Privacy Policy سياسة الخصوصية

01 What we collect

a. Account data

• The name you choose and your email address.
• Your password — stored as a one-way hash that we cannot read.
• Your preferred interface language, account creation date, and email verification status.

b. Conversations and files

• The messages you send and the model responses, stored in your account so you can return to them.
• Files and images you upload for analysis, and the model selected for each conversation.
• Conversation titles and timestamps.

c. Subscription and usage data

• Your current plan, subscription status, renewal or cancellation date, and your Paddle subscription ID.
• Usage counters (daily/monthly message counts per model) needed to apply plan limits.
• Billing history as provided by Paddle — with no card data.

d. Technical data

• IP address, browser type, device and operating system.
• Login times, error and performance logs needed to run and secure the service.

e. Support correspondence

Messages and attachments you send us by email or WhatsApp, retained to follow up on your request.

02 Why we use it

Our legal bases are: performance of our contract with you (running the subscription), legitimate interests (security, abuse prevention, service improvement), legal obligation (tax records), and your consent where it is required.

03 AI providers — where your messages go

Noor does not run models on its own servers. To produce any response, your message text (plus conversation context and any attached files) is sent to the provider of the model you selected:

• OpenAI — ChatGPT / GPT models.
• Anthropic — Claude models.
• Google — Gemini models.
• OpenRouter — a routing service that forwards requests to the right provider for some models.

This processing may happen on servers outside your country, typically in the United States or Europe. Each provider handles data under its own policy. We access them through business APIs which, under those providers' published terms, are not used to train their models by default. We cannot, however, guarantee or change a third party's policy — so we recommend never sending genuine secrets through any AI platform.

04 Payments

All payments are processed by Paddle.com acting as Merchant of Record. At checkout you are handed to Paddle's secure window and your financial details are entered directly with them.

• We never receive, store or see your card number, CVC or expiry date.
• What Paddle returns to us is: subscription status and ID, billing country, amount and currency, and where available the payment method type or last four digits.
• Paddle handles tax and invoicing under its own privacy policy.

05 Other parties we share with

• Hosting and infrastructure providers — to run servers, databases and storage for uploaded files.
• Email delivery provider — to send verification, password reset and subscription notices.
• Competent authorities — where there is a valid legal obligation or court order.

We do not sell, trade or share your personal data with advertisers. If ownership of the service ever transfers, data would transfer with it under this policy's commitments, and we would notify you in advance.

06 Security

• All traffic to the site and apps is encrypted with HTTPS/TLS.
• Passwords are stored using a one-way hash and cannot be recovered by anyone, including us.
• Database and server access is limited to the smallest possible number of authorised people, for operational purposes only.
• We review logs for unusual access and keep backups for disaster recovery.

That said, no system is 100% secure and we cannot offer an absolute guarantee. If a breach materially affects your personal data, we will inform you and notify the relevant authorities where the law requires it.

07 How long we keep data

08 Your rights

At any time you can request:

• Access to the data we hold about you.
• Correction of inaccurate data.
• Deletion of your account and conversations, via the account deletion page or by contacting support.
• A copy of your data in a readable format.
• Objection or restriction of processing where the law allows.
• Withdrawal of consent where processing relies on it, without affecting what was done before withdrawal.

Email support@noorai.chat from the address registered to your account so we can verify you. We normally reply within two business days and complete requests within 30 days at most. There is no charge, unless a request is clearly repetitive or excessive.

Note: deleting your account does not automatically cancel your subscription — cancel first to avoid a further renewal.

09 Cookies

We use as few cookies as possible, and all of them are operational:

We use no advertising cookies and no cross-site tracking cookies. You can clear cookies in your browser settings, but disabling essential cookies will prevent you from logging in. We also use localStorage to remember simple interface preferences, such as the language you chose for reading these legal documents.

10 Children

The service is not directed at anyone under 16, and we do not knowingly collect their data. If we learn that an account belongs to a child under that age, we will close it and delete the data. If you are a parent or guardian and believe your child created an account, contact support@noorai.chat.

11 International transfers

Noor is operated from the Kingdom of Bahrain, but our model, payment and hosting providers may process data in other countries. By using the service you understand that your data may be transferred and processed outside your country of residence under those providers' policies.

12 Changes to this policy

We may update this policy when the service, our providers or legal requirements change. We will update the "Last updated" date at the top of this page and notify active users of any material change affecting their data. If the Arabic and English versions conflict, the Arabic version prevails.

13 Contact us

For any question or request about your privacy or your data: support@noorai.chat. We treat privacy requests as a priority and aim to reply within two business days.