Privacy Policy

The UNOAH application, www.unoah.com and related services (the “Service”) are provided by UNOAH AI LIMITED (“UNOAH”, “we”, “us”, “our”), a company incorporated in Ireland. UNOAH AI LIMITED is the controller of your personal data under the EU General Data Protection Regulation (GDPR) and the Irish Data Protection Acts 1988 to 2018, and the Data Fiduciary for it under India’s Digital Personal Data Protection Act, 2023.

For any privacy matter, contact privacy@unoah.com.

Grievance Officer for users in India (in accordance with the DPDP Act, 2023):

We collect the following categories of personal data:

Parts of the Service are powered by generative artificial intelligence. This section is the complete account of that processing: which features use AI, exactly what leaves your device and our servers, who receives it, what they may and may not do with it, the legal basis we rely on, how long anything is kept, how you consent and how you take that consent back. It adds to, and does not replace, the rest of this policy.

Which features use AI, and which do not

These features send your data to an AI provider:

These features do not send your data to an AI provider, even though they involve AI-generated material:

What we send

When you use one of the AI features above, the following leaves your device or our servers and is sent to the AI provider handling that request:

Two points about the profile, because they are easy to miss and we would rather state them plainly than have you discover them. First, it is attached to EVERY conversation with NOAH, including ordinary Bible questions — if you ask who Moses was, the provider handling that request also receives that you are, for example, Catholic, a new parent, and feeling anxious. It is not sent only when a message is obviously about you. Second, two of those fields are sensitive: your denomination is information about your religious beliefs, and how you are feeling is information about your state of mind. We treat both as special-category personal data and process them only with your explicit consent.

What we never send

How we collect it

Everything described above comes directly from what you type, say, or select in the app. We do not infer it from your behaviour, we do not buy it, and we do not obtain it from data brokers, social networks or any other third party. Where a value came from your setup answers, you provided it yourself and you can change or clear it in the app.

Who receives it

Three companies may receive this data, each in a defined role. No other AI provider receives it, and we do not share it with any AI provider for that provider's own purposes.

All three act as our service providers and process this data on our behalf and on our instructions. We confirm that the third-party service providers with whom we share this data — Google LLC, OpenAI and Apple Inc. — provide the same or equal protection of your personal data as is set out in this Privacy Policy.

We use these services under API terms that do not grant the provider the right to use your content to train or improve their general-purpose models. Providers may retain content briefly for abuse monitoring and to meet their own legal obligations, as their published terms describe. If the terms applicable to our use ever changed in a way that permitted training on your content, we would update this policy and ask for your consent again before continuing.

What it is used for, and what it is not

Your data is sent for one purpose: to generate the response that is shown back to you, in the conversation you are having, at the moment you are having it.

Legal basis, and why we ask rather than assume

We rely on your explicit consent, and on nothing else, for every transfer described in this section. We do not rely on legitimate interests here. That is deliberate: your prayer requests, your conversations with NOAH, your denomination and how you are feeling reveal religious belief and information about your mental and emotional state. Under the GDPR these are special categories of personal data under Article 9, and under India's Digital Personal Data Protection Act consent is in any event the operative basis. Explicit consent is the only basis we consider adequate for sending them to a third party.

How we ask, and how you take it back

If you decline, or later withdraw

The AI features stop, and nothing else does. Bible reading and downloaded translations, audio, the daily verse, curated and guided prayers from our own library, reading plans, notes, community and every other part of the Service continue to work exactly as before. Account setup can be completed manually without AI. We do not degrade, delay or restrict the rest of the app because you declined, and we do not ask you repeatedly.

How long it is kept

Where it goes

Your data is primarily stored and processed in our India (ap-south-1) region. The AI processing described in this section is an international transfer: Google, OpenAI and Apple may process these requests outside your country, including in the United States. Those transfers are made on the basis of your explicit consent and, where required, under appropriate safeguards such as standard contractual clauses, and in compliance with applicable restrictions and conditions under the DPDP Act, the GDPR and the other laws identified elsewhere in this policy.

Security

Requests to the AI providers are made over encrypted connections from our servers, authenticated with credentials held by us and not exposed to the app. Access to conversation data inside our systems is restricted to personnel who need it to operate and support the Service, and is logged. The safeguards described in the Security section of the Common Terms apply to this data in full.

Children

The Service is not directed to children below the age limit stated elsewhere in this policy, and the AI features are not made available to anyone below that age. If we learn that we have processed a child's personal data through these features without a lawful basis, we will delete it.

Your rights over this data

The rights described in the Common Terms — access, correction, deletion, portability, objection, restriction, and withdrawal of consent — apply in full to the data described in this section, including the conversations you have had with NOAH and the profile attached to them. You can exercise them in the app, or by writing to privacy@unoah.com. Withdrawing consent for AI features is immediate and needs no explanation.

The web companion

The AI Companion on www.unoah.com uses the same AI features and the same providers, in the same way, for the same purpose and on the same terms. You can use the rest of the site without it.

Automated decision-making and profiling

We do not use the AI features to make decisions about you by automated means that produce legal effects for you or that similarly significantly affect you, and we do not use them to profile you. NOAH's reply is text shown back to you; nothing about your account, your access, your pricing or your standing is decided from it. Your profile is used to make a reply relevant, not to score, rank, segment or evaluate you, and it is not combined with data from other UNOAH products for that purpose.

Children and parental consent

The AI features are not offered to anyone below the minimum age stated elsewhere in this policy, and we do not knowingly process a child's personal data through them. Where the law requires verifiable consent from a parent or guardian before a child's personal data may be processed, we do not make these features available until that consent has been obtained. If we learn that we have processed a child's data through these features without a lawful basis, we will delete it and, where required, notify the appropriate authority.

Withdrawing consent, and Consent Managers

You may withdraw this consent at any time, as easily as you gave it, in the app at Settings → Privacy & Security → Data & Privacy. You do not have to give a reason and we will not ask for one. Where India's Digital Personal Data Protection Act makes a registered Consent Manager available to you, you may also give, manage, review and withdraw this consent through that Consent Manager, and we will honour a withdrawal received through it exactly as we would one made in the app.

Complaints

If you are unhappy with how we handle the data described in this section, please contact us first at privacy@unoah.com or through our Grievance Officer, whose details appear in the Common Terms. If you remain unsatisfied you have the right to complain to the Data Protection Commission in Ireland, to the supervisory authority where you live or work, or to the Data Protection Board of India, and to seek a judicial remedy. Exercising that right costs you nothing here and does not affect your use of the Service.

Changes to this section

If we add an AI provider, change what is sent, or change what it is used for, we will publish a new version of this policy, record it in the version history, and ask for your consent again before the change takes effect for you.

We need a legal basis for each use of your personal data. These are the ones we rely on:

Where we rely on legitimate interests, we have weighed them against your rights and reasonable expectations, and you can object at any time by writing to privacy@unoah.com. In India, the equivalent grounds are your consent and the legitimate uses the DPDP Act permits. Where consent is required, we request it through clear notices and affirmative action (for example, agreeing to these terms at sign-up and granting microphone permission). You may withdraw consent at any time; withdrawal does not affect processing already carried out.

Sending your data to Google through Vertex AI on Google Cloud rests on your explicit consent, and on no other ground. We ask for it separately, before the first time an AI feature sends anything, because what you write to NOAH and in prayer requests routinely reveals religious belief, health, and personal relationships — special-category data under Article 9 of the UK and EU General Data Protection Regulation, and data we treat as sensitive throughout this policy. We do not rely on legitimate interests for it, and you can withdraw it at any time as described in section 4.

On iOS, our use of the advertising identifier (IDFA) for attribution depends on your App Tracking Transparency choice. We ask through Apple’s standard prompt and use the advertising identifier only if you allow it. If you decline, or later turn tracking off in iOS Settings, no measurement based on the advertising identifier takes place; attribution then relies only on aggregated, non-identifying reporting such as Apple’s SKAdNetwork. Declining does not limit any feature of the Service. On Android, you can reset the Google Advertising ID or opt out of its use for advertising from your device settings at any time.

We do not sell your personal data. We share it only with service providers who process it on our behalf under appropriate safeguards, including:

We use Cloudflare Turnstile to protect our site from automated abuse. When you use certain features (sign-in, sign-up, verification), Turnstile processes technical data such as your IP address and device/browser information to distinguish humans from bots. See Cloudflare's Privacy Policy: https://www.cloudflare.com/privacypolicy/

We may also disclose data where required by law or a lawful government request, in accordance with applicable law.

Your data is primarily stored and processed in our India (ap-south-1) region. Some processors may process data outside your country — including Google, which handles the AI requests described in section 4 through Vertex AI on Google Cloud, and OpenAI, which handles those same requests when it acts as the fallback provider. Any cross-border transfer is carried out in compliance with applicable restrictions, conditions, or government directions under the DPDP Act, the UAE PDPL, the KSA PDPL, and other applicable laws.

We are established in Ireland. Where personal data is transferred out of the European Economic Area or the United Kingdom to a country without an adequacy decision — including India, where our servers and our operations team are, and the United States — we use the European Commission’s Standard Contractual Clauses (with the UK addendum where it applies) or another safeguard the GDPR recognises, with additional measures where they are needed. You can ask for a copy of the relevant safeguard at privacy@unoah.com.

We retain your personal data for as long as your account is active and as needed to provide the Service. When you delete your account, we delete or irreversibly anonymise your personal data within a reasonable period, except where we are required to retain certain records to comply with legal, tax, accounting, or security obligations.

You have the right to access your personal data and get a copy of it; to correct it; to have it erased; to restrict our use of it or object to it, including where we rely on our legitimate interests; to receive the data you gave us in a portable format; and to withdraw your consent at any time, without affecting processing already carried out. Under India’s DPDP Act you may also nominate an individual to exercise your rights in the event of death or incapacity.

To exercise any right, contact privacy@unoah.com or use the in-app controls. You can request account deletion at any time at https://unoah.com/delete-account or from within the app. We respond to requests within one (1) month of receiving them. Where a request is complex, or we receive many, we may extend that by up to two (2) further months; if we do, we tell you within the first month and explain why. We may ask for information to confirm your identity before we act on a request.

You also have the right to complain to a supervisory authority, including the Data Protection Commission in Ireland. Their details are under “Contact” below.

UNOAH may collect and process the personal data of users under 18 only with verifiable consent from a parent or legal guardian and where permitted by applicable law. The parent or legal guardian may request access to, correction of, or deletion of the minor’s personal data and may withdraw consent. UNOAH does not knowingly permit minors to use the Service without the required consent and supervision.

We implement appropriate technical and organisational measures to protect your data, including encryption in transit (TLS), hashing of direct identifiers before analytics, access controls, and monitoring. No method of transmission or storage is completely secure; where required by law we will notify the competent authority and/or affected users of a personal data breach.

We may update this Privacy Policy from time to time. For material changes, we will provide notice by email or a prominent in-app notice at least fourteen (14) days before they take effect.