Privacy Policy

1. Data Controller

The data controller responsible for processing your personal data is:

2. Data We Collect

Account Information

• Name (as provided during registration)
• Email address
• Gender (optional)
• Profile avatar selection
• Full name and student ID, if you join as a student at a partner university (see section 9)
• Personal email address and the name for your certificate, if you claim your certificate in the app. We use the address to send the confirmation code and to reach you about your certificate after graduation
• Programme news to that address, only if you switch it on

Learning Data

• Lesson progress and completed cards
• Quiz results and scores
• Daily streak and XP points
• Course enrollments and preferences
• AI chat messages (used to personalise responses)
• Savings goals you set, with the target and the amounts you enter
• Your answers to the financial confidence questionnaire (statements on a 1 to 5 scale)

Community Data

• Posts and reactions you create
• Community interactions

Technical Data

• Device type and operating system
• App version
• Crash reports (anonymized)

3. Legal Basis (GDPR Art. 6)

We process your personal data under the EU General Data Protection Regulation (GDPR).

• Contract Performance (Art. 6(1)(b)): Processing necessary to provide the Nayra educational service.
• Consent (Art. 6(1)(a)): Optional features such as push notifications and anonymous analytics sharing and programme news to the personal email address you confirmed for your certificate.
• Legitimate Interests (Art. 6(1)(f)): Service improvement and security, and emails about your learning (reminders, progress, congratulations), which you can unsubscribe from at any time.
• Vital Interests (Art. 6(1)(d), Art. 9(2)(c)): Alerting our team when a message points to a crisis such as self-harm, so that help can reach you.

4. Data Retention

5. Third-Party Services

We use the following services to operate Nayra:

• Supabase: database, authentication, file storage and backend functions. Hosted in Australia (AWS ap-southeast-2).
• Anthropic (Claude): AI chat responses and automated safety checks. For a reply, your message, your first name, a summary of your learning progress and savings goals and, if you turned it on, Nayra's memory are sent to Anthropic. For the safety check, posts, comments and support messages are sent as plain text, without your name, email address or user ID (see section 10).
• Resend: email delivery, such as sign-in codes, reminders and progress emails. Emails are sent from the EU (Ireland); Resend is a US company and may process delivery records in the USA.
• Firebase Cloud Messaging (Google) and Apple Push Notification service: delivery of push notifications.
• Apple: Sign in with Apple authentication.
• Google: Sign in with Google authentication.
• Vercel: hosting of our website, our staff dashboard and the university portal. Server functions run in Australia; public pages are served from Vercel's global network.

Transfers outside the EU

• Our database and the files you upload are hosted in Australia, not in the EU.
• AI chat content and the texts checked for safety are processed by Anthropic in the USA. Anthropic does not use this data to train its models and deletes it within 30 days, longer only where the law or the enforcement of its usage policy requires it.
• Push notification services operated by Apple and Google may process data outside the EU.
• Emails are sent from the EU; delivery records may be processed by Resend in the USA.
• If you do not use the AI assistant, your own questions never reach Anthropic. Posts, comments and support messages are still checked there for safety, as plain text only.

6. Data Security

• All data encrypted in transit (TLS).
• Encryption at rest is provided by our hosting platform.
• Row-level security enforced on every database table.
• Access controls and authentication required for all accounts.
• Rate limits and abuse protection on sensitive operations.
• Re-authentication required before a data export or an account deletion.

8. Contact & Complaints

You have the right to lodge a complaint with a supervisory authority. EU users may contact their national data protection authority.

Gegevensbeschermingsautoriteit (GBA) Drukpersstraat 35 1000 Brussels, Belgium https://www.gegevensbeschermingsautoriteit.be

9. Partner Universities and Research Sharing

With your consent, given in the app, we share anonymous, aggregated research insights with our university and institutional partners: currently DMCC, the UAE Ministry of Economy & Tourism, and the American University of Sharjah. Only group-level statistics are shared, and no statistic is reported for a group smaller than 5 people. These insights never contain your name, email address, user ID, individual answers or chat messages. You can withdraw this consent at any time under Settings > Privacy.

If you are a student at a partner university, we ask for your full name and your student ID when you create your account. We check only that the ID has the right format. Nobody is turned away for not being on a list, and one student ID can be used for one account only.

Your university may give us a class list for the pilot so that results can be reported at the level of the group. Where your student ID matches a row on that list, your account is linked to it. That link decides only whether your progress counts towards the programme and its figures. It changes nothing about how the app works for you. We process a class list only on behalf of your university and on its instructions; the university is responsible for it. We keep it while the programme it was supplied for runs and its certificates and reports are issued, and delete it at the latest 12 months after the programme ends. If your university asks us to, we email people on its list who have not yet created an account, only with invitations and reminders for the programme and on the university's behalf. Every such email lets you opt out of further emails. People who do not create an account are not part of any result.

Separately, authorised staff of your own university can see, for students in their programme, your name, student ID, email address, and your progress and results in that programme, for example so that it can count towards a course. They never see your chat messages. Here too we rely on our legitimate interest (Art. 6(1)(f)).

10. Safety Checks and Crisis Alerts

To keep you and others safe, texts you write in the app are checked automatically: AI chat messages, community posts, comments and poll options, your profile, reflections in lessons and support messages. The check looks for signs of a crisis such as self-harm, and for insults, slurs and other content our community rules do not allow.

Community posts, comments and support messages are additionally checked by Anthropic. Only the text is sent, without your name, email address or user ID.

If a text points to a crisis, the app shows you right away where to find help, and the Nayra team is alerted. For AI chat messages and reflections the alert includes the message itself, so the team can understand the situation. Before you first use the AI chat, the app tells you about this. Alerts are visible only to the Nayra team. The message inside an alert is deleted automatically after 30 days; the record that an alert was raised stays, and loses its link to you when you delete your account.

Community posts that clearly break the rules are not published. Unclear cases are held back until a team member has looked at them.

11. Notifications and Emails

Here is what we send you, and how you stop it.

• Push notifications, only if you allow them on your phone: reminders to keep learning, your streak, milestones and saving check-ins, replies to your support requests, activity on your community posts, and programme news from the Nayra team. In the app's notification settings you can switch them off, choose categories and set quiet hours. You can also turn them off in your phone's settings.
• Emails you need for your account: sign-in and confirmation codes, password and account-deletion messages, replies to your support requests and notices about community moderation. These are always sent.
• Emails about your learning: reminders, progress and weekly summaries, congratulations when you finish a module or the programme, and news about your certificate. Every one of these emails has an unsubscribe link, and one click stops them.
• Programme news to the personal email address you confirmed for your certificate, only if you switch it on.
• If your university gave us a class list and you have not created an account yet, you may receive invitations and reminders for the programme on your university's behalf (see section 9). Each of these emails lets you opt out.