Privacy Policy

1. Summary of Key Points

What personal information do we process? Personal information you provide (such as name, email, billing address, and account data) and information collected automatically (such as IP address, usage data, and cookies).

Do we process sensitive personal information? No.

Do we receive information from third parties? We may receive limited information from social login providers, analytics services, and public sources.

How do we process your information? To provide, improve, and secure the Service, process payments, communicate with you, and comply with law.

Do we sell personal information? No.

What are your rights? EU/UK/Swiss and U.S. state residents have specific rights described below.

2. Information We Collect

3. How We Process Your Information

• Provide the Service: deliver access to prompts, guides, and platform features
• Account management: authenticate you and manage your account
• Process payments: complete transactions via payment providers
• Communicate: send service messages, respond to support requests, and (with consent) marketing communications
• Improve the Service: analyze usage to improve features (aggregated / anonymized where possible)
• Security and fraud prevention: protect the Service and users from abuse and fraud
• Legal compliance: comply with legal obligations, court orders, or lawful requests

4. Legal Bases for Processing (GDPR)

If you are in the EEA, UK, or Switzerland, we rely on:

• Contract performance (Art. 6(1)(b)): to deliver the Service you purchased
• Consent (Art. 6(1)(a)): for marketing and optional cookies
• Legitimate interests (Art. 6(1)(f)): for service improvement, security, and fraud prevention
• Legal obligations (Art. 6(1)(c)): where required by law (e.g., tax records)

5. Sharing of Personal Information

We share information with:

• Service providers (processors): hosting, payment processing, email delivery, analytics, customer support — under written data-processing agreements meeting GDPR Article 28 requirements
• Business transfers: in connection with a sale or transfer of the business or its assets
• Legal requirements: when required by law, court order, or governmental authority
• With your consent: in other circumstances with your explicit consent

We do NOT sell personal information and do not share it for cross-context targeted advertising under U.S. state privacy laws.

6. Cookies and Tracking

We use cookies and similar technologies for authentication, preferences, analytics, and (with consent where required) marketing. You can manage cookies via browser settings or our cookie preference manager. We honor the Global Privacy Control (GPC) signal where required by applicable law.

7. Social Logins

If you register using a social login (Google, Apple, etc.), we receive the profile information you authorize that provider to share. We are not responsible for the social provider's practices. Your use of that account is governed by its own terms.

8. International Data Transfers

The Service is hosted on infrastructure operated by the Operator and its service providers, which may be located in the United Arab Emirates, the European Union, the United States, and other countries. If you access the Service from outside your country of residence, your personal information may be transferred to, stored, and processed in countries other than your own, including countries that may not have the same level of data protection as your home jurisdiction.

For transfers of personal data originating in the European Economic Area (EEA), the United Kingdom, or Switzerland to countries that have not received an adequacy decision from the European Commission (including the United States, in certain cases), we rely on appropriate safeguards, such as:

• Standard Contractual Clauses approved by the European Commission (Module 2 or Module 3 as applicable)
• The EU-U.S. Data Privacy Framework, where the relevant U.S. service provider is self-certified
• Your explicit consent for specific transfers, where appropriate

By using the Service, U.S. residents acknowledge that their data may also be transferred to and processed in the United Arab Emirates and other countries within the European Economic Area.

9. Data Retention

We retain personal information only as long as necessary for the purposes it was collected, typically:

• Account data: while your account is active, plus up to 3 years after closure for legal/accounting purposes
• Transaction records: as required by applicable UAE tax and accounting law (currently 10 years for invoices)
• Usage analytics: anonymized data retained up to 24 months
• Marketing lists: until you unsubscribe

10. Data Security

We implement technical and organizational measures under Article 32 GDPR, including encryption in transit, access controls, and secure hosting. No method is 100% secure; we cannot guarantee absolute protection.

11. Data Breach Notification

In the event of a breach likely to result in high risk to your rights, we will notify you and the relevant EEA/UK data protection supervisory authority, or the UAE Data Office in accordance with Articles 33–34 GDPR. For U.S. users, we will provide notice as required by applicable state laws.

12. Children's Privacy

The Service is not directed to children under 13 (or the applicable age of digital consent in the EEA under Article 8 GDPR). We do not knowingly collect data from children under these ages without verified parental consent. See the COPPA section under U.S. State Privacy Rights.

13. EU/UK/Swiss Privacy Rights

Under the GDPR, UK GDPR, and Swiss FADP, you have the right to:

• access your personal data (Art. 15)
• rectify inaccuracies (Art. 16)
• request erasure (Art. 17)
• restrict processing (Art. 18)
• receive data in a portable format (Art. 20)
• object to processing (Art. 21)
• not be subject to automated decisions with legal effects (Art. 22)
• withdraw consent at any time
• lodge a complaint with the relevant EEA/UK data protection supervisory authority, the UAE Data Office, or your EU Member State supervisory authority

To exercise these rights, email [email protected]. We respond within one month, extendable by two months for complex requests.

14. U.S. State Privacy Rights

We offer the Service to residents of the United States. Depending on the state in which you reside, you may have additional privacy rights under applicable U.S. state privacy laws. As of the effective date of this notice, comprehensive state privacy laws have been enacted in California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Delaware, New Hampshire, New Jersey, Tennessee, Nebraska, Maryland, Minnesota, Rhode Island, Indiana, and Kentucky, among others.

15. Marketing Communications

You can opt out of marketing at any time by clicking unsubscribe in our emails or contacting us. We may still send service-related messages necessary for account administration.

16. Do Not Track

We honor the Global Privacy Control (GPC) signal. No uniform DNT standard exists, but we treat GPC as a valid opt-out signal for sale/sharing under U.S. state privacy laws, where applicable.

17. Changes to This Notice

We may update this notice. Material changes will be posted with an updated “Last updated” date, and where appropriate, direct notification by email.

18. How to Review, Update, or Delete Your Data

You can access and update account information through your account settings, export your data, or request deletion by emailing [email protected]. We respond in accordance with applicable law.

19. Contact