ustaad

Privacy Policy

This policy explains what [COMPANY LEGAL NAME] does with personal data when you use Ustaad. It is written for the GDPR because we offer Ustaad to people in the European Union. The database runs in Frankfurt. The company is registered in Pakistan.

1. Controller

Controller: [COMPANY LEGAL NAME], [REGISTERED ADDRESS], registration no. [REGISTRATION NO.]. Privacy contact: privacy@ustaad.io. Legal contact: legal@ustaad.io.

EU representative under GDPR Article 27: [EU REPRESENTATIVE NAME], [EU REPRESENTATIVE ADDRESS]. Write to them if you are in the EU and you want a contact inside the Union. They will pass the request to us.

2. What we collect

We keep the set small.

  • Account: email, handle, display name, bio, settings, the time you confirmed you are 16 or older, the time you accepted the Terms and the terms version, and, if you confirm it, the time you confirmed you are 18.
  • Content you submit: questions, answers, photos you post, comments, event details, and messages.
  • Optional profile links you add for Instagram, Facebook, or TikTok. We store only a validated https profile URL.
  • A session cookie, HttpOnly, used to keep you signed in.
  • If you opt in, a web-push subscription. The notification text is generic. It does not include the question.
  • For an anonymous question: a salted HMAC of the IP address, not the IP itself, kept for 30 days and then deleted; a separate fingerprint used only to count whether that sender signal asked before, also cleared after 30 days; country, city, and device type only when the network actually sent them.
  • An anonymous receipt is a random token shown once. We store only its hash so the asker can open the answer later.

We do not ask for a legal name, a government ID, or a precise GPS location. We do not sell personal data.

3. Who-asked hints

If you ask anonymously, the recipient does not receive your name, email, or account. Premium can later show honest hints, and only these: country or city if an edge header was present, a coarse device type, the time the question was sent, and a count of whether that sender signal asked before. If a signal was not sent, the hint stays blank. We do not guess, and we do not fill a blank with a likely city. Named questions show the handle you chose to attach, and they do not store country or city.

4. Purposes and legal bases

  • Account, inbox, answers, and messages: contract, GDPR Art. 6(1)(b).
  • Age and terms acceptance: legal obligation and contract, Art. 6(1)(b) and (c).
  • IP hash, fingerprint, rate limits, moderation, and the audit log: legitimate interests in safety and abuse prevention, Art. 6(1)(f). You can object. We may still keep a record where we must defend a legal claim or comply with a lawful order.
  • Hint notice, optional push, and optional social profile links: consent, Art. 6(1)(a). You can withdraw push consent in the browser, and you can clear the profile links in Settings.
  • Premium billing records, when checkout is on: contract and legal obligation, handled by Paddle as merchant of record.

5. How long we keep it

These periods match the running product.

  • Magic-link tokens expire after 15 minutes and the rows are deleted about a day after expiry.
  • Sessions last 30 days and are deleted when they expire.
  • The IP hash is nulled 30 days after the question is sent. The repeat fingerprint is nulled when the question is older than 30 days.
  • Rate-limit counters are deleted after 2 days.
  • Translation cache rows are deleted after 14 days, and the cache is capped at 5,000 rows.
  • Questions blocked by the safety filter are deleted after 90 days.
  • Account content, messages, and the moderation audit log stay until you delete the account or we delete them in a moderation or legal process. The audit log itself is not on an automatic timer, because we need the timestamp of a removal.

Deleting your account in Settings removes the user and detaches named questions so the handle is not left hanging on them.

6. Processors

  • Supabase, database in Frankfurt, stores the application data.
  • Vercel hosts the application.
  • Cloudflare Turnstile, if keys are set, checks that a send or sign-up is not a bot.
  • An AI provider, only if a Gemini or Groq key is set, screens text and images. The prompt is the content being checked. If no key is set, screening stays on the server with a local word list.
  • Paddle, when Premium checkout is enabled, is the merchant of record for the subscription.
  • The email provider, currently Resend if a key is set, sends magic links.
  • Photo files, when storage keys are set, go to Cloudflare R2 or Supabase Storage. The demo keeps them on the server disk and does not ship them to a vendor.

7. International transfers

Production data sits in Frankfurt. Pakistan, where the company is registered, does not have a European adequacy decision. If a transfer of EU personal data outside the EEA is needed, we use the European Commission’s standard contractual clauses. You can ask privacy@ustaad.io for a copy of the relevant safeguards.

8. Your rights

You can ask for access, correction, deletion, restriction, and a portable copy, and you can object to processing based on legitimate interests. Export and delete are in Settings. You can also email privacy@ustaad.io. We respond within one month.

You can complain to a supervisory authority where you live, including anywhere in the EU.

9. Cookies

We use a session cookie and, if you ask us to remember an anonymous receipt on that browser, a receipt cookie. Both are HttpOnly and SameSite. We do not run advertising cookies. Turnstile may set its own cookie when it is enabled.

10. Children

Ustaad is not for anyone under 16. We do not knowingly create an account for a child. If we learn that we have, we delete it. Write to privacy@ustaad.io.

Deutsch, kurz

Verantwortliche Stelle ist [COMPANY LEGAL NAME] in Pakistan. Die Datenbank steht in Frankfurt. Die DSGVO gilt, weil sich das Angebot an Menschen in der EU richtet. Ein Vertreter nach Art. 27 DSGVO wird unter [EU REPRESENTATIVE NAME], [EU REPRESENTATIVE ADDRESS] benannt. Anonyme Fragen speichern keinen Namen. Hinweise sind nur tatsächlich empfangene Signale. Unter 18 bleiben private Nachrichten aus. Du hast die üblichen Betroffenenrechte und kannst dich bei einer Aufsichtsbehörde beschweren.