Privacy Policy

Tarbiya AI is an AI-powered parenting platform operated by Tarbiya AI Technologies FZ-LLC, a free zone limited liability company registered in the Ras Al Khaimah Economic Zone (RAKEZ), United Arab Emirates. In this Privacy Policy, "Tarbiya AI", "we", "us", and "our" refer to Tarbiya AI Technologies FZ-LLC, which provides and operates the Tarbiya AI app and website and acts as the data controller for the personal data described here.

• Registered Address: FDBC5821, Compass Building, Al Shohada Road, Al Hamra Industrial Zone-FZ, Ras Al Khaimah, United Arab Emirates

• Privacy Contact: privacy@tarbiyaai.com

Where required by applicable law, Tarbiya AI will appoint or designate the appropriate privacy representative or contact (such as a Data Protection Officer or an EU/UK Representative pursuant to Article 27 of the GDPR / UK GDPR).

For the purposes of applicable data protection laws—including the European Union General Data Protection Regulation (EU GDPR), the UK General Data Protection Regulation (UK GDPR), the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021 / UAE PDPL), and the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA)—Tarbiya AI acts as the Data Controller of your personal information.

Our approach to data protection is guided by four fundamental commitments:

This Privacy Policy applies to all individuals who download, register, access, or interact with Tarbiya AI globally.

Important Clarification on Our Services:

Tarbiya AI is an AI-powered parenting companion designed to support parents and caregivers through evidence-based child development guidance, alongside optional guidance informed by Islamic ethics and values.

Tarbiya AI is not a healthcare provider, clinical diagnostic tool, medical device, licensed psychology service, educational institution, or legal service. Our Services are designed to support—not replace—human relationships, parental judgment, and professional advice.

We collect information to provide, maintain, secure, and improve our Services, as well as to deliver personalized guidance. We categorize the information we collect as follows:

A. Information You Provide Directly to Us

• Account Information: When you create an account, we collect your email address, primary authentication credentials (managed securely via Firebase Authentication), profile settings, preferred language, and subscription status.
• AI Conversations & Prompt Data: When you use our AI parenting assistant, we collect the text, prompts, context, and questions you input, as well as the responses generated by our system. This includes session information, conversation timestamps, and saved thread histories.
• Parenting Context & Profile Preferences (Optional): You may choose to share contextual information within conversations or settings to receive more tailored guidance (such as your child's age group, specific parenting challenges, or a preference for guidance integrated with Islamic values).
• Customer Support & Communications: If you contact us directly for support, feedback, or inquiries, we collect your contact information, the contents of your message, and any attached logs or screenshots you provide.

B. Sensitive Personal Data

Providing parenting context, cultural preferences, or guidance choices informed by Islamic values is entirely optional. Where applicable law classifies these preferences or details as sensitive personal data or special category data, we process this information based on your explicit consent when you voluntarily choose to provide it. This information is used solely to personalize the guidance you request.

C. Information Collected Automatically

When you download, install, or navigate our App or Site, our backend systems automatically record technical information from your device:

• Technical Device Information: Device model, operating system type and version, unique device identifiers, language settings, time zone, app version, and IP-derived broad location data (country or city level).
• Usage & Log Data: Interaction timestamps, feature usage, error logs, performance metrics, and crash reports (collected via Firebase Crashlytics if enabled).
• Push Notification Tokens: Unique device tokens generated via Firebase Cloud Messaging (FCM) necessary to send you notifications, updates, or operational alerts (if permitted by your device settings).

D. Information Received from Third Parties

• In-App Purchase Information: When you subscribe to Tarbiya AI via the Apple App Store or Google Play Store, we receive confirmation of your transaction, subscription status, expiration date, and transaction ID. We do not collect or store your credit card or payment details directly. All financial transactions are handled securely by Apple or Google.

We use your personal data for explicit and defined operational purposes:

We process your personal data under the following legal grounds:

• Performance of a Contract: Processing is necessary to execute our terms of service, maintain your account, process payments through app stores, and deliver AI-generated parenting guidance.
• Consent: Where required by law (such as sending push notifications or processing voluntary sensitive profile choices), we process your data based on your explicit consent. You may withdraw consent at any time.
• Legitimate Interests: We process data to secure our architecture, prevent fraud, debug technical errors, and optimize the quality of our Services, provided these interests are not overridden by your privacy rights.
• Legal Obligation: We process data where required to comply with statutory obligations, financial record-keeping, or legal demands.

We share your information under controlled conditions with trusted service providers, platforms, or legal authorities:

A. Infrastructure & Service Providers

We share data with technology vendors who act as Data Processors bound by contractual data protection terms:

• Google Cloud / Firebase: For account authentication, Cloud Messaging, app performance monitoring, crash logging, and primary database storage (Firestore).
• OpenAI LLC: For backend processing of AI conversation prompts via secure API.

B. Mobile Platform Operators

• Apple Inc. & Google LLC: To manage in-app subscriptions, subscription verification, and billing validation.

C. Legal & Regulatory Requirements

We may disclose your information if required to do so by law, warrant, court order, or binding administrative demand, or when we believe in good faith that disclosure is necessary to protect the rights, property, or safety of Tarbiya AI, our users, or the public.

D. Corporate Transfers

In the event of a merger, acquisition, reorganization, bankruptcy, or sale of assets, user data may be transferred as part of that transaction, subject to the acquiring entity honoring this Privacy Policy.

Because Tarbiya AI operates globally, your information may be transferred to, stored, and processed on cloud servers located outside your country of residence, including in the United States and Europe, where our primary cloud infrastructure resides.

Whenever we transfer personal data across international borders, we implement recognized legal safeguards, including:

• Standard Contractual Clauses (SCCs): Utilizing European Commission and UK-approved Standard Contractual Clauses for transfers out of the EU, UK, or Switzerland.
• Data Processing Agreements (DPAs): Enforcing contractual terms that mandate compliance with applicable privacy laws.
• Adequacy Decisions: Relying on official adequacy decisions where recognized under applicable law.

We retain your personal information for as long as necessary to fulfill the purposes for which it was collected, maintain your active account, or comply with legal obligations.

• Account Data: Retained for as long as your account remains active.
• AI Conversation History: Retained to allow you to review past conversations until you clear a thread or request account deletion.
• Technical Logs & Crash Reports: Retained for a limited operational period (typically up to 180 days) before being deleted or anonymized.
• Account Deletion: You may request account deletion directly within the App settings or by contacting us via email. Upon receiving a verified request, associated account details and active conversation histories are deleted or anonymized within reasonable technical timelines (typically within 30 days), except where retention is required by law or necessary for legitimate business purposes (such as financial reporting). Residual copies in encrypted system backups are overwritten in accordance with standard operational backup cycles.

We enforce technical, administrative, and physical safeguards designed to protect your personal information against unauthorized access, loss, misuse, or alteration:

• Encryption in Transit: All communication between the mobile app, our backend servers, and third-party APIs is encrypted using Transport Layer Security (TLS 1.2 or higher / HTTPS).
• Encryption at Rest: Data stored within our cloud databases is encrypted at rest using industry-standard AES-256 encryption.
• Secure Architecture: API keys and credentials are isolated on our secure backend and are not stored on client devices.
• Access Controls: Access controls ensure that only authorized technical personnel with a defined need can access operational infrastructure.

Note: While we implement reasonable security measures, no method of transmission over the internet or method of electronic storage is completely secure. We cannot guarantee absolute security.

Depending on your location (including the EU, UK, UAE, California, and other applicable regions), you may possess specific rights regarding your personal data:

To exercise any of these rights, please contact us at [privacy@tarbiyaai.com]. We will respond to verified requests within statutory timelines (typically within 30 days).

Our website uses cookies and similar functional technologies to support site operation, security, and basic usage analytics.

We do not use invasive tracking cookies or third-party ad network trackers. For detailed information regarding the cookies we use and how to manage your preferences, please review our separate [Cookie Policy].

Tarbiya AI relies on third-party service providers for infrastructure and technical operations. Each provider maintains its own independent privacy policy:

• Google Cloud / Firebase: Google Privacy Policy
• OpenAI: OpenAI Privacy Policy
• Apple App Store: Apple Privacy Policy
• Google Play Store: Google Play Privacy Terms
• Brevo (Sendinblue GmbH): delivers the notification email generated when you use our contact form. Brevo Privacy Policy
• Cloudflare Turnstile: protects our contact form from automated abuse. It processes your IP address and basic browser signals at Cloudflare, and does not track you across websites. Cloudflare Privacy Policy

Contact form. When you send us a message through the contact form on our Site, your name, email address, chosen topic and message are validated on our server and passed directly to Brevo for delivery to the relevant Tarbiya AI inbox. We do not store the contents of your message, your name or your email address in any Tarbiya AI database — the resulting email in our inbox is the only record. Your email address is set as the reply-to address so we can respond.

Abuse prevention. To block spam and duplicate submissions, our server stores a one-way cryptographic code (an HMAC hash) derived from your IP address and your message. These codes cannot be reversed to reveal your IP address or message content, are never used for any other purpose, and are deleted automatically within 24 hours.

Launch waitlist. If you ask to be notified when Tarbiya AI launches, we store your email address and nothing else — no name, and no other personal information. It is held in our encrypted database, is not readable from the website or by any browser, and is never shared, sold or used for marketing. We will use it only to tell you that Tarbiya AI has launched or to share a major launch update. You can ask us to remove or export it at any time by writing to privacy@tarbiyaai.com.

Website analytics. We use PostHog (EU hosting) in a cookieless, privacy-first configuration to understand which pages are read and which links are used. We do not enable session recording, profiling, advertising integrations, fingerprinting or cross-site tracking, and we do not use these measurements to identify individual families.

We may update this Privacy Policy periodically to reflect changes in our legal obligations, architectural updates, or operational practices.

When material changes are made, we will notify you through an in-app notice, email, or banner on our Site prior to the changes becoming effective. We encourage you to review this Privacy Policy periodically. The "Effective Date" at the top indicates when the policy was last revised.

If you have questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us:

This Privacy Policy shall be governed by and construed in accordance with the laws of the United Arab Emirates and, where applicable, the laws and regulations of the Emirate of Dubai, without prejudice to any mandatory rights or protections afforded to consumers under the laws of their country of residence.

Nothing in this Privacy Policy limits or excludes any rights that users may have under applicable mandatory data protection or consumer protection laws, including, where applicable, the European Union General Data Protection Regulation (GDPR), the UK General Data Protection Regulation (UK GDPR), the California Consumer Privacy Act (CCPA/CPRA), or other applicable legislation.

Any disputes arising from or relating to this Privacy Policy shall be subject to the dispute resolution and jurisdiction provisions set out in the Tarbiya AI Terms of Service, except where mandatory local law requires otherwise.