1. Data Controller
The data controller responsible for processing your personal data is:
| Company | BUSINESS BRIDGE INTERNATIONAL BV |
| Address | Vogelenzangstraat 1a/4 2920 Kalmthout, Belgium |
| hello@mynayra.app |
2. Data We Collect
Account Information
- Name (as provided during registration)
- Email address
- Gender (optional)
- Profile avatar selection
- Full name and student ID, if you join as a student at a partner university (see section 9)
Learning Data
- Lesson progress and completed cards
- Quiz results and scores
- Daily streak and XP points
- Course enrollments and preferences
- AI chat messages (used to personalise responses)
Community Data
- Posts and reactions you create
- Community interactions
Technical Data
- Device type and operating system
- App version
- Crash reports (anonymized)
3. Legal Basis (GDPR Art. 6)
We process your personal data under the EU General Data Protection Regulation (GDPR).
- Contract Performance (Art. 6(1)(b)): Processing necessary to provide the Nayra educational service.
- Consent (Art. 6(1)(a)): Optional features such as push notifications and anonymous analytics sharing.
- Legitimate Interests (Art. 6(1)(f)): Service improvement and security.
4. Data Retention
| Account & profile data | Until account deletion |
| Learning progress & XP | Until account deletion |
| AI chat messages | 12 months, then automatically deleted |
| Community posts | Until manually deleted or account deletion |
| Technical logs | 90 days |
| Anonymous analytics | Aggregated: retained indefinitely |
| Class list from a partner university | 30 days after the programme ends |
5. Third-Party Services
We use the following services to operate Nayra:
- Supabase: database, authentication, file storage and backend functions. Hosted in Australia (AWS ap-southeast-2).
- DeepSeek: AI chat responses. Your message and a short summary of your learning progress are sent to DeepSeek to generate the reply.
- Resend: transactional email such as sign-in codes and notifications. Hosted in the EU.
- Firebase Cloud Messaging (Google) and Apple Push Notification service: delivery of push notifications.
- Apple: Sign in with Apple authentication.
- Google: Sign in with Google authentication.
- Vercel: hosting of our website.
Transfers outside the EU
- Our database and the files you upload are hosted in Australia, not in the EU.
- AI chat content is processed by DeepSeek outside the EU.
- Push notification services operated by Apple and Google may process data outside the EU.
- Transactional email is processed in the EU.
- You can avoid the transfer to DeepSeek entirely by not using the AI assistant. Everything else in the app works without it.
6. Data Security
- All data encrypted in transit (TLS).
- Encryption at rest is provided by our hosting platform.
- Row-level security enforced on every database table.
- Access controls and authentication required for all accounts.
- Rate limits and abuse protection on sensitive operations.
- Re-authentication required before a data export or an account deletion.
7. Your Rights (GDPR)
- Right of Access (Art. 15): Request a copy of your personal data
- Right to Rectification (Art. 16): Correct inaccurate or incomplete data
- Right to Erasure (Art. 17): Delete your account and all associated data
- Right to Restrict (Art. 18): Limit how we process your data
- Right to Portability (Art. 20): Receive your data in a portable format
- Right to Object (Art. 21): Object to processing based on legitimate interests
8. Contact & Complaints
| Privacy inquiries | hello@mynayra.app |
You have the right to lodge a complaint with a supervisory authority. EU users may contact their national data protection authority.
Gegevensbeschermingsautoriteit (GBA) Drukpersstraat 35 1000 Brussels, Belgium https://www.gegevensbeschermingsautoriteit.be
9. Partner Universities and Research Sharing
With your consent, given in the app, we share anonymous, aggregated research insights with our university and institutional partners: currently DMCC, the UAE Ministry of Economy & Tourism, and the American University of Sharjah. Only group-level statistics are shared, and no statistic is reported for a group smaller than 5 people. Your name, email address, user ID, individual answers and chat messages are never shared. You can withdraw this consent at any time under Settings > Privacy.
If you are a student at a partner university, we ask for your full name and your student ID when you create your account. We check only that the ID has the right format. Nobody is turned away for not being on a list, and one student ID can be used for one account only.
Your university may give us a class list for the pilot so that results can be reported at the level of the group. Where your student ID matches a row on that list, your account is linked to it. That link decides only whether your progress counts towards the pilot figures. It changes nothing about how the app works for you. We rely on our legitimate interest in reporting the pilot at group level (Art. 6(1)(f)) and delete a class list within 30 days after the end of the programme it was supplied for. People on the list who never create an account are not contacted and are not part of any result.