Privacy Policy

Norai is operated by Karsaaz EBS Ltd, a company registered in the United Kingdom. For the purposes of applicable data protection laws, Karsaaz EBS Ltd acts as the Data Controller for personal data processed in connection with the Norai service.

Payments and subscription billing are processed separately by Karsaaz EBS Technology Solutions FZCO, a company registered in the United Arab Emirates, acting solely as the Merchant of Record. The UAE entity does not control product data processing decisions.

What This Policy Covers

This Privacy Policy explains how Norai handles information when you use our website, mobile application, or related services.

Norai is a Quranic Arabic learning application designed for parents, adult learners, and minor learner profiles managed by parents or guardians. This policy applies to all users of the Norai platform.

We are committed to responsible, transparent, and privacy focused data handling.

Account and Learner Data

Adult account data

Parents and adult learners may provide:

• Name
• Email address
• Authentication credentials through email or supported sign in providers
• Preferred language settings
• Learning preference information such as preferred learning time
• Subscription and billing information processed through payment providers

Google Sign-In

When you choose Continue with Google, NorAI may receive your name, email address, profile picture, and Google account identifier. We use this information to authenticate you, create or locate your NorAI account, maintain account security, and provide account-related services. We do not use Google user data for advertising and do not sell it to third parties.

Minor learner profiles

Minor learner profiles are created and managed by parents or guardians.

During learner profile setup, parents or guardians may provide:

• Display name or learner name
• Gender
• Date of birth Each learner profile is connected to the parent account and accessed through a parent managed QR based learner login flow designed to keep the learning experience simple and secure for minor learners.

Minor learners do not create independent accounts and do not manage billing or subscription settings.

Information we do not collect from minor learners

We do not collect or store from minor learners:

• Email addresses
• Phone numbers
• GPS location or precise device location
• Voice recordings
• Biometric data
• Payment or billing information
• Device contacts or social network information

Learning data

We collect learning activity data to support progress tracking, lesson continuity, mastery monitoring, XP calculation, family dashboard summaries, and synchronization across devices.

This may include:

• Lesson completion records
• Practice activity
• Vocabulary progress
• Mastery and retention data
• XP and learning activity
• Session activity such as learner login and logout events
• Device type and application version for technical support and performance stability Learning activity is linked to the learner profile and parent managed account.

We do not use learner data for advertising, profiling, or sale to third parties.

Device Binding and Device Records

Norai records limited device information when a user logs in or uses the app. This helps protect accounts, manage subscription access, support offline learning, and prevent misuse across multiple devices.

This includes device type, device category, device model where available, operating system, app version, a device identifier generated by the app or platform, login status, push notification token, last active time, and the linked learner profile or account ID.

Norai uses this information to identify active devices, manage device-based access, support logout and session control, prevent duplicate or conflicting offline access, troubleshoot app errors, protect parent-managed minor learner profiles, and maintain subscription access rules.

Norai does not use device records to track users outside Norai.

How We Use Data

We use data to:

• Deliver the Norai learning experience
• Maintain learner profiles and progress tracking
• Sync progress across devices and sessions
• Support offline learning synchronization
• Provide parent and family dashboard summaries
• Manage subscriptions and billing for adult accounts
• Improve application stability and performance
• Support privacy-minimized technical monitoring
• Comply with legal and regulatory obligations

Subscription and Access Data

Norai may process subscription status information to determine which lessons, features, devices, offline lesson packs, family features, or parent-managed learner profiles are available to the user.

Payments are processed by Apple App Store, Google Play, or other approved payment providers where applicable. Norai does not directly store full card numbers or payment card details.

Offline learning, local storage, and sync

Norai is designed with an offline first architecture.

Learning content may be downloaded and stored locally on the device for offline access. Learning activity and progress data may also be stored locally on the device so that learners can continue using the app when an internet connection is not available.

Locally stored data may include lesson progress, practice activity, vocabulary progress, mastery and retention data, XP, session activity, downloaded learning content, and app settings required for the learning experience.

When internet access becomes available, locally stored activity and progress data may be synchronized with Norai backend systems to keep learner progress up to date across devices and sessions.

Norai may allow users or parents to connect a supported personal cloud storage account, such as Google Drive or Microsoft OneDrive, to back up or restore supported learning progress, app settings, and offline learning status.

When a personal cloud storage account is connected, Norai may create or update backup files in that connected account only for backup and restore purposes.

Backups stored in a connected personal cloud storage account are managed by the user or parent through that third party storage provider. Users can disconnect the storage account or manage stored backup files through the available app settings or the provider’s own controls.

Where backup or restore options are available, Norai uses locally stored learning data and synced backend records to help restore supported learning progress, app settings, and offline learning status. We do not use local storage to access personal files, photos, videos, contacts, or other unrelated content on the user’s device.

Camera and QR Code Scanning

Norai may request access to the device camera only for the purpose of scanning QR codes used in the parent managed learner access flow.

The camera is used to scan a QR code so that a learner profile can be accessed on a device in a simple and secure way.

Norai does not use the camera to take photos, record videos, identify users, collect biometric data, or monitor minors.

Camera data, images, and videos are not stored by Norai and are not shared with third parties. QR code scanning is used only to read the QR code required for learner access.

Users can choose not to grant camera permission, but QR based learner access may not work unless camera access is allowed.

Microphone

Norai does not currently collect voice recordings or require microphone access for core learning features.

If microphone-based features are introduced in the future, Norai will update its app permissions, privacy disclosures, and store declarations before enabling those features.

Parent Managed Learning System

Norai uses a parent managed learning system for Minor learners.

Parents or guardians control:

• Learner profile creation
• QR based learner access
• Billing and subscription management
• Learning visibility and dashboard access
• Account level settings Minor learner profiles are not shown billing flows, subscription pricing, or payment interfaces during learning sessions.

Public Interaction Restrictions

Minor learner profiles are not public. Norai does not provide public social networking, public messaging, public chat, public activity feeds, public child profiles, or child-to-child communication features.

Minor learners cannot make their learning activity public, contact strangers, receive messages from strangers, or participate in open social features through Norai.

Sub Processors

To provide Norai, we rely on trusted third party service providers. These may include:

• Cloud infrastructure providers
• Stripe, Inc. for payment processing
• Apple Inc. and Google LLC for App Store and Google Play billing services
• Authentication and infrastructure providers
• Analytics and monitoring providers where applicable

Sub processors handle data according to their own service agreements and applicable data protection obligations.

Technical Monitoring and Diagnostics

NorAI may use privacy-minimized crash reporting, performance monitoring, limited analytics, and operational diagnostics to identify application crashes, performance issues, failed synchronization, offline pack errors, audio loading issues, subscription restore issues, and service reliability problems.

NorAI does not use monitoring tools to record Quran answers, Quran text, Quran meanings, audio recordings, child names, contact details, precise location, payment details, authentication tokens, QR login tokens, subscription receipts, or unnecessary personal data.

Monitoring data is used only for app reliability, security, troubleshooting, and service improvement.

Firebase and Firebase Cloud Messaging

Norai may use Firebase services, including Firebase Cloud Messaging, to deliver app notifications and support app reliability.

Firebase may process technical information such as app instance identifiers, device notification tokens, platform information, and delivery status information needed to send notifications and maintain service functionality.

Norai does not use push notifications to send sensitive learning data, child login tokens, QR login tokens, private account details, payment details, or full Quran learning records.

Push Notifications

Norai may send notifications such as learning reminders, subscription notices, service messages, and account security alerts.

During signup, onboarding, or app setup, Norai asks users or parents whether they want to enable notifications for reminders, progress updates, account alerts, or service messages.

Where notifications or account messages are enabled, Norai may send notices about important policy updates, including changes to privacy, terms, child safety, subscription, or data handling practices.

Where notifications are enabled, Norai may send service notifications about required app updates, important security updates, or compatibility changes needed to keep the app working safely and reliably.

Users may disable notifications through their device settings. If notifications are disabled, the app will continue to function, but some reminders or service messages may not be received.

Norai does not send push notifications directly to minor learner profiles unless the notification is parent-controlled and approved under Norai’s privacy and child safety requirements.

Norai may use automated or analytics-based reminder rules to decide when a learning reminder should be shown, but notification text is limited to approved templates and is not used to generate Quranic meanings, tafseer, fatwa, or religious rulings.

Notification Consent and Reminder Logic

Norai sends push notifications only where notification permissions, user preferences, and applicable platform requirements allow them.

Notification preferences may include learning reminders, progress celebrations, parent digests, account or security alerts, and subscription or account notices.

Norai may use learning activity, last active time, lesson completion, progress activity, subscription status, device status, notification consent status, and parent-controlled settings to decide whether a notification should be sent.

For minor learner profiles, child-related notifications are normally routed to the parent or guardian. Direct child device notifications, where available, are limited to simple learning reminders or positive learning encouragement and must be parent-controlled.

Norai does not use push notifications to send direct child marketing, subscription pressure, external links, Quranic interpretation, tafseer, fatwa, AI-generated Quranic meanings, shame-based messages, fear-based messages, or sensitive personal data.

Users and parents may turn notification categories on or off through device settings or available Norai settings.

Cross Border Data Processing

Norai operates using global infrastructure providers. As a result, data may be processed in countries outside the United Kingdom or European Economic Area, including the United States.

Where required by law, we implement appropriate safeguards to support lawful international data transfers.

Data handling follows applicable frameworks including:

• GDPR and GDPR-K
• COPPA
• UK Age Appropriate Design Code
• Applicable consumer and privacy regulations in supported regions

Minor Learner Privacy

Norai is designed with learner safety and parent controlled learning as core requirements.

• Minor learner profiles are created only through a parent or guardian account
• Minor learners do not create independent accounts
• Minor learners are not shown advertisements or billing prompts during learning
• Learning takes place through a parent managed QR based learner access flow
• We do not knowingly collect personal information directly from minor learners outside of the learner profile information provided by parents or guardians Parents or guardians may request access to or deletion of learner data by contacting privacy@norai.app.

Data Retention and Account Deletion

We retain account and learning data while an account remains active.

Parents and adult learners may request account deletion either through the application or by contacting our support team.

When deletion is requested:

• The account is soft deleted
• A 30 day deletion grace period begins
• During this period, account and learner data may still be recoverable
• After the grace period ends, account and learner data are permanently deleted from active systems Minor learner profiles can only be removed by the parent or guardian managing the account.

Billing and financial records may be retained for longer periods where required by applicable tax, financial, or legal obligations.

Your Rights

Depending on your jurisdiction, you may have the right to:

• Access personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data
• Restrict or object to certain processing
• Request a portable copy of your data To exercise these rights, contact privacy@norai.app.

Security

Norai uses secure transmission methods and industry standard safeguards to protect user data.

Learning activity and synchronization events are protected during transmission and storage. We regularly review our systems and infrastructure to reduce the risk of unauthorized access, disclosure, or misuse.

Contact

For privacy-related questions or data requests, contact us at privacy@norai.app.

Norai is operated by Karsaaz EBS Ltd, registered in the United Kingdom. Karsaaz operates through multiple legal entities across the United Arab Emirates, United Kingdom, and Pakistan. Communications sent to this address are centrally received and internally routed to the appropriate entity responsible for the relevant matter, in accordance with applicable laws.