Effective 17 October 2026.
Who is responsible
Kirto LLC ("Kirto", "we") is the controller of the personal data described here. We are atAnas Bin Malik Road, Al Yasmin, Riyadh, Saudi Arabia. Write to [email protected] about anything in this notice.
This notice covers kirto.com and email you send us. Gate and Flow run in your own network, and the personal data they process stays with you: neither product sends Kirto anything. The Trust Center lists the connections each product makes.
Visiting the site
The site is static pages. It sets no cookies, runs no analytics and loads no third-party trackers. The theme you choose is kept in your browser's local storage and never sent to us.
The site is hosted on Cloudflare. To deliver a page, Cloudflare receives what every browser sends: your IP address, the page requested, and your browser's user agent. Cloudflare uses this to serve the site and protect it from attack. We do not combine it with anything else or use it to identify you.
Writing to us
A demo request, a question or a security report is an email you send to us. We receive your email address, your name and company if you give them, and what you write.
We use it to reply to you, to arrange a demo or an evaluation, and, where the conversation leads to one, to prepare an agreement with you. We do not add you to a mailing list, and we do not sell or rent your data.
How long we keep it
We keep a conversation for 24 months after our last exchange with you, then delete it. Spam and messages we cannot act on are deleted within 30 days. A conversation that becomes a contract is kept for as long as the contract and the law require.
Who else handles it
Microsoft stores the messages you send us, in the Microsoft 365 mailboxes our addresses belong to. Cloudflare handles the page requests described above. Each processes the data only to provide its service to us. We share personal data with nobody else, unless the law requires it.
Either may process data outside the Kingdom of Saudi Arabia. Where personal data leaves the Kingdom, we transfer it only as the Personal Data Protection Law and its regulations on transfer allow.
Your rights
Under the Personal Data Protection Law you may ask us what personal data we hold about you and how we use it, get a copy of it, have it corrected, and have it deleted. Write to [email protected]; we answer within 30 days. If you are not satisfied with our answer, you can complain to the Saudi Data and AI Authority (SDAIA).
If you are in the European Union or the United Kingdom, you also have the rights to object to our use of your data, to restrict it, and to complain to your local data protection authority.
Changes
When this notice changes, the date at the top changes with it. A change to how we use data you have already sent us is told to you by email before it applies.