Privacy Policy

1 Scope of this policy

This policy applies to the personal data Roundout Company processes through Roundout: the desktop app for Microsoft Flight Simulator 2024, the website roundout.io with its customer portal, and the online services the app uses for licences, landing sync, updates and airport data. Roundout was first released as FLARE, and this policy also covers the data from that time.

It does not apply to: (a) Roundout Company's own website, roundout.sa, which has its own privacy policy; (b) the payment you make at checkout, which Paddle processes as merchant of record under its own privacy policy; (c) Microsoft Flight Simulator, which Microsoft runs under its own terms; or (d) other websites we link to.

2 The controller and how to contact us

The controller of your personal data is:

Name

Roundout Company

Legal form

Limited liability company

Commercial Registration (unified number)

7055349612

Email

privacy@roundout.io

For any question or request about your personal data, email privacy@roundout.io, from the address on your account if you have one. Privacy requests reach the person responsible for personal data protection at Roundout. Our Contact page has the company's details too.

3 Definitions

Words in this policy have the meanings the Personal Data Protection Law and its regulations give them, including:

The Law

The Personal Data Protection Law issued by Royal Decree No. (M/19) dated 9/2/1443H and amended by Royal Decree No. (M/148) dated 5/9/1444H, with its Implementing Regulations and the Regulation on Personal Data Transfer outside the Kingdom.

The Authority

The Saudi Data and Artificial Intelligence Authority (SDAIA), the competent authority for the Law.

Personal data

Any data, whatever its source or form, that identifies you or makes it possible to identify you directly or indirectly, such as your email address, your IP address or your licence key.

Processing

Any operation on personal data, by any means, including collecting, recording, storing, using, disclosing, transferring and destroying it.

Controller and processor

The controller decides why and how personal data is processed: here, Roundout Company. A processor processes it on the controller's behalf, such as our service providers.

Roundout, the app, the website

As defined in our Terms of Service.

4 The personal data we collect

We collect only what we need for the purposes in this policy. You can read the website without giving us anything; an account is needed to buy, activate and sync.

5 Cookies and browser storage

The site sets only the cookies it needs to work, such as keeping you signed in and remembering your cookie choice, unless you accept analytics or marketing cookies in the cookie settings. It uses no advertising or cross-site cookies. It also keeps two short notes in your browser's own storage. The Cookies page lists every cookie and both notes, what each is for and how long it lasts, and you can change your choice at any time.

6 Purposes and legal grounds

We process personal data only for these purposes, on the grounds the Law allows:

• Running your account, your licence and the app's online services (account, purchase, licence, device and landing data): carrying out the agreement you are a party to, our Terms of Service.
• Showing what you choose to share (public profile, leaderboards, shared landings, debriefs): your consent, which you give by turning each one on, and withdraw by turning it off.
• Answering your messages and support requests: carrying out our agreement with you, or, if you have no account, your consent expressed by writing to us.
• Sending product news, only if you ask for it: your consent, which you can withdraw in one click.
• Keeping the Roundout Pro waiting list, only if you join it: your consent, which you withdraw by leaving the list.
• Counting visits with our analytics cookie, and noting which campaign link brought you, only if you accept each in the cookie settings: your consent, which you can withdraw there at any time.
• Sending personal invitations, and seeing whether each one reaches the person it was written for (the invitation, and the time, IP address, browser, approximate location and referring page of each opening): our legitimate interest in offering licences to people we choose, telling whether an invitation was opened and its licence used, and noticing when its link has been passed on.
• Protecting the service, preventing fraud and key sharing, keeping security records, and counting visits in aggregate without cookies (technical, security and device data): our legitimate interests in running the service and in protecting network and information security and detecting fraud, which the Implementing Regulations recognize, without prejudice to your rights or conflict with your interests, and without processing any sensitive data.
• Building and testing new versions of the service on a private copy that only our team can open, in which names and email addresses are replaced: our legitimate interest in improving the service, limited to what testing needs.
• Meeting our legal obligations (purchase records, and any data a competent authority lawfully asks for): processing that another law requires.

We will not use your data for a purpose that doesn't fit the ones above before telling you, and asking for your consent where the Law requires it.

7 Sharing and disclosure

Your data is seen only by our team members who need it for the purposes above, who are bound by confidentiality. Outside the company we share it only with:

• Service providers that process data on our behalf (processors): hosting and storage, network protection and content delivery, bot protection, email delivery, error monitoring, our company mailbox, and a separate mailbox for our addresses from before the change of name. They work under terms that oblige them to protect it. Some also use limited technical data, such as security signals and delivery logs, to run and secure their own services.
• AI assistants that help our team with support and with running the service, which also process data on our behalf. When one helps with your request, it may see your messages to us and the records of yours the request needs, such as your account, licences, orders and landings. When one helps run the service, it sees our code and the service's logs, which can hold an IP or email address. We set each of them not to use what it sees to train its models.
• Paddle, our merchant of record, which sells you the licence and is the controller of the payment data you give at checkout. We send it what it needs to handle a refund or a question about your order.
• A reseller, if you bought your key from one: it already holds your purchase, and we contact it about your key only if a refund or a problem with that key needs it.
• The company you sign in with, if you choose to sign in with an account from Google or Microsoft. That company knows you signed in to Roundout.
• Other pilots and the public, only what you choose to share: your public profile, your place on the leaderboards, a landing you share, and your landings in a debrief you accept.
• Professional advisers, such as lawyers and auditors, where needed, under a duty of confidentiality.
• Competent authorities, where a law, a judgment or an order requires it.
• A successor, if the Service passes to another company, which must then respect this policy and your rights.

We don't sell, rent or trade personal data, and we don't share it with anyone for their marketing or for advertising. On request, we give you the names of the service providers that process your data.

8 Transfers outside the Kingdom

Our servers are outside Saudi Arabia, and so are most of the service providers in the section above, some of them in several countries: those for hosting and storage, network protection and content delivery, bot protection, email delivery, error monitoring, our two mailboxes, and the AI assistants that help our team.

Each of them handles your data under the data protection terms it offers its customers.

We follow the Regulation on Personal Data Transfer outside the Kingdom, and will review these transfers and this section as the Authority settles its rules. You can ask us which providers these are, where they process your data and the terms they work under.

9 How long we keep your data

We keep personal data only as long as its purpose needs, then destroy it. Most of this runs by itself every day:

We keep data longer only where a law requires it, until that period ends, or where it is needed for a case before a court, until the case is over. Destruction includes backups, and we ask the providers that hold a copy to destroy theirs.

10 How we protect your data

We apply organizational, administrative and technical measures suited to the nature and sensitivity of the data, including:

• encrypting every connection to the website and between the app and our servers;
• storing passwords only as a deliberately slow one-way hash that nobody, us included, can read back, and offering two-step sign-in and passkeys on every account;
• signing the licence our servers give the app, so it can't be forged, and keeping your full licence key off your PC;
• limiting access to our servers and to your data to the team members who need it, and recording what our team does in customer accounts;
• keeping security records of sign-ins and licence events, so we can spot and stop misuse;
• backing up the database every night and deleting each backup after 30 days; and
• choosing service providers whose terms oblige them to protect data, and reviewing our measures regularly.

No transmission or storage of data is completely secure. If personal data is leaked, damaged or accessed unlawfully in a way that may harm you, we notify the Authority within 72 hours of becoming aware of it, notify the other competent authorities where the law requires, and tell you without undue delay, in plain language, what happened, what we have done and what you can do to protect yourself.

11 Your rights

The Law and its regulations give you these rights:

• To be informed of the legal ground and the purpose for collecting your data, which this policy does.
• To access the personal data we hold about you.
• To obtain a copy in a readable, commonly used format. The portal's Export my data gives you, at any time, your account and its email addresses, licences and their history, orders, PCs, sign-ins, support requests and their messages, email preferences, your place on the Roundout Pro waiting list and the main details of your landings; the landing pages export each landing in full. For a copy of everything else we hold, such as your debriefs, your achievements and your handle, write to us.
• To have it corrected, completed or updated, and to have its processing restricted while its accuracy is checked. You can change most details yourself in the portal.
• To have it destroyed when it is no longer needed, apart from what the law requires us to keep. Deleting your account in the portal does this for your account, apart from the records the table above says outlast it.
• To withdraw your consent at any time, as easily as you gave it, without affecting what was done before.

To use any of these rights, email privacy@roundout.io from the address on your account. We record every request, and may ask for information to confirm it is you, which we use for nothing else. Requests are free.

We reply within 30 days. We may extend that by up to 30 more days if a request needs unusual effort or you send several, and if so we tell you why before the first 30 days end.

We may refuse a request in the cases the Law sets, for example where it is repeated without reason, would harm others, or where a law requires us to keep the data. If we refuse, we tell you why.

12 If you live in the European Economic Area, the United Kingdom or California

The data protection laws of the European Union and the United Kingdom (the GDPR and the UK GDPR) and of California also protect you. Under them, the grounds in the purposes section are, respectively: performance of a contract, consent, our legitimate interests (which you may object to), and a legal obligation.

You have the rights listed above, and also the right to object to processing based on our legitimate interests, to have your data moved to another service in a machine-readable format, and to complain to the data protection authority where you live or work. Under California law you also have the right to know, to delete and to correct, and the right to opt out of the sale or sharing of personal information: we neither sell it nor share it for advertising. We never treat you differently for using these rights.

13 Complaints

If you are not satisfied with how we handle your data or your request, please write to us first, so we can try to put it right.

You have the right to complain to the Saudi Data and Artificial Intelligence Authority through the National Data Governance Platform within 90 days of the incident or of learning of it, and to claim compensation before the competent court for damage a breach of the Law causes you. If you live in the European Economic Area or the United Kingdom, you may also complain to your data protection authority.

14 The emails we send you

Some emails always go out: your receipt and licence key, mail about a revoked, refunded or transferred licence, and security mail such as password resets, email codes and changes to your email, password, two-step sign-in, passkeys or connected accounts.

You choose the others in the portal, under Settings, Notifications: replies to your support requests, licence changes and end reminders, PC warnings, new sign-in alerts and debrief emails. They are on until you turn them off.

We may also email every licence holder a notice about a change to the service, such as a new name or address, or new terms. Those reach you whatever your settings, and may also mention what's coming next.

Product news reaches you only if you turn on Product updates in the portal, and every one includes a way to stop it. We never send marketing for anyone else, and we stop within 24 hours of being asked.

15 Automated decisions

The app scores and grades your landings automatically: that is what Roundout does, and the scores have no legal or similarly significant effect on you. Automated checks also protect the service, for example by limiting how many PCs a licence runs on and how often a key can be replaced. A licence is revoked automatically when its payment is refunded or charged back; any other suspension, pause or revocation is decided by a member of our team, and you can ask us to look at it again.

16 Minors

Accounts and licences are for people aged 18 or over, the age of majority under the Civil Transactions Law. Someone younger may use the app only through an account their parent or legal guardian holds, with the guardian's consent. We don't knowingly collect personal data directly from anyone under 18 without that consent. If you learn that we have, tell us at privacy@roundout.io and we will destroy it.

17 Changes to this policy

We review this policy regularly and update it when our practices or the law change. We publish the new version here with its date. If a change is material, such as a new kind of data or a new purpose, we email you at least 30 days before it takes effect, and ask for your consent where the Law requires it.

Update record:

• 1 November 2026: named the AI assistants that help our team and what they may see, a coupon code kept with its order, the mailbox for our addresses from before the change of name, the check of your password when you sign in, and why we record each opening of an invitation; and said only what we can show about transfers outside the Kingdom.
• 1 November 2026: added what we keep when you join the Roundout Pro waiting list.
• 1 November 2026: checked again against version 1.3.0 of the app and the website: where the app keeps your data, how a PC gets its name, what the site keeps in your browser, the records of our team's and your own actions, and which emails you choose.
• 30 October 2026: rewritten for Roundout Company with the change of name, with every statement checked against what the app and the website do.
• 24 September 2026: the last version before the change of name.