Privacy Policy

This Privacy Policy explains what personal data we collect, how we use it, the choices you have, and your rights. It applies to our websites, apps, and services (the "Service"). Capitalised terms used but not defined here have the meanings in our Terms of Service.

• We collect only what we need to run Qiraa: account details, limited billing metadata from Stripe, in-app items (e.g., saved passages, notes, recents), short audio snippets you choose to record for matching, and basic device/usage data.
• Payments: handled by Stripe; we do not store full card numbers, CVC, or bank account details.
• Emails: you'll receive essential transactional emails (e.g., sign-in, 2FA, security, receipts, critical announcements). Newsletters are opt-in and can be unsubscribed at any time.
• You can access, correct, export, or delete your data, and object to or restrict certain processing.
• We keep data only as long as needed or required by law, and use security measures to protect it.

• A) Account data (you provide)

  • Email, first name, last name, password (stored as a one-way hash)
  • Profile preferences (e.g., interface settings).

• B) In-app content

  • Saved items, notes, bookmarks, recent activity, and any other content you store in the app.

• C) Audio data (optional)

  • Short microphone snippets you record for recognition/matching or other in-app activities. These are processed to PCM and retained only as necessary for the Service (see Retention).

• D) Billing & donations metadata (via Stripe)

  • Stripe customer ID, donation amounts/currency, timestamps, invoice/charge IDs, outcome codes (refund, chargeback, etc.).
  • We do not collect or store full payment card numbers, CVC, or bank account details. Those are collected and stored by Stripe.
  • You can view Stripe's privacy and terms here.

• E) Device & usage data (automatic)

  • Log data (e.g., IP address, device type, app version, pages/screens visited, time stamps), crash diagnostics, and basic event telemetry for reliability and security.
  • Generic analytic data such as device types, pages/screens visted do not link back to your account. They are used as indicators to help us improve our services, e.g. allocating more recourses towards certain services.

• F) Cookies and similar tech

  • Strictly necessary cookies for authentication and security across qiraa.ai subdomains.
  • Optional analytics/marketing cookies only with your consent (if enabled).

• G) Sources

  • Directly from you; automatically through the Service; from Stripe and other processors we use to operate Qiraa.

Balancing test (legitimate interests). Where we rely on legitimate interests, we only process data that is necessary, implement safeguards (e.g., pseudonymisation, opt-outs), and balance against your privacy interests.

• Transactional/service emails. We send essential emails to operate your account (e.g., sign-in links, two-factor codes, security alerts, receipts, and critical service announcements). These are not marketing and you cannot opt out while keeping an active account.
• Newsletters/marketing. Sent only if you opt in. Unsubscribe anytime via the link in the email or in settings. We maintain a minimal suppression list to honour opt-outs.
• In-app notifications may be used for important messages or in-app features, e.g. reminders.

We do not sell your personal data. We share it only with:

• Processors that help us run Qiraa (e.g., hosting, storage, email & notification providers, analytics, error reporting).
• Stripe for payments. Stripe acts as our payment processor and independent controller for some activities.
• Legal & compliance recipients (law enforcement or regulatory bodies) when required by law.
• Business transfers. If we're involved in a merger, acquisition, or sale of assets, we'll continue protecting your data and notify you of any changes to this Policy.

All processors are bound by contracts requiring appropriate security and privacy protections.

Your data may be processed in countries other than where you live. Where required, we use appropriate safeguards (e.g., Standard Contractual Clauses and the UK IDTA) and assess local laws to ensure an equivalent level of protection.

We keep data only for as long as necessary for the purposes described or as required by law:

• Account & in-app data: while your account is active. Deleted upon request or after published inactivity periods.
• Audio snippets: retained only long enough to perform matching and service integrity; thereafter deleted or anonymised.
• Billing metadata: retained for 6-7 years to comply with tax and audit obligations. Kept indefinately for active account.
• Logs & diagnostics: short, rolling retention unless needed for security or investigations.
• Marketing suppression list: kept to honour your opt-out.
• Analytic Data: Usually kept for 1-3 months but is not tied to user accounts. kept anonymised.

Depending on your location (e.g., UK/EU/EEA), you may have the right to:

• Access a copy of your data.
• Correct inaccurate data.
• Delete your data ("right to be forgotten").
• Restrict or object to certain processing (including where we rely on legitimate interests).
• Portability of data you provided to us.
• Withdraw consent at any time (where processing is based on consent).
• Lodge a complaint with a supervisory authority (e.g., the UK ICO at ico.org.uk).