Functional | Remembering the selected language (browser local storage) | No |
| Analytical | Collecting aggregated visit statistics (without personal identification) | No |
Users can manage cookie settings in their browser. Disabling non-essential cookies does not prevent use of the core features of the Service.
10. Payment Data
The Controller does not store bank card numbers, payment account details or other financial credentials of users. The Service does not use payment gateways and does not accept online card payments: payment is made by bank transfer against an invoice issued in the dashboard.
The Controller stores only:
- invoice number or transaction identifier (to link the payment to an account);
- payment status (pending / paid / refunded);
- amount and date of payment;
- payer's email address.
11. Minors
The Service is not intended for use by persons under the age of 18. We do not knowingly collect personal data from minors. If we become aware that data from a minor has been submitted without the consent of a legal representative, we will immediately delete such data.
12. Your Data Rights
In accordance with the Law of the Republic of Kazakhstan "On Personal Data and Their Protection" and this Policy, you have the following rights:
Request information about what data we hold about you
Request correction of inaccurate or outdated data
Request deletion of your personal data ("right to be forgotten")
Object to processing based on legitimate interest
Receive your data in a structured, machine-readable format
Withdraw consent to data processing at any time
How to Exercise Your Rights
Submit requests to privacy@amanah-ai.com with the subject line "Data Subject Rights Request". We will respond within 30 (thirty) business days. You can revoke a financial institution's access to your application yourself in the "Sharing" section of your dashboard.
To verify your identity when processing a request, we may ask for confirmation from the registered email address of your account.
13. Policy Updates
The Controller may update this Policy from time to time. The new version will be published on the website with the date of update. For material changes, registered users will be notified by email.
Continued use of the Service after the updated Policy is published constitutes acceptance of the changes.
14. Contact Information
For any questions relating to the processing of personal data, the exercise of your rights, or this Policy, please contact us:
See also: Terms of Use · Disclaimer