Privacy Policy

1. Who is responsible

This Privacy Policy explains how Oraq ("we", "us") — owned and operated by Muhammad Faizan Wasif as a sole proprietorship — collects, uses, and protects personal data when you use oraqgpt.com and our application at chat.oraqgpt.com (together, the "Service"). We are the "data controller" for this data under the EU/UK GDPR and similar laws.

2. Data we collect

Account data

• Email address and display name, via Google Firebase Authentication when you sign up with email/password or Google. Passwords are handled exclusively by Firebase; we never see them.
• Session tokens minted by our server after login (random strings used to authenticate API requests).

Profile & academic data

• Your intake answers: degree level, field/discipline, nationality, target regions, budget, GPA, standardized test scores, extracurriculars, work experience, and any personal statement text you enter.

Uploaded documents

• Files you upload — typically transcripts, CVs, and certificates (PDF, DOCX, TXT). We extract their text so it can ground your generated documents.

Generated content & activity

• Documents Oraq generates for you (CVs, SoPs, letters, checklists) and rendered PDF copies.
• Match runs and results, saved favorites, application tracker entries, and export activity.

Technical & billing data

• Request logs (IP address, request ID, endpoint, timestamp) kept for security and debugging.
• If you purchase a plan: your order is processed by Paddle.com as merchant of record. We receive from Paddle the minimum needed to activate your purchase (e.g., product purchased, status, identifiers) — never your full card number.

Please do not upload documents containing more sensitive information than necessary (e.g., passport scans) unless genuinely required for a document you are generating.

3. How we use data & legal bases

We do not sell your personal data, and we do not use your uploaded documents or profile to train AI models.

4. AI processing disclosure

Oraq's core features are AI-powered. To produce matches and documents, portions of your data are sent to third-party large-language-model providers:

• What is sent: your profile summary and intake fields; extracted text of documents you uploaded (used only when generating documents for you); and structured search results about universities/scholarships. For match searches, short queries containing your field, level, and nationality may be sent to web-search providers.
• Providers: model APIs operated by Google (Gemini), OpenAI, and NVIDIA-hosted endpoints, plus web-search via Tavily. These providers process data on our instructions as processors/subprocessors.
• Safeguards: payloads are limited to what a given feature needs; we do not intentionally include payment details or passwords in prompts; and provider terms prohibit using inputs to train their models where such commitments apply to the tiers we consume.

5. Service providers & sharing

We share personal data only with the providers necessary to run the Service:

• Google Firebase — account authentication (email, name, password flows).
• Paddle.com (merchant of record) — checkout, payments, tax handling, refunds.
• Cloudflare — hosting and delivery of the website and app frontend.
• Our infrastructure host — the backend server and PostgreSQL database that store your profile, matches, documents, and files.
• AI/search providers — Google (Gemini), OpenAI, NVIDIA-hosted endpoints, Tavily (see §4).

We may also disclose data if required by law or to protect rights, safety, and security. We do not share your data with advertisers or data brokers. A sale or merger of Oraq would be disclosed with notice before your data transferred subject to this policy.

6. Cookies & local storage

We keep tracking to a minimum. The Service uses:

• Firebase Authentication storage — strictly necessary browser storage to keep you signed in;
• Local preferences — e.g., remembering which pricing region you viewed;
• No advertising, cross-site tracking, or analytics-cohort cookies are placed by us.

7. Data retention

• Account, profile, uploads, matches, and generated documents: kept while your account exists, so the Service keeps working for you.
• Request/security logs: kept for up to 90 days.
• Billing records held by Paddle: retained per tax and accounting requirements (typically 7 years); we retain the minimal order references needed to honor licenses and refunds.
• Deleted uploads are removed from your library immediately and purged from backups within 30 days.

8. Security

We use HTTPS everywhere, Firebase-managed authentication, random session tokens with expiry and revocation, per-user access controls on all stored files and documents, hardened servers behind a restrictive firewall, and least-access operational practices. No system is perfectly secure; please use a unique password and tell us immediately at support@oraqgpt.com if you suspect unauthorized access.

9. Your rights

Depending on where you live (e.g., GDPR in the EU/UK, CCPA/CPRA in California, and similar laws elsewhere), you have rights to:

• Access & portability — get a copy of your data;
• Rectification — correct inaccurate data (most profile data is editable in-app);
• Erasure — delete your account and data;
• Restriction / objection — limit or object to certain processing;
• Withdraw consent — where processing relies on consent;
• Non-discrimination — for exercising these rights (California).

To exercise any right, email support@oraqgpt.com from your account email. We respond within 30 days. You may also complain to your local supervisory authority; we would appreciate the chance to fix problems first.

10. International transfers

Oraq operates globally but its core infrastructure is hosted in the United States. Your data may therefore be processed outside your country, including in countries whose data-protection laws differ from yours. Where required (e.g., EU/UK data), transfers rely on appropriate safeguards such as standard contractual clauses with our providers.

11. Children's privacy

The Service is intended for people aged 16 and older and is not directed at children. We do not knowingly collect data from children under 16. If you believe a child has provided us personal data, contact us and we will delete it.

12. Changes to this policy

We may update this Privacy Policy as the Service evolves. The effective date above will change, and material changes will be highlighted on this page (and in-app where feasible) at least 14 days before taking effect.

13. Contact

Data controller contact point:

• Email: support@oraqgpt.com (mark "Privacy" in the subject)
• Contact form: oraqgpt.com/contact.html

Related policies: Terms of Service · Refund Policy · Pricing