Skip to main content

Privacy Policy

Last updated: August 8, 2026

1. Who We Are

Nawah Ltd is an AI applications company that provides an AI-powered business management platform for founders, organizations, and investors. We are committed to protecting your privacy and handling your personal data transparently.

This Privacy Policy should be read together with our Terms of Use and our Refund & Cancellation Policy.

Company details

  • Company name: Nawah Ltd
  • Tax number: 3740432
  • Address: 23 Elbatrawy St, Sara Tower, 3rd Floor, Abbas El-Aqqad, Nasr City, Cairo, Egypt
  • Contact: contact@nawah.ai | 01000049999
  • Data Protection Officer: contact@nawah.ai

2. What Information We Collect

Company and business data

  • Company profiles: business details, registration information, industry sector
  • Team members: employee names, roles, contact information, access permissions
  • Customer data: your customers’ contact details, interaction history, sales pipeline
  • Financial data: revenue, expenses, financial projections, business performance metrics, invoices
  • Inventory data: stock levels, products, suppliers, movements
  • Operational data: projects, tasks, plans, sales operations
  • Investor relations data: portfolio company information shared by founders, investment performance metrics

User account information

  • Personal details: name, email, phone number, login credentials, role (e.g. founder, team member, angel investor, VC)
  • Usage data: platform interactions, feature usage, session activity
  • Communications: support requests, feedback, system notifications

AI interaction data

  • Chat inputs: natural language requests submitted to our AI assistant
  • Uploaded documents: files you upload for AI processing (e.g. spreadsheets converted to projects, quotations converted to purchase orders)
  • Voice inputs: audio recordings (where voice features are enabled) and resulting transcriptions
  • AI outputs: generated responses, suggestions, and structured data extracted from your inputs

Billing and subscription data

Where your organization subscribes to a paid plan, we collect and hold:

  • Subscription details: plan, billing cadence (monthly or annual), seat count, subscription status, current billing period, renewal date, and any discount applied to your organization
  • Billing contact and tax details: the billing email address and, where you provide it, your organization’s tax registration number
  • Invoices and receipts: amount charged, currency, VAT breakdown (net subtotal, VAT rate, VAT amount, total), billing period, and payment outcome
  • Payment method reference: a token issued by our payment gateway, together with the non-sensitive card descriptors it returns to us (such as card brand, last four digits, and expiry). We never receive or store your full card number or security code — see section 6
  • Billing audit records: charge attempts and outcomes, subscription state changes, gateway callbacks, refunds and chargebacks, each with a timestamp and a trace identifier used for support and investigation

Usage metering data

To enforce the fair-use limits described in our Terms of Use, we record:

  • AI usage: counts of AI tokens consumed, attributed to the organization and to the member who made the request, within the current allowance window
  • Storage usage: total bytes stored by the organization

This data is used to apply and explain usage limits and to manage our own infrastructure costs. It is not used to bill you, and it is not sold or shared for advertising.

Technical information

  • Device data: IP address, browser type, operating system
  • Performance data: usage analytics, error logs, system performance metrics

3. How We Use Your Information

Service delivery

  • Managing company profiles and access for different user roles (founders, employees, investors)
  • Processing customer data for CRM and sales pipeline functionality
  • Generating financial reports, invoices, dashboards, and business analytics
  • Managing inventory, operations, planning, and project workflows
  • Providing AI-powered business insights and recommendations
  • Enabling investor access to portfolio company data when authorized by the founder

AI features

  • Processing your natural language requests to perform business actions
  • Extracting structured data from uploaded documents
  • Transcribing voice inputs (where applicable)
  • Generating insights, summaries, and recommendations

Billing and subscription management

  • Starting and tracking free trials, and telling you when one is ending
  • Calculating what you owe — seat count, cadence price, prorated seat additions, any discount, and VAT — and charging it to your payment method
  • Processing renewals, retrying failed payments, and managing grace periods and suspensions
  • Issuing receipts and maintaining your billing history
  • Investigating and resolving billing questions, refunds, and payment disputes
  • Meeting our tax, accounting, and record-keeping obligations
  • Applying and explaining AI and storage usage limits

Platform operations

  • User authentication and account management
  • Platform performance monitoring and improvement
  • Customer support and technical assistance
  • Data backup and security maintenance

Analytics and marketing

  • Usage analytics to enhance platform features
  • Marketing communications about our services (with your consent)

We never sell your business data or share it with competitors. We do not use your business data, chat inputs, uploaded documents, or voice inputs to train generative AI models.

4. AI Processing and Third-Party Model Providers

Nawah’s chatbot and AI features are powered in part by large language models and AI services provided by trusted third-party providers (such as Anthropic, OpenAI, Microsoft Azure, and similar). When you interact with our AI features:

  • Your prompts, uploaded documents, and (where applicable) voice transcriptions are sent to these providers under enterprise contracts that prohibit the use of your data to train their models.
  • Providers may retain inputs and outputs only for short periods for abuse monitoring, as required by their service terms.
  • We do not retain or use your business data to train Nawah’s own AI models.
  • AI outputs are generated automatically and may contain inaccuracies. You should review AI-generated content before acting on it.

A current list of AI subprocessors is available on request at contact@nawah.ai.

We process your personal data based on:

  • Contract performance: to deliver our services to you, and to take and process the subscription payments you have agreed to
  • Legitimate interest: to improve our services, secure the platform, prevent fraud and payment abuse, and enforce the usage limits that keep our costs sustainable
  • Consent: for marketing communications and any optional processing
  • Legal obligation: to comply with applicable laws and regulations, including Egyptian tax and accounting record-keeping requirements for invoices and receipts, Egypt’s Personal Data Protection Law (Law No. 151 of 2020) and, where applicable, the EU/UK General Data Protection Regulation

6. Data Sharing and Third Parties

We only share your data with trusted service providers who help us deliver our services.

Service providers

  • Cloud hosting: AWS (Amazon Web Services) for secure data storage and compute
  • AI providers: third-party AI model providers (see Section 4)
  • Communications: email and notification delivery providers

Payment processing

Subscription payments are processed by Paymob, our authorized payment gateway.

  • Card details are entered into, and stored by, the gateway. Nawah never receives, stores, or logs your card number or security code. We keep only a token reference that lets us charge the saved payment method for renewals and for changes you request.
  • We share with the gateway what it needs to process a payment: the amount and currency, an identifier for the charge and your organization, and the billing contact details required by the gateway and the card schemes.
  • The gateway returns to us the outcome of each transaction, a payment token, and non-sensitive card descriptors such as card brand, last four digits, and expiry.
  • Paymob processes this data as an independent payment service provider under its own terms and privacy policy, and is subject to card-industry (PCI DSS) requirements.
  • In a payment dispute or chargeback, we may share transaction records, receipts, and relevant access logs with the gateway, your card scheme, or your bank to evidence the charge.

Investor access

Where a founder enables investor access to a company’s data on the platform, the relevant operational and financial information will be visible to the authorized investor(s). Founders control which data is shared and may revoke investor access at any time through account settings. Investors agree to use such data only for monitoring their investment and to keep it confidential.

All third-party providers are carefully selected and contractually bound to protect your data in line with applicable privacy laws.

7. Data Security

Security measures

  • Industry-standard encryption for data in transit and at rest
  • Regular security audits and vulnerability assessments
  • Access controls and authentication protocols
  • Backup and disaster recovery procedures

Payment data security

  • Card numbers and security codes are handled entirely by our payment gateway and never reach Nawah’s systems, which keeps our platform outside the scope of card-data storage
  • Payment gateway credentials are held in a managed secrets store, never in application code, and can be rotated without a code change
  • Every callback we receive from the payment gateway is cryptographically verified before it is allowed to change anything about your subscription; unverified callbacks are rejected and logged
  • Billing data and actions are restricted to an organization’s owner and admins, and no organization can access another organization’s billing data

Breach notification

In the event of a personal data breach that is likely to result in a risk to your rights, we will notify affected users and the relevant supervisory authority without undue delay, in accordance with applicable law.

8. Data Retention

  • Active accounts: data is retained while you actively use our services
  • Inactive accounts: business and user data are deleted two years after account inactivity
  • Customer data: retained as long as needed for your business operations
  • Financial records: kept according to legal and tax requirements
  • Subscription invoices, receipts, and billing audit records: retained for at least 5 years, in line with Egyptian tax record-keeping requirements. These records are not removed by account deactivation or a data-deletion request, because we are required by law to keep them
  • Usage metering records: retained for the current allowance window and a limited period afterwards, so that limits can be explained and disputes resolved
  • Billing state does not affect retention: we never delete your business data because a payment failed, a trial expired, or a subscription was cancelled or suspended. Data is retained through every billing state and can be restored by resuming your subscription
  • AI inputs and outputs: retained as part of your conversation history within the platform; you may delete chat history at any time
  • System logs: retained for security and performance monitoring (up to one year)

9. Your Rights

For users in Egypt (Personal Data Protection Law No. 151 of 2020)

You have the right to:

  • Be informed about how your data is processed
  • Access your personal data
  • Correct or update inaccurate data
  • Request deletion of your personal data
  • Object to or restrict processing
  • Withdraw consent at any time

For users in the EU or UK (GDPR)

You have the right to:

  • Access: request a copy of your personal data
  • Rectification: correct inaccurate or incomplete data
  • Erasure: request deletion of your personal data
  • Portability: receive your data in a structured format
  • Restriction: limit how we process your data
  • Objection: object to processing based on legitimate interests
  • Withdraw consent: for marketing and other consent-based processing

To exercise these rights, contact us at contact@nawah.ai. We will respond within the timelines required by applicable law.

Limit on erasure of billing records. Where we are legally required to retain invoices, receipts, and related billing records — for example under Egyptian tax law — we will keep those specific records for the required period even after you ask us to delete your data, and we will tell you when this applies. All other personal data is deleted as requested.

10. International Data Transfers

Where data is transferred internationally — for example, to AI providers or cloud subprocessors operating in other regions — we ensure appropriate safeguards are in place, such as Standard Contractual Clauses, adequacy decisions, or equivalent protections recognized under Egyptian and applicable foreign law.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by email or through the platform.

12. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us:

For Egyptian residents, complaints may be submitted to the Personal Data Protection Center. For EU or UK residents, you also have the right to lodge a complaint with your local data protection authority.