Privacy Policy

Last updated: 25 October 2026

1. Controller

The controller is the commercial-registration entity (name added after registration), CR no. added after registration, national address: added after registration, the entity that provides NAHJ. Privacy contact: [email protected].

2. How we collect data

From you (sign-up, your ideas and evidence, payments, messages to us); automatically while you use NAHJ (request counts, activity days, a short device and country fingerprint, for abuse prevention and new-device alerts — no advertising identifiers or third-party trackers); and, at your choice, from Google, Microsoft or Apple sign-in (email and name only) and the app stores (subscription status only).

3. What we collect, why, and on what basis

Title, first and last name — to address you and issue certificates (contract). Mobile number — verification and one free trial per number (contract; legitimate interest in preventing fraud). Email when you reserve a founders’ number on the website — to hold the number and send one launch-day email if you asked for it (consent). Email — sign-in, outputs, notices (contract). Birth year and stage — to adapt the experience (contract). School email or student-card photo — only for NAHJ Student; the photo is deleted once reviewed, within 60 days at most, and at once if you delete your account (contract, at your request). Password, hashed with PBKDF2 (contract). Consent records (legal obligation). Projects and evidence (contract). Showcase entry and public portfolio (consent). Activity days (contract). Rating, comment and reports — rating is optional (consent). The text of Fahim’s reply when you ask for voice (consent, asked before first use). Certificate data (contract). Payment records and invoice numbers, no card details (contract; legal obligation). Limited technical data (legitimate interest: security). Updates and reminders (separate consent). The weekly guardian report (consent). Where we rely on legitimate interest we have documented a balancing assessment, and you may object by emailing us.

4. Processors and search recipients

Cloudflare (hosting, storage, the NAHJ engine, and Workers AI for Fahim’s conversation and voice after your consent); Anthropic (Fahim’s model on Pro and Max when enabled, after your consent; receives your question, the conversation and what your project shows, never your name or email, and does not train on it); ElevenLabs (Fahim’s voice, after your consent); Resend (emails); Meta WhatsApp and Twilio (codes and opted-in reminders); Tap Payments (payments); the App Store, Google Play and RevenueCat for in-app purchases only (subscription status and an anonymous ID; no payment details); Google, Microsoft and Apple (email and name only when you choose their sign-in). Search engines — research databases (OpenAlex, Semantic Scholar, Crossref, arXiv, PubMed, Europe PMC, DOAJ, Zenodo, HAL, CORE, ERIC, NASA ADS, ClinicalTrials.gov, the Library of Congress, GitHub, Google Patents), Google Scholar through SerpAPI, and web search through Exa — receive search keywords only, never your idea or identity.

5. Transfers outside Saudi Arabia

Some processors handle data outside the Kingdom. We transfer only the minimum needed to perform the service you asked for, under the Personal Data Protection Law and the Regulation on Personal Data Transfer outside the Kingdom, after a documented risk assessment.

6. Retention

Accounts and projects until you delete them, and automatically after two years without use; sessions 30 days (guests 12 hours); guest projects 2 days; codes 10 minutes; ratings, reports and the admin audit log 2 years; certificates until you delete your account; a keyed fingerprint of your mobile number (it does not reveal the number) recording that the free project was used, 2 years, even after deleting the account; payment records and invoices for the period required by the commercial-books, zakat and tax laws, even after deleting the account, then deleted.

7. Your rights

Under Saudi Arabia’s Personal Data Protection Law: to be informed; to access and get a copy in a common electronic format (“Download all my data”); to correct; to erase (delete your account instantly); to withdraw consent (turn off updates, voice, showcase or the guardian report in “My account” or via the stop link in any message, free and immediate); and human review of any automated answer you report. We answer within 30 days (extendable by 30 days for complex requests, with notice) and log every request. You may complain to the Saudi Data and AI Authority (SDAIA).

8. Automated decisions

The verdict on your idea comes from the NAHJ engine’s published fixed rules and is shown with its trace. It is guidance for your project; no decision with legal effect on you is made by automated processing alone, and you can ask for human review.

9. Users under 18

The parent or guardian of a user under 18 is responsible for them, and accepting the Terms at sign-up counts as the guardian’s consent to this policy and the processing described in it (Terms, section 2). Children’s data gets extra protection: no ads or tracking, and nothing of theirs appears in the public showcase unless they ask, after a human review, with their first name only. A guardian may ask to see or delete their child’s data, or switch off any feature, at any time by emailing us.

10. Messages

Updates and reminders go only to people who agreed separately, at most one a week, each with NAHJ’s name and a free stop link. Verification codes, security alerts and plan-ending reminders are part of the service.

11. Security

HTTPS everywhere; PBKDF2 password hashing; two-step sign-in and an audit log for the admin panel; new-device alerts. If a breach affects your data, we notify SDAIA within 72 hours of learning of it and tell you without undue delay.

12. AI

We never use your data or ideas to train any model. Reading your idea, searching and the verdict run on the NAHJ engine’s fixed rules without generative AI. An AI model is used only for Fahim’s conversation and voice, after your consent, and receives your question, the conversation and what your project shows, never your name, email or phone. You can withdraw in My account.

13. Changes

We show the last-updated date above and tell you about material changes.

14. Contact

the commercial-registration entity (name added after registration), CR no. added after registration, national address: added after registration. [email protected]