Privacy Policy

1. Information We Collect

Account data: email, display name, date of birth, password (stored securely by Firebase; we never see your raw password). Profile preferences: madhab, knowledge level, language. Chat conversations: stored to enable history, associated with your account only. Usage data: anonymous patterns (topics, session length). Device data: platform, app version only.

We do NOT collect: location data, contacts, photos, device advertising identifiers, or any data beyond what you explicitly provide.

2. AI Processing & Third-Party AI

When you send a message, your question (and any attached images or audio) is transmitted to Google Vertex AI for AI processing. Under our enterprise agreement, Google does not use your data to train its models. Your data is processed solely to generate your response.

3. How We Use Your Data

To provide and personalize the AI service. To enforce usage limits and subscription tiers. To detect and prevent abuse. To comply with legal obligations.

We do NOT: sell your data, display ads, build advertising profiles, track you across apps, or share data with other users.

4. Data Storage & Security

Data is stored on Google Cloud (Firestore) with AES-256 encryption at rest and TLS 1.2+ encryption in transit. Chat history is stored per-user and only accessible by the account owner. PII is automatically scrubbed from feedback data.

5. International Data Transfers

Domla AI LTD is based in the United Kingdom. Your data may be processed on Google Cloud and Vertex AI infrastructure located outside your country of residence, including in the European Union and on Google's global endpoints. Where such transfers involve personal data protected by the UK GDPR or EU GDPR, they are made under appropriate safeguards, including Standard Contractual Clauses and any equivalent mechanisms required by applicable data protection law. By using the Service, you acknowledge that your data may be transferred, processed, and stored in these jurisdictions.

6. Third-Party Services

Google Cloud / Vertex AI: AI processing and hosting. Firebase Authentication: account management. RevenueCat: subscription status (receives only pseudonymous user ID). Apple/Google: payment processing.

Each third-party provider offers the same or equivalent data protection as described in this policy. We do not sell your data to any third party.

7. Data Retention & Deletion

All data is retained while your account is active. When you delete your account (Settings > Danger Zone > Delete Account), deletion is processed immediately and permanently removes: profile, chat history, user memory, feedback, behavioral data, and authentication account. Active subscriptions must be cancelled separately via your app store.

We may retain a minimal amount of information for longer where we are legally required to do so (for example, to comply with tax, accounting, or fraud-prevention obligations), to resolve disputes, or to enforce our agreements. Where we retain data for these purposes, we hold only what is strictly necessary and for no longer than the applicable legal retention period.

8. Your Rights

You have the right to: access the personal data we hold about you; have inaccurate personal data corrected; request deletion (erasure) of your personal data; receive a copy of your personal data in a structured, commonly used, machine-readable format (portability); object to or restrict certain processing; and withdraw consent where processing is based on consent.

You can exercise most of these rights directly in the app (view and edit your profile; delete your account from Settings > Danger Zone). For portability or any other request, contact privacy@domla.ai. We will respond within 30 days.

EU/UK users: you have additional rights under the UK GDPR and EU GDPR, including the right to lodge a complaint with your local supervisory authority (in the UK, the Information Commissioner's Office at ico.org.uk). Our legal bases for processing are: performance of our contract with you (to provide the Service), your consent (where specifically requested), compliance with legal obligations, and our legitimate interests in operating and improving the Service.

California users (CCPA/CPRA): we do not sell or share personal information. You have the right to know, correct, delete, and limit the use of sensitive personal information. You have the right not to be discriminated against for exercising these rights.

9. Children

Domla AI is for users aged 13 and older. We do not knowingly collect personal information from children under 13. If we discover such data, it will be deleted promptly. We comply with COPPA and equivalent regulations.

10. Changes

We may update this policy periodically. Material changes will be communicated via the app or email. Continued use constitutes acceptance.

11. Data Controller & Contact

For the purposes of the UK GDPR and EU GDPR, the Data Controller is:

Domla AI LTD (a company registered in England and Wales, company number 16535313) 128 City Road, London, EC1V 2NX, United Kingdom

For privacy inquiries and to exercise your data rights: privacy@domla.ai For general support: support@domla.ai

12. Cookies & Website Analytics (domla.ai)

The domla.ai website uses a small set of first-party cookies to remember your consent choice, and third-party cookies from Google Analytics 4 (GA4) to understand how visitors discover the site. GA4 is loaded with all consent signals denied by default (Google Consent Mode v2) and only activated after you accept on the cookie banner. We do not use cookies for advertising, retargeting, or cross-site profiling. IP addresses are anonymised on collection. Full details, including cookie names, lifetimes, and opt-out instructions, are set out in our Cookie Policy at domla.ai/cookies.

The Domla mobile app does not use web cookies. In-app analytics for the app follow this Privacy Policy and only run after you have signed in and accepted our Terms of Service.