Privacy Policy

Last updated 26 October 2026

Update of 26 October 2026: section 5 now lists our transcription and AI providers, used only for AI live summaries a community owner turns on, and section 7 says what happens to live recordings. The previous version of 9 October 2026 is kept for reference.

Update of 9 October 2026: section 5 now also lists our video providers, who run live calls and streams, keep recordings, and store and play videos. This describes what already happens; it does not change how we use personal data. The last version of 8 October 2026 is kept for reference.

Update of 8 October 2026: section 3 now says what we receive when you sign in with Google or Apple (Google sign-in was already available; this describes it), sections 3 and 5 now describe notifications in the Nadi app, and section 7 says that we ask Apple to revoke your Apple sign-in when you confirm with Apple as you delete your account and that video files may be kept after you delete them or your account while we finish our deletion system. This does not change how we use other personal data. The previous version of 17 September 2026, the first earlier version of 8 October 2026 and the second earlier version of 8 October 2026 are kept for reference.

Correction of 17 September 2026: section 5 now says that PayPal processed past payments and handles existing subscriptions and payouts of amounts already owed, because new purchases through Nadi are not available. This is a correction of fact; it does not change how we use personal data. The previous version of 16 September 2026 is kept for reference.

This explains what NADI ONLINE FZ-LLC ("Nadi") does with personal data. It covers the platform itself. Each community is run by its own owner, and section 2 explains where the line between us falls.

1. In short

We collect what we need to run accounts, communities, and payments — and not more.
We do not sell personal data or run advertising trackers. Optional usage measurement runs only if you accept it.
Card details go directly to our payment provider over a secure connection. Nadi does not store card numbers.
You can export or delete your data from account settings, or by writing to privacy@nadi.online.

2. Who is responsible for what

For your account — your email, your profile, your billing relationship with us — we are the data controller.

This notice was last changed on 26 October 2026; changes apply from that date. It does not retrospectively change responsibility for earlier processing. Your rights concerning previously collected personal data remain unaffected. You can contact privacy@nadi.online to exercise those rights.

For what happens inside a community, the community's owner is the controller and we act as their processor: they decide who is admitted, what is posted, and what they do with a member list. If you want your data removed from a particular community, ask its owner first; if they do not respond, write to us and we will act.

3. What we collect

Account data — name, email, handle, password hash, profile photo, bio, and language preference.
Sign-in with Google or Apple — if you choose to sign in with Google or Apple, we receive from them your name (if you share it), your email address, an identifier for that sign-in and, from Google, your profile photo if you have one. If you use Apple's ‘Hide My Email’, we receive a private relay address that forwards to you instead of your own address. We use this to create your account, sign you in and contact you about your account. We never receive your Google or Apple password.
App notifications — if you allow notifications in the Nadi app, your phone gives us a push token, a code that lets us send notifications to that device. We keep it with your account and use it only to send you Nadi notifications. It is deleted when you sign out of the app on that device or delete your account, and you can turn notifications off at any time in your phone's settings. You choose which kinds of notification you get; news about Nadi itself is off unless you turn it on.
Content — posts, comments, courses and lessons you write, calendar events, direct messages, and anything you upload.
Membership and activity — which communities you belong to, your role in each, points and level, lesson progress, and event responses.
Payment data — what you were charged, when, by which community, and the last four digits and brand of the card. Full card numbers go straight to the payment provider and are never stored by us.
Technical data — IP address, browser and device type, and timestamps, recorded in server logs and used for security, abuse prevention, and debugging.
Optional signup context — if you accept analytics, we remember a broad arrival source, page type, device and browser category. When you create an account, this context may be attached to it so our team can understand signup friction. It is not shared with community owners. We do not put full URLs, gift tokens, raw browser identifiers or campaign text in this record.
Licence check-ins — when software licensed by a community checks that your membership is still active, we count that check-in against a one-way hash of your network prefix, never the address itself, so that an owner can see when one key is being used from many places at once.

We do not ask for special-category data — health, religion, politics, sexuality. If you choose to write it in a post, you are making it visible to that community.

4. Why we use it, and on what basis

To provide the service — creating your account, showing you your communities, taking payments. Basis: performance of our contract with you.
To keep it safe — detecting fraud, spam, and abuse; enforcing our terms; keeping audit logs. Basis: our legitimate interest in a service that is not overrun.
To support and improve it — answering your questions, fixing what is broken, understanding which features are used. Basis: legitimate interest.
To meet legal obligations — tax and accounting records, and responding to lawful requests. Basis: legal obligation.
Marketing email — only if you opt in, and every message has an unsubscribe link. Basis: consent.
Optional measurement — signup context and broad page-usage counts help us improve the first visit. Basis: consent. Declining does not change your access to Nadi.

5. Who we share it with

We share personal data only with providers who process it on our instructions, under contract, and only for these purposes:

Supabase — database, file storage, and authentication.
PayPal — processed past payments, and handles existing subscriptions and payouts of amounts already owed. PayPal is a controller in its own right for the payment data it collects.
Our email provider — transactional email such as password resets and receipts.
Our hosting and error-monitoring providers — running the site and telling us when it breaks.
Our video providers — live calls and streams, recordings, and storing and playing videos.
Our transcription and AI providers — only for AI live summaries a community owner turns on: our transcription provider turns the live's recording into text, and our AI provider uses that text to draft a summary. We delete our copy of the text when the draft is ready, or about a day later if it is not. Our providers may keep their copies for a limited time under their own rules. A summary is posted only after the owner or a co-owner approves it.
Apple and Google — notifications to the app are delivered through Apple Push Notification service (iPhone) or Google Firebase Cloud Messaging (Android). They receive your device's push token and the notification's title, text and link.
Vercel Web Analytics — with your consent, broad page categories and aggregate browser, device and country statistics. We do not send account identifiers, private page paths, gift links or query strings to this analytics service.

When you search for or view GIFs, your device connects directly to GIPHY; it receives search terms when you search, technical information such as your IP address and browser or device details, and events when you view, select or send a GIF.

Beyond that we share data with a community's owner and moderators for the community you joined; with law enforcement or a court where we are legally required to and, where we are allowed, after telling you; and with a buyer if the business is ever sold, under the same commitments made here.

We do not sell personal data, and never have.

6. Cookies and local storage

Essential cookies keep Nadi working. Optional arrival cookies and usage measurement start only after you accept analytics. You can decline or change your choice on the cookie policy page. We do not use these records to follow you across other sites.

The cookie policy lists every one of them — what it is for, and how long it stays.

7. How long we keep it

Account and content — while your account is open.
Optional signup context — the browser arrival cookie lasts up to seven days; a Google signup-start proof lasts up to ten minutes. Context attached to your account remains until you remove it by declining analytics while signed in, ask us to remove it, or delete your account. Clearing a browser cookie alone does not remove a record already attached to your account. You can include this record in your account export.
After you delete your account — removed or anonymised within 30 days, except where we must keep something longer. If you signed in with Apple, we also ask Apple to revoke your Apple sign-in for Nadi when you confirm with Apple.
Live recordings — after a live ends, the host or the community's managers can post the recording, download it, or ask us to delete it. Until it is posted, only they can see it.
Video files — video files from live recordings, courses and posts may be kept after you delete them or your account while we finish our deletion system.
Payment and tax records — kept as long as tax law requires, typically six to seven years.
Server and security logs — 90 days.
Backups — overwritten on a rolling 30-day cycle, so deleted data can persist there briefly.

Posts and comments you made in a community may remain visible to that community after you leave, detached from your profile, so that conversations other people took part in do not fall apart. Ask us if you want them removed as well.

8. Your rights

Depending on where you live you can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or send it to another service. You can also withdraw consent at any time where consent is what we relied on.

Most of this is self-service in account settings. For anything else, write to privacy@nadi.online — we answer within 30 days. We will never charge you for asking or treat you differently for having asked. If you are unhappy with our answer you can complain to your local data protection authority.

9. International transfers

Our providers operate in several countries, so your data may be processed outside the one you live in. Where it leaves the UK or the EEA we rely on the European Commission's Standard Contractual Clauses, or on an adequacy decision covering the destination.

10. Security

Traffic is encrypted in transit, passwords are hashed and never stored in a readable form, access to production data is limited to the people who need it, and rendered content is sanitised so one member cannot run code in another's browser. No system is perfect; if a breach affects you we will tell you and the relevant authority within the time the law sets.

11. Children

Nadi is not for people under 16. If we learn that we hold data on someone younger, we delete it. If you believe a child has an account here, write to privacy@nadi.online.

12. Changes

We will post any material change here and, where it affects you meaningfully, tell you by email before it takes effect. The date at the top always reflects the current version.

13. Contact

NADI ONLINE FZ-LLC
VUNE2324, Compass building - Al Hulaila, Al Hulaila Industrial Zone-FZ, Ras Al Khaimah, United Arab Emirates
privacy@nadi.online