Last updated: 13 August 2026
This policy explains what ALOP-AI collects, who it is shared with, and what you can do about it. It is written to be read, not to be skimmed past. If anything here is unclear, ask us.
ALOP-AI is operated by Mohamed Fateh Douba, a sole trader established in the United Arab Emirates (“we”, “us”). We are the data controller for the personal data described in this policy.
Postal address: Style Tower 2603, Sharjah, United Arab Emirates
Privacy contact: privacy@alop-ai.com
You must be at least 13 years old to use ALOP-AI. If you are in the European Economic Area or the United Kingdom, you must be at least 16.
We do not knowingly collect personal data from children below these ages. If we learn that we have, we will delete the account and its data. If you believe a child has created an account, email privacy@alop-ai.com and we will act promptly.
A cached answer is stored against a fingerprint of the question, your language, your country, your plan and whether you asked for detail. It carries no user identifier and cannot be traced back to you.
We do not cache an answer that was shaped by anything about you. If the reply drew on your conversation history, your chat summary, anything the service remembers about you, your learned preferences, an image you attached or a file you uploaded, then no fingerprint is calculated and nothing is stored or reused. That is enforced in the code rather than by policy: those turns never produce a cache key at all.
Cached answers expire on their own — an hour for anything you asked about the present, six hours for anything drawn from a web search, and seven days otherwise. They are never readable by other users directly.
| Purpose | Legal basis (UK/EU GDPR) |
|---|---|
| Providing chat, search, image generation and screen analysis | Performance of our contract with you |
| Managing your account and enforcing plan limits | Performance of our contract with you |
| Taking payment and managing subscriptions | Performance of our contract with you |
| Caching search results and non-personal answers so the service stays fast and within its shared daily model allowance | Our legitimate interest in a service that works for everyone using it |
| Preventing abuse, rate limiting, and security investigation | Our legitimate interest in keeping the service available and safe |
| Diagnosing errors and improving reliability | Our legitimate interest in a working product |
| Meeting tax, accounting and legal obligations | Compliance with a legal obligation |
We do not use your conversations to train our own models, and we do not sell your personal data.
ALOP-AI is built on third-party services. The tables below list the processors that receive your data, and what each one receives. Several of these are outside the UAE, including in the United States. Where a service is reached directly by your browser rather than by our server, we say so, because in those cases it also sees your IP address.
| Service | What it receives | Why |
|---|---|---|
| OpenRouter, Inc. (upstream providers: NVIDIA, InclusionAI, OpenAI, Poolside and Google) | Your messages and conversation history | OpenRouter is an LLM API gateway that routes prompts to upstream model providers. All council model inference is routed through it |
| Google (Gemini API) | Images, screen captures and message text | Vision analysis and text processing |
| Brave Search | Generated search queries | Web search results |
| Tavily | Generated search queries | Web search results |
| Google (Custom Search) | Generated search queries | Web and image search results |
| Wikipedia | Topic lookups | Reference information |
| Jina AI | URLs of pages to be read | Extracting readable text from web pages |
| Pollinations.ai | Your image-generation prompts | Generating images |
| Service | What it receives | Why |
|---|---|---|
| Clerk | Account and authentication data | Sign-in and session management |
| Supabase | Account records, chats, usage and audit logs | Our database |
| Stripe | Payment and subscription data | Processing payments. Stripe is a controller in its own right for card data — see Stripe's privacy policy |
| Vercel | Requests to the website, including IP address | Hosting and delivering the frontend |
| Render | API requests, including IP address | Hosting the backend |
| Sentry | Error reports, which may include request context | Diagnosing crashes (only when enabled) |
| Google Fonts | Your IP address when a page loads | Delivering the site's typeface |
We also disclose personal data where we are legally required to, or where it is necessary to establish or defend legal claims or protect someone's safety.
The services above process data in a number of countries, including the United States. Where data leaves the UK or EEA, we rely on the receiving provider's own transfer safeguards — typically Standard Contractual Clauses or an adequacy decision. You can ask us for details of the safeguards that apply to a particular provider.
| Data | Retention |
|---|---|
| Chats and messages | Until you delete them or close your account |
| Account record | Until you close your account |
| Usage counts | For the current billing period, plus a rolling history for limit enforcement |
| Audit log, including IP addresses | 90 days |
| Cached search queries and results | 15 minutes |
| Cached answers to non-personal questions | 1 hour, 6 hours or 7 days, depending on how quickly the answer goes out of date. No user identifier is stored with them |
| Uploaded files | With the chat they belong to; deleted with it |
| Screen captures | Not stored on our servers after the response is produced |
| Billing records | As required by tax and accounting law, typically 5 years |
Wherever you live, you can ask us to:
You can delete individual chats and your account from within the app. For anything else, email privacy@alop-ai.com. We will respond within 30 days. We will not charge you or degrade your service for exercising these rights.
If you are in the UK or EEA and think we have handled your data badly, you may complain to your national data protection authority. We would rather you told us first.
This section applies if you live in California, under the CCPA as amended by the CPRA.
Categories of personal information we have collected in the past 12 months:
We collect these from you directly and from the services listed in section 5. We use them for the purposes in section 4, and we disclose them to the processors in section 5 for business purposes only.
We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We have not done so in the past 12 months. We do not knowingly sell or share the personal information of anyone under 16. Because we do not sell or share, an opt-out is not required — but we will honour a Global Privacy Control signal as an opt-out request regardless.
We do not use or disclose sensitive personal information for purposes requiring a right to limit. You have the right to know, delete, correct, and to be free from discrimination for exercising any of these. You may use an authorised agent; we may ask them to prove they act for you. Requests go to privacy@alop-ai.com.
All traffic is encrypted in transit with TLS. Database access is restricted by row-level security so one account cannot read another's data. API endpoints are rate limited, and administrative access requires several independent credentials.
No system is perfectly secure, and we will not pretend otherwise. If a breach affects your personal data and creates a real risk to you, we will tell you and the relevant authority without undue delay.
ALOP-AI generates answers automatically. It does not make decisions with legal or similarly significant effects about you. Its output can be wrong, and you should not rely on it as professional, legal, medical or financial advice.
We may update this policy. If a change materially affects your rights, we will tell you in the app or by email before it takes effect. The date at the top always reflects the current version.