Privacy Policy

• We collect what you enter into the enquiry form, so that we can reply to you.
• We do not use analytics, advertising trackers or profiling of any kind.
• This website sets no cookies of its own.
• We do not sell, rent or trade your personal information. Ever.
• You can ask us to show you, correct or delete what we hold, by emailing kimi@alsadaany.com.

Alsadaany Industries, established in Egypt, is the controller of the personal information described in this policy. We can be reached at kimi@alsadaany.com, and our registered postal address is available on request.

This policy covers this website, KIMI’s product site. It does not cover the separate Alsadaany Industries website, or any third-party site we link to.

There are three sources, and they are the only three.

The enquiry form

Your full name, your email address, your country, your company or organisation (optional), the type of enquiry you select from a fixed list, and the message you write. These fields are the whole of the form. Nothing is collected that you cannot see on screen.

Technical request data

When you submit the form, our server sees your IP address, your browser’s user agent string and the time of the request. This is used to protect the form from automated abuse, and for nothing else. It is not used to build a profile of you, and it is not used to track you across the web.

Correspondence

If you email us, or we reply to you, the resulting exchange is held in our mailbox in the ordinary way, along with whatever you choose to tell us in it.

Reading the site collects nothing. Pages are static, and no request is made to a third party until you interact with the enquiry form.

Stated explicitly, because a privacy policy that only lists what is taken tells you half the story:

• No analytics. There is no Google Analytics, no Vercel Analytics, no Plausible, no Meta Pixel and no equivalent, on any page.
• No advertising or cross-site tracking technology of any kind.
• No accounts, usernames or passwords. The site has no login.
• No payment card, bank or financial details. The site takes no payment.
• No location data beyond the country you type in yourself.
• No special category data. Please do not send us health, biometric, political or similar sensitive information through the form.
• No cookies set by this website, and no use of local storage or session storage by our own code.

To reply to your enquiry

Your form submission is emailed to our sales team so a person can answer it. Basis: taking steps at your request before entering into a contract, and our legitimate interest in responding to people who contact us.

To prepare a quotation and fulfil an order

Where your enquiry becomes a quotation or an order, we use your details to prepare it, to invoice and to deliver. Basis: performance of a contract with you, or steps taken at your request before one.

To send you an acknowledgement

If acknowledgements are enabled, we send one email confirming we received your enquiry. It contains your name and the enquiry type you chose, and deliberately does not quote your message back to you. Basis: our legitimate interest in confirming receipt. It is a single message, not a subscription.

To protect the form from abuse

Technical request data supports verification, rate limiting and spam scoring. Basis: our legitimate interest in keeping the site available and free of automated abuse.

To meet legal obligations

Where the law requires us to keep records, for example for tax or trade compliance on an order. Basis: compliance with a legal obligation.

We do not use your information for automated decision-making that produces legal or similarly significant effects for you, and we do not use it for marketing unless you have separately asked us to.

This website sets no cookies of its own, and our code uses no local storage or session storage.

The only third-party technology loaded into a page is Cloudflare’s Turnstile widget, which protects the enquiry form. The full detail, including what Turnstile may store and how to control it, is in our Cookie Policy.

We keep this list short on purpose. These are the only third parties involved, and each one is named because it is actually present in the running site:

Vercel Inc.

Hosting and content delivery. Vercel serves the pages and runs the server-side code that handles a form submission. It processes request data, including your IP address, as part of delivering the site. United States, with a global edge network.

Cloudflare, Inc.

Turnstile, the check that distinguishes a person from an automated sender. The widget loads on the page containing the enquiry form, and on submission we send your challenge token and IP address to Cloudflare to verify. United States.

Resend, or our SMTP provider

Email delivery. The contents of your enquiry are transmitted as an email to our sales inbox, and the acknowledgement, where enabled, is sent to you the same way. Exactly one of these transports is configured at a time.

The typeface used on this site is served from our own domain rather than from a font provider, so viewing the site sends no request to a third-party font service.

We do not sell, rent or trade personal information, and we do not share it with anyone for their own marketing. We may disclose information where we are legally required to, or where it is necessary to establish, exercise or defend a legal claim.

We are based in Egypt, and the providers listed above are established in the United States and operate globally. Your information will therefore be transferred outside your country, and outside Egypt.

Where we transfer personal information internationally, we rely on the contractual protections in our agreements with those providers, including standard contractual clauses where they apply, and we limit what is transferred to what the service actually needs.

Enquiries and correspondence

Kept in our mailbox for up to 24 months after our last exchange with you, so that we can pick up a conversation where it left off. Deleted sooner if you ask.

Quotation and order records

Kept for as long as the commercial relationship lasts, and afterwards for as long as tax, accounting and trade compliance law requires us to keep them.

Anti-abuse counters

Rate limiting counts requests in the server’s memory over a rolling one-hour window, and discards them as the window passes. Nothing is written to a database, because the site has none.

Duplicate detection

To catch the same enquiry being sent twice, we hold a one-way SHA-256 hash of your email address and message in memory for six hours. The hash cannot be read back into the original text, and it is discarded after that.

Security logs

When a submission is refused, we log the reason. Your IP address is not stored in full: it is masked and salted with a key that is regenerated whenever the server restarts, so the entry cannot be traced back to an address. These logs are held by our hosting provider under its own retention schedule.

• The whole site is served over HTTPS, with HTTP Strict Transport Security enabled.
• A Content Security Policy restricts what a page may load and where a form may submit to, which limits the damage any injected content could do.
• Credentials for the email and verification providers are held server-side only and are never included in anything sent to your browser.
• Submitted text is stripped of control characters before it is used, so nothing typed into the form can forge an email header.
• The form is protected by verification, rate limiting, timing checks and spam scoring, so it cannot be used as a relay.
• IP addresses in security logs are masked and salted rather than stored.
• The site holds no database and no payment data, so there is no store of personal information to breach.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If you believe you have found a vulnerability, please tell us at kimi@alsadaany.com.

Depending on where you live, you may have some or all of the following rights over your personal information:

• Access. Ask us for a copy of what we hold about you.
• Correction. Ask us to correct anything inaccurate or incomplete.
• Deletion. Ask us to delete what we hold, where we have no continuing need or legal obligation to keep it.
• Restriction. Ask us to limit how we use it while a question about it is resolved.
• Objection. Object to our use of it where we rely on legitimate interests.
• Portability. Ask for a copy in a portable format, where that right applies.
• Withdraw consent. Where we rely on consent, withdraw it at any time, without affecting anything done before.
• Complain. Raise a complaint with the data protection authority in your country.

To exercise any of these, email kimi@alsadaany.com with “Privacy” in the subject line, from the address you used to contact us. We will acknowledge within 5 business days and respond substantively within 30 days. If we need longer, we will tell you why.

We may need to confirm your identity before acting on a request, which protects you from someone else obtaining your information. There is no charge for a request unless it is manifestly unfounded or excessive.

KIMI is a commercial product sold to adults and to organisations. This website is not directed at children, and we do not knowingly collect personal information from anyone under 18.

If you believe a child has sent us information through this site, contact kimi@alsadaany.com and we will delete it.

We may update this policy as the site changes. The version on this page is the current one, and the date it last changed is shown at the top.

If we ever begin collecting something materially different, for example by adding analytics, we will update this page and the Cookie Policy before doing so, and we will say clearly on this page what changed. Where the change requires your consent, we will ask for it.

Privacy questions, and requests about your information, go to kimi@alsadaany.com. Please mark them “Privacy” so they reach the right person quickly.

Controller

Alsadaany Industries

Country

Egypt

Email

kimi@alsadaany.com