Privacy Policy

1. Who is responsible

This Privacy Policy explains how Oraq ("we", "us") — owned and operated by Muhammad Faizan Wasif as a sole proprietorship — collects, uses, and protects personal data when you use oraqgpt.com and our application at chat.oraqgpt.com (together, the "Service"). We are the "data controller" for this data under the EU/UK GDPR and similar laws.

2. Data we collect

Account data

• Email address and display name, via Google Firebase Authentication when you sign up with email/password or Google. Passwords are handled exclusively by Firebase; we never see them.
• Session tokens minted by our server after login (random strings used to authenticate API requests).

Search preferences

• Your study preferences: preferred degree level, field/discipline, target countries/regions, and tuition budget.

Saved favorites & activity

• Programs and scholarships you save to your favorites, application tracker milestone entries, and search history.

Technical & billing data

• Request logs (IP address, request ID, endpoint, timestamp) kept for security and debugging.
• If you purchase a plan: your order is processed by Paddle.com as merchant of record. We receive from Paddle the minimum needed to activate your purchase (e.g., product purchased, status, identifiers) — never your full card number.

3. How we use data & legal bases

We do not sell your personal data.

4. Search query processing & no automated decision-making

When you perform a search, query keywords reflecting your selected discipline, degree level, and region may be processed to retrieve public university program and scholarship listings from public sources.

5. Service providers & sharing

We share personal data only with the providers necessary to run the Service:

• Google Firebase — account authentication (email, name, password flows).
• Paddle.com (merchant of record) — checkout, payments, tax handling, refunds.
• Cloudflare — hosting and delivery of the website and app frontend.
• Our infrastructure host — the backend server and PostgreSQL database that store your profile, search results, documents, and files.
• AI/search providers — Google (Gemini), OpenAI, NVIDIA-hosted endpoints, Tavily (see §4).

We may also disclose data if required by law or to protect rights, safety, and security. We do not share your data with advertisers or data brokers. A sale or merger of Oraq would be disclosed with notice before your data transferred subject to this policy.

6. Cookies & local storage

We keep tracking to a minimum. The Service uses:

• Firebase Authentication storage — strictly necessary browser storage to keep you signed in;
• Local preferences — e.g., remembering which pricing region you viewed;
• No advertising, cross-site tracking, or analytics-cohort cookies are placed by us.

7. Data retention

• Account preferences, saved searches, and application tracker records: kept while your account exists, so the Service keeps working for you.
• Request/security logs: kept for up to 90 days.
• Billing records held by Paddle: retained per tax and accounting requirements (typically 7 years); we retain the minimal order references needed to honor licenses and refunds.

8. Security

We use HTTPS everywhere, Firebase-managed authentication, random session tokens with expiry and revocation, per-user access controls on all stored files and documents, hardened servers behind a restrictive firewall, and least-access operational practices. No system is perfectly secure; please use a unique password and tell us immediately at support@oraqgpt.com if you suspect unauthorized access.

9. Your rights

Depending on where you live (e.g., GDPR in the EU/UK, CCPA/CPRA in California, and similar laws elsewhere), you have rights to:

• Access & portability — get a copy of your data;
• Rectification — correct inaccurate data (most profile data is editable in-app);
• Erasure — delete your account and data;
• Restriction / objection — limit or object to certain processing;
• Withdraw consent — where processing relies on consent;
• Non-discrimination — for exercising these rights (California).

To exercise any right, email support@oraqgpt.com from your account email. We respond within 30 days. You may also complain to your local supervisory authority; we would appreciate the chance to fix problems first.

10. International transfers

Oraq operates globally but its core infrastructure is hosted in the United States. Your data may therefore be processed outside your country, including in countries whose data-protection laws differ from yours. Where required (e.g., EU/UK data), transfers rely on appropriate safeguards such as standard contractual clauses with our providers.

11. Children's privacy

The Service is intended for people aged 16 and older and is not directed at children. We do not knowingly collect data from children under 16. If you believe a child has provided us personal data, contact us and we will delete it.

12. Changes to this policy

We may update this Privacy Policy as the Service evolves. The effective date above will change, and material changes will be highlighted on this page (and in-app where feasible) at least 14 days before taking effect.

13. Contact

Data controller contact point:

• Email: support@oraqgpt.com (mark "Privacy" in the subject)
• Contact form: oraqgpt.com/contact.html

Related policies: Terms of Service · Refund Policy · Pricing