Privacy Policy

The UNOAH application, www.unoah.com and related services (the “Service”) are provided by UNOAH AI LIMITED (“UNOAH”, “we”, “us”, “our”), a company incorporated in Ireland. UNOAH AI LIMITED is the controller of your personal data under the EU General Data Protection Regulation (GDPR) and the Irish Data Protection Acts 1988 to 2018, and the Data Fiduciary for it under India’s Digital Personal Data Protection Act, 2023.

For any privacy matter, contact privacy@unoah.com.

If you live in India

Our Grievance Officer for users in India, under the Digital Personal Data Protection Act, 2023 and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021:

We collect the following categories of personal data:

Parts of the Service are powered by generative artificial intelligence. This section is the complete account of that processing: which features use AI, exactly what leaves your device and our servers, who receives it, what they may and may not do with it, the legal basis we rely on, how long anything is kept, how you consent and how you take that consent back. It adds to, and does not replace, the rest of this policy.

Which features use AI, and which do not

These features send your data to an AI provider:

These features do not send your data to an AI provider, even though they involve AI-generated material:

What we send

When you use one of the AI features above, the following leaves your device or our servers and is sent to the AI provider handling that request:

Two points about the profile, because they are easy to miss and we would rather state them plainly than have you discover them. First, it is attached to EVERY conversation with NOAH, including ordinary Bible questions — if you ask who Moses was, the provider handling that request also receives that you are, for example, Catholic, a new parent, and feeling anxious. It is not sent only when a message is obviously about you. Second, two of those fields are sensitive: your denomination is information about your religious beliefs, and how you are feeling is information about your state of mind. We treat both as special-category personal data and process them only with your explicit consent.

What we never send

How we collect it

Everything described above comes directly from what you type, say, or select in the app. We do not infer it from your behaviour, we do not buy it, and we do not obtain it from data brokers, social networks or any other third party. Where a value came from your setup answers, you provided it yourself and you can change or clear it in the app.

Who receives it

Three companies may receive this data, each in a defined role. No other AI provider receives it, and we do not share it with any AI provider for that provider's own purposes.

All three act as our service providers and process this data on our behalf and on our instructions. We confirm that the third-party service providers with whom we share this data — Google LLC, OpenAI and Apple Inc. — provide the same or equal protection of your personal data as is set out in this Privacy Policy.

We use these services under API terms that do not grant the provider the right to use your content to train or improve their general-purpose models. Providers may retain content briefly for abuse monitoring and to meet their own legal obligations, as their published terms describe. If the terms applicable to our use ever changed in a way that permitted training on your content, we would update this policy and ask for your consent again before continuing.

What it is used for, and what it is not

Your data is sent for one purpose: to generate the response that is shown back to you, in the conversation you are having, at the moment you are having it.

Legal basis, and why we ask rather than assume

We rely on your explicit consent, and on nothing else, for every transfer described in this section. We do not rely on legitimate interests here. That is deliberate: your prayer requests, your conversations with NOAH, your denomination and how you are feeling reveal religious belief and information about your mental and emotional state. Under the GDPR these are special categories of personal data under Article 9, and under India's Digital Personal Data Protection Act consent is in any event the operative basis. Explicit consent is the only basis we consider adequate for sending them to a third party.

How we ask, and how you take it back

If you decline, or later withdraw

The AI features stop, and nothing else does. Bible reading and downloaded translations, audio, the daily verse, curated and guided prayers from our own library, reading plans, notes, community and every other part of the Service continue to work exactly as before. Account setup can be completed manually without AI. We do not degrade, delay or restrict the rest of the app because you declined, and we do not ask you repeatedly.

How long it is kept

Where it goes

Your data is primarily stored and processed in our India (ap-south-1) region. The AI processing described in this section is an international transfer: Google, OpenAI and Apple may process these requests outside your country, including in the United States. Those transfers are made on the basis of your explicit consent and, where required, under appropriate safeguards such as standard contractual clauses, and in compliance with applicable restrictions and conditions under the DPDP Act, the GDPR and the other laws identified elsewhere in this policy.

Security

Requests to the AI providers are made over encrypted connections from our servers, authenticated with credentials held by us and not exposed to the app. Access to conversation data inside our systems is restricted to personnel who need it to operate and support the Service, and is logged. The safeguards described in the Security section of the Common Terms apply to this data in full.

Children

The Service is not directed to children below the age limit stated elsewhere in this policy, and the AI features are not made available to anyone below that age. If we learn that we have processed a child's personal data through these features without a lawful basis, we will delete it.

Your rights over this data

The rights described in the Common Terms — access, correction, deletion, portability, objection, restriction, and withdrawal of consent — apply in full to the data described in this section, including the conversations you have had with NOAH and the profile attached to them. You can exercise them in the app, or by writing to privacy@unoah.com. Withdrawing consent for AI features is immediate and needs no explanation.

The web companion

The AI Companion on www.unoah.com uses the same AI features and the same providers, in the same way, for the same purpose and on the same terms. You can use the rest of the site without it.

Automated decision-making and profiling

We do not use the AI features to make decisions about you by automated means that produce legal effects for you or that similarly significantly affect you, and we do not use them to profile you. NOAH's reply is text shown back to you; nothing about your account, your access, your pricing or your standing is decided from it. Your profile is used to make a reply relevant, not to score, rank, segment or evaluate you, and it is not combined with data from other UNOAH products for that purpose.

Children and parental consent

The AI features are not offered to anyone below the minimum age stated elsewhere in this policy, and we do not knowingly process a child's personal data through them. Where the law requires verifiable consent from a parent or guardian before a child's personal data may be processed, we do not make these features available until that consent has been obtained. If we learn that we have processed a child's data through these features without a lawful basis, we will delete it and, where required, notify the appropriate authority.

Withdrawing consent, and Consent Managers

You may withdraw this consent at any time, as easily as you gave it, in the app at Settings → Privacy & Security → Data & Privacy. You do not have to give a reason and we will not ask for one. Where India's Digital Personal Data Protection Act makes a registered Consent Manager available to you, you may also give, manage, review and withdraw this consent through that Consent Manager, and we will honour a withdrawal received through it exactly as we would one made in the app.

Complaints

If you are unhappy with how we handle the data described in this section, please contact us first at privacy@unoah.com. If you live in India, you can also contact our Grievance Officer. Their details are under “Who is responsible for your data”. If you remain unsatisfied you have the right to complain to the Data Protection Commission in Ireland, to the supervisory authority where you live or work, or to the Data Protection Board of India, and to seek a judicial remedy. Exercising that right costs you nothing here and does not affect your use of the Service.

Changes to this section

If we add an AI provider, change what is sent, or change what it is used for, we will publish a new version of this policy, record it in the version history, and ask for your consent again before the change takes effect for you.

UNOAH offers a free plan and paid plans. Our Terms & Conditions set out the plans, the free trial, renewals and cancellation. This section explains what happens to your data.

Our billing platform

Plans, prices, trials and subscriptions are managed for us by our billing platform, UPG. UPG receives only an internal reference for your account — never your name, email address or phone number. It tells us which plan you hold and until when, and we keep a copy of that in our own database in India so the app can check your plan quickly.

Who takes your payment

You pay by card through our payment processor, Stripe, not to us directly. You enter your email address and card details on Stripe’s own checkout page, and Stripe processes them under its own privacy policy and the PCI-DSS card-security standard. We do not receive or store full card numbers or card security codes. Our billing platform gives Stripe only an internal reference for your account and the plan you chose. Stripe tells our billing platform whether a payment succeeded, its amount and currency, the type of card, and a reference for the payment.

Usage limits

Some features have limits that depend on your plan. The limits for your plan, and how much of each you have used, are shown in the app. To apply them, we count your use of those features.

How long we keep it

We need a legal basis for each use of your personal data. These are the ones we rely on:

Where we rely on legitimate interests, we have weighed them against your rights and reasonable expectations, and you can object at any time by writing to privacy@unoah.com. In India and the UAE the law does not recognise legitimate interests as a general ground: there, we rely on your consent, or on a use the law allows without consent (such as meeting a legal duty, preventing fraud or responding to an emergency), for each use this policy attributes to legitimate interests. Where consent is required, we request it through clear notices and affirmative action (for example, agreeing to these terms at sign-up and granting microphone permission). You may withdraw consent at any time; withdrawal does not affect processing already carried out.

Sending your data to Google through its Gemini API rests on your explicit consent, and on no other ground. We ask for it separately, before the first time an AI feature sends anything, because what you write to NOAH and in prayer requests routinely reveals religious belief, health, and personal relationships — special-category data under Article 9 of the UK and EU General Data Protection Regulation, and data we treat as sensitive throughout this policy. We do not rely on legitimate interests for it, and you can withdraw it at any time as described in section 4.

On iOS, our use of the advertising identifier (IDFA) for attribution depends on your App Tracking Transparency choice. We ask through Apple’s standard prompt and use the advertising identifier only if you allow it. If you decline, or later turn tracking off in iOS Settings, no measurement based on the advertising identifier takes place; attribution then relies only on aggregated, non-identifying reporting such as Apple’s SKAdNetwork. Declining does not limit any feature of the Service. On Android, you can reset the Google Advertising ID or opt out of its use for advertising from your device settings at any time.

We do not sell your personal data. We share it only with service providers who process it on our behalf under appropriate safeguards, including:

We use Cloudflare Turnstile to protect our site from automated abuse. When you use certain features (sign-in, sign-up, verification), Turnstile processes technical data such as your IP address and device/browser information to distinguish humans from bots. See Cloudflare's Privacy Policy: https://www.cloudflare.com/privacypolicy/

We may also disclose data where required by law or a lawful government request, in accordance with applicable law.

Your data is primarily stored and processed in our India (ap-south-1) region. Some processors may process data outside your country — including Google, which handles the AI requests described in section 4 through its Gemini API, and OpenAI, which handles those same requests when it acts as the fallback provider, and our payment processor Stripe, described in section 5. Any cross-border transfer is carried out in compliance with applicable restrictions, conditions, or government directions under the DPDP Act, the UAE PDPL, the KSA PDPL, and other applicable laws.

We are established in Ireland. Where personal data is transferred out of the European Economic Area or the United Kingdom to a country without an adequacy decision — including India, where our servers and our operations team are, and the United States — we use the European Commission’s Standard Contractual Clauses (with the UK addendum where it applies) or another safeguard the GDPR recognises, with additional measures where they are needed. You can ask for a copy of the relevant safeguard at privacy@unoah.com.

Service messages. We send you messages you need in order to use the Service: sign-in codes, security alerts, receipts and notices about your plan, replies to your requests, and notice of important changes to these documents. You cannot opt out of them while you have an account.

Notifications. Push notifications, such as prayer reminders, the daily verse and community activity, are sent only if you allow notifications on your device, and you can choose which ones you receive in the app’s settings.

Marketing emails about the AI Bible Companion. We send news and offers by email only if you opt in, and every such email has a link to unsubscribe.

UNOAH Union emails. If you have a Union profile, we email you about your matches, new messages and Union news. You can stop any of them with the unsubscribe link in each email, and one unsubscribe stops all Union emails except service messages.

Where the law of the country you live in requires your consent before we send a kind of message, we ask for it first.

Our websites (www.unoah.com, the AI Bible Companion web app and the UNOAH Union site) use cookies and similar technologies, such as your browser’s local storage. Some are needed for the site to work; the rest are used only if you agree.

Always on — needed for the site to work

Only if you agree — “Share usage data”

We do not use Google advertising cookies. When you press play on a video on our site, it is played by YouTube (Google), which may set its own cookies under Google’s privacy policy.

Your choice. You can change your choice at any time with “Privacy settings” at the bottom of every page. When you withdraw, we stop loading these tools and delete their cookies from our sites. Cookies the providers set on their own sites are controlled in your browser and on those sites.

We retain your personal data for as long as your account is active and as needed to provide the Service. When you delete your account, we delete or irreversibly anonymise your personal data, except for the limited records described below and records we are required to keep to comply with legal, tax, accounting, or security obligations.

How deletion works

When you ask us to delete your account, we may first hold the request for a short cooling-off period of no more than fourteen (14) days. If we do, we email you a link that lets you cancel the request during that period, and we may suspend sign-in to your account while the request is pending. We complete the deletion within one (1) month of your request.

Some UNOAH products let you delete only your profile in that product — for example, your UNOAH Union profile — and keep your UNOAH account. This deletes that product’s data and leaves the rest of your account in place.

What we keep after you delete your account

The deletion record (180 days)

When you delete your whole UNOAH account, we keep a small deletion record for one hundred and eighty (180) days. It holds only: a keyed, one-way hash of the email address and/or phone number you signed in with; the date your account was deleted; whether the account used a free trial or a paid subscription; and how much the account had used, in total, of the features that have a limit on your plan. It does not hold your name, your email address or phone number in readable form, or any of your content.

We keep it for one purpose: so that deleting an account and registering again does not reset free allowances or give a second free trial. If you register again with the same email address or phone number within 180 days, we use the record only to carry that trial status and those usage totals over to your new account. We do not use it to identify you, to contact you, or for any other purpose. After 180 days it is permanently deleted.

We keep the deletion record to prevent fraud and abuse of the Service, relying on the legitimate uses and legitimate interests that applicable law allows for that purpose. Deleting only a product profile, such as your UNOAH Union profile, does not create a deletion record.

You have the right to access your personal data and get a copy of it; to correct it; to have it erased; to restrict our use of it or object to it, including where we rely on our legitimate interests; to receive the data you gave us in a portable format; and to withdraw your consent at any time, without affecting processing already carried out. Under India’s DPDP Act you may also nominate an individual to exercise your rights in the event of death or incapacity.

To exercise any right, contact privacy@unoah.com, or use the in-app controls. You can request account deletion at any time at https://unoah.com/delete-account or from within the app; “Data retention” above explains how deletion works and what we keep. We complete account deletion within one (1) month of your request. We respond to other requests within one (1) month of receiving them. Where a request is complex, or we receive many, we may extend that by up to two (2) further months; if we do, we tell you within the first month and explain why. We may ask for information to confirm your identity before we act on a request.

You also have the right to complain to a supervisory authority, including the Data Protection Commission in Ireland. Their details are under “Contact” below.

You must be at least thirteen (13) years old to create an UNOAH account. If you live in the European Economic Area, you must be at least sixteen (16). Where the law of the country you live in sets a higher minimum age, or requires the consent of a parent or guardian below a certain age, that rule applies instead.

India. Under India’s Digital Personal Data Protection Act, 2023, anyone under eighteen (18) is a child. If you live in India and are under 18, you may hold an account only after a parent or legal guardian has given verifiable consent. Until we offer a way to give that consent, accounts in India are available from age 18.

Adults only. Some parts of the Service are only for users aged eighteen (18) or over, wherever they live: community features (circles, communities, the Prayer Room and messages with other members) and UNOAH Union. If you are under 18, we do not collect or share your device’s advertising identifier for install attribution, and we do not use your personal data for advertising.

We rely on the date of birth you give us. If we learn that we hold personal data about someone below the minimum age that applies to them, or without a parent’s consent that the law requires, we delete it. A parent or guardian who believes their child has an account can ask us to delete it at privacy@unoah.com.

Where a parent or guardian has given consent for a child, they may ask to access, correct or delete the child’s personal data, and may withdraw that consent at any time.

We implement appropriate technical and organisational measures to protect your data, including encryption in transit (TLS), hashing of direct identifiers before analytics, access controls, and monitoring. No method of transmission or storage is completely secure; if a personal data breach happens, we report it to the authorities the law requires — including the Data Protection Commission in Ireland and the Data Protection Board of India — and we tell the people affected without delay, with what happened, what it may mean for them and what we are doing about it. In India, we tell every person affected by any breach.

We may update this Privacy Policy from time to time. For material changes, we will provide notice by email or a prominent in-app notice at least fourteen (14) days before they take effect.