Privacy Policy — Noor by Sawt Tech

This Privacy Policy describes how Sawt Technology and Marketing LLC ("Sawt Tech", "we", "us", or "our"), operating from Muscat, Sultanate of Oman, collects, uses, and protects your personal data when you use Noor — our personal AI assistant available at app.sawt.tech.

Noor's use of information received from Google APIs — including Gmail, Google Calendar, and Google Contacts — adheres to the Google API Services User Data Policy, including the Limited Use requirements.

1. Information We Collect

We collect the following categories of information:

Account information: your name, email address, and authentication credentials when you sign in via Google, Apple, or email/password.
Profile preferences: language preference, communication style, timezone, gender (for bilingual grammar), and optional professional background — all provided by you during onboarding.
Usage data: message count, subscription plan, trial status, and session timestamps — used to manage your plan limits.
Google account data (only when you explicitly connect Google in Settings):
- Gmail: email subjects, senders, and bodies — read only when you ask Noor to retrieve or act on specific emails.
- Google Calendar: event titles, times, and attendees — read and written only in response to your explicit instructions.
- Google Contacts: contact names and email addresses — read only to help compose emails you request.
Uploaded documents: files you attach to a conversation (PDF, Word, Excel, CSV) — processed temporarily to extract text and generate a response, then discarded.
Payment data: subscription transactions are processed by PayTabs. We store only a transaction reference and plan status; we never store card numbers or banking details.

2. How We Use Your Information

To provide and personalise the Noor assistant experience based on your preferences.
To read, draft, or send emails, create or update calendar events, and look up contacts — only when you explicitly instruct Noor to do so.
To enforce subscription plan limits and manage billing.
To send you transactional emails (welcome message, billing receipts). We do not send marketing emails without your consent.
To maintain the security and reliability of our services.

3. Google API Data — Limited Use Disclosure

Noor's access to your Google account data is strictly limited to what is necessary to respond to your in-session requests. We do not use Google data to serve advertising, build user profiles beyond your stated preferences, or train AI models. Google data is never shared with third parties except as required to fulfil your request (e.g., sending an email you composed).

You may disconnect your Google account at any time from Settings → Integrations within the Noor dashboard. Upon disconnection, we delete your stored Google access token immediately.

4. Data Retention

Conversation messages are not stored server-side beyond the active session. We do not maintain a chat history database.
Uploaded documents are processed in memory and not saved to disk or cloud storage.
Google tokens are stored encrypted in Firestore and deleted when you disconnect Google or delete your account.
Account and subscription data is retained for as long as your account is active, and for up to 90 days after deletion for legal and accounting purposes.

5. Data Sharing

We do not sell your personal data. We share data only with the following sub-processors, strictly to operate the service:

Anthropic (claude.ai) — processes your messages to generate AI responses. Subject to Anthropic's Privacy Policy.
Google LLC — for Gmail, Calendar, and Contacts access you authorise. Subject to Google's Privacy Policy.
PayTabs — processes subscription payments. Subject to PayTabs' Privacy Policy.
Firebase (Google) — user authentication and database. Data stored in the EU/US region.
ElevenLabs — converts Noor's text responses to voice audio when voice mode is enabled.
Resend — delivers transactional emails (welcome, billing).
Vercel — hosts the application infrastructure.

6. Security

All data is transmitted over HTTPS/TLS. Google access tokens are stored encrypted. Server-side API calls are authenticated using Firebase ID tokens verified by Firebase Admin SDK. We do not log message contents in production.

7. Your Rights

You have the right to:

Access the personal data we hold about you.
Request correction of inaccurate data.
Request deletion of your account and associated data.
Withdraw Google permissions at any time via Settings → Integrations.
Lodge a complaint with a data protection authority if you believe your rights have been violated.

To exercise any of these rights, contact us at privacy@sawt.tech.

8. Cookies

We use a minimal session cookie (noor-uid) to detect whether you are signed in and redirect you appropriately. No third-party advertising or tracking cookies are used.

9. Children's Privacy

Noor is not intended for users under the age of 18. We do not knowingly collect personal data from children. If you believe a child has created an account, please contact us at privacy@sawt.tech and we will delete the account promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email to registered users at least 14 days before they take effect. Continued use of Noor after the effective date constitutes acceptance of the updated policy.

11. Contact

Sawt Technology and Marketing LLC
Muscat, Sultanate of Oman
Email: privacy@sawt.tech
App: app.sawt.tech