Privacy Notice

1. Who we are

Qanuni AI is operated by Plany plus Events Organization & Management ("we", "us"), which acts as the data controller for personal data processed through the service.

2. Personal data we collect

• Account data: full name, email address, password hash, language preference, profile picture (if provided via Google sign-in).
• Service content: chat messages, uploaded documents and contracts, generated documents and letters, conversation history.
• Usage and telemetry: features used, request counts, credit consumption, error logs.
• Device and connection data: IP address, browser type, device identifiers, approximate location derived from IP.
• Support communications: messages you send to our support channel.

Payment and billing details (card data, billing address, tax ID) are collected directly by Paddle and not by us.

3. Why we use it

• Account creation and authentication — performance of our contract with you.
• Providing the AI legal assistant (chat, analysis, generation, search) — performance of contract.
• Security, fraud, and abuse prevention — our legitimate interests in protecting the service.
• Product improvement and analytics (in aggregated/anonymised form) — legitimate interests.
• Customer support — performance of contract.
• Legal compliance — to comply with applicable laws, court orders, and regulatory requests.
• Marketing communications — only with your consent, which you can withdraw at any time.

4. Who we share data with

• Merchant of Record: Paddle.com, which processes payments, manages subscriptions, calculates taxes, and issues invoices on our behalf.
• Hosting and infrastructure: Supabase and Cloudflare for database, authentication, storage, and edge compute.
• AI providers: the Lovable AI Gateway (which routes requests to large-language-model providers such as OpenAI and Google) to generate responses based on your prompts and documents.
• Identity providers: Google, when you choose to sign in with Google.
• Authorities: where required by law, court order, or to protect rights and safety.

We do not sell personal data.

5. International transfers

Some of our service providers (including AI model providers and hosting infrastructure) are located outside the United Arab Emirates, including in the United States and the European Economic Area. Where personal data is transferred internationally we rely on appropriate safeguards (such as Standard Contractual Clauses or equivalent mechanisms) and on the providers' security commitments.

6. Retention

We keep personal data for as long as your account is active and as needed to provide the service. After account closure we delete or anonymise personal data within a reasonable period, except where we are required to keep it longer to comply with legal, tax, or accounting obligations, or to defend legal claims. Uploaded documents and generated outputs are retained until you delete them or your account is closed.

7. Your rights

Subject to applicable law (including the UAE Personal Data Protection Law and, where applicable, the EU/UK GDPR), you may have the right to: access your data, correct inaccurate data, request deletion, restrict or object to processing, request data portability, withdraw consent, and lodge a complaint with a competent supervisory authority. To exercise these rights, contact us through the support channel inside the app; we aim to respond within one month.

8. Security

We use appropriate technical and organisational measures to protect personal data, including encryption in transit, access controls, role-based permissions, row-level database security, and audit logging. No system is perfectly secure; you must keep your credentials confidential.

9. Cookies and similar technologies

We use strictly necessary cookies and local storage to keep you signed in and to remember your language and preferences. We do not use advertising cookies. You can manage cookies and local storage through your browser settings; disabling them may prevent the service from functioning correctly.

10. Children

The service is not directed to children under 18 and we do not knowingly collect their personal data.

11. Changes

We may update this notice. Material changes will be communicated through the service or by email.

12. Contact

Plany plus Events Organization & Management — for privacy questions or to exercise your rights, contact us through the support channel inside the app.