Skip to main content

Privacy Policy

العربية

Last updated: 2026-09-28 — Changelog · privacy-v2-2026-09-28

Privacy Policy

Introduction

Nashr ("we," "us," "our") is committed to protecting your privacy. This Privacy Policy describes how we collect, use, disclose, and safeguard your personal information when you use the Nashr platform for social media account management ("the Service").

Information We Collect

Information You Provide

When you create an account, we may collect:

  • Your business name and email address
  • Profile information (store name, category, description)
  • Communications you send us (support inquiries, feedback)

Information Collected Automatically

When you use the Service, we automatically collect:

  • Device and browser information (device type, operating system, browser version)
  • Usage data (pages visited, actions taken, timestamps)
  • IP address (truncated for storage, not logged in raw form)
  • If you use the mobile app and allow notifications: a push notification token and your device model, which we store and use only to deliver notifications to your device
  • Your approximate country, derived from your IP address when you sign up, used to set your default region settings and which consent settings apply to you

Information from Third Parties

When you connect social media accounts:

  • We receive profile information from the platforms you authenticate
  • Engagement metrics and analytics from your posts
  • Data about users who interact with your content (comments, likes, followers). If you turn on AI suggestions, the text of comments you receive may be sent to our AI providers to classify them and draft replies; commenter usernames are removed before sending

How We Use Your Information

We use your information to:

  • Provide and maintain the Nashr service
  • Schedule and publish content to your connected social media accounts
  • Generate AI-powered content suggestions, captions and reply drafts, only if you turn on AI suggestions
  • Provide engagement analytics and performance insights
  • Send weekly performance reports (at your option)
  • Communicate with you regarding updates, security, and support

Legal Basis for Processing

Where data protection law requires a legal basis, we rely on:

  • Consent: when you grant us explicit permission (e.g., connecting social media accounts, turning on AI suggestions, or opting in to marketing).
  • Contract Performance: processing necessary to deliver the Service to you.
  • Legitimate Interests: for service improvement, security, and fraud prevention, balanced against your rights.
  • Legitimate Interests (people who comment on your posts): when you have turned on AI suggestions, we process the text of comments people leave on your content, with their usernames removed, to classify the comments and draft replies for you. We rely on our and your legitimate interest in responding to your customers, and we send only the comment text, never the commenter's username.

Your Consent

By accepting the Terms and this Privacy Policy when you create an account, you consent to the processing necessary to provide the Service, including the cross-border transfer of your data described in International Data Transfers below.

AI suggestions are separate and optional. Before the first time the Service uses AI for you, we ask for your explicit consent. If you agree, your photos, business details and the comments you receive (with usernames removed) are sent through OpenRouter, our AI routing provider, to AI model providers, including Mistral AI, Alibaba (Qwen) and TypeSafe (Jev), and may be processed outside your country. You can withdraw this consent at any time in Settings; you can always write and publish posts without AI.

Marketing communications are separate. We send marketing messages only with your separate, optional opt-in, which you can give or decline independently of accepting the Terms and this Privacy Policy, and which you can withdraw at any time without affecting your use of the Service.

Cookies and Similar Technologies

We use cookies and similar technologies for two main purposes:

  • Essential cookies needed to run the Service (e.g., authentication, security).
  • Analytics cookies that help us understand usage and improve the Service.

For analytics we rely on privacy-friendly, behavioral analytics providers; the authoritative, current list of these providers and their locations is maintained on our Subprocessors page. You can accept or reject non-essential cookies through our cookie banner, and you can change your choice at any time. Rejecting non-essential cookies does not affect access to the core Service. For more detail on the categories of cookies we use, see our Cookie Policy.

Data Sharing and Disclosure

We may share your information with:

  • Service Providers (Subprocessors): third-party vendors that help operate the Service. We use third-party subprocessors to operate the Service; our current subprocessors, their purpose, and their location are listed on our public Subprocessors page, which we keep up to date.
  • AI providers: only if you turn on AI suggestions, as described in Your Consent above.
  • Social Media Platforms: when publishing content through the Service, on your instruction.
  • Payments: Paddle, our Merchant of Record, which processes payments and acts as an independent controller for payment data.
  • Legal Obligations: when required by law or in response to valid legal requests.

We never sell your personal information.

International Data Transfers

Your data may be processed outside your country. Our infrastructure and service providers are located in the European Union (Frankfurt and the Netherlands), the United States, and other countries, and AI requests are routed by OpenRouter to model providers that may be located in other regions. Where we transfer personal data across borders, we rely on appropriate safeguards — such as Standard Contractual Clauses — consistent with applicable data protection law. You can see each provider and its location on our Subprocessors page.

Data Retention

We retain your information for as long as your account is active or as needed to provide you the Service. Upon account deletion:

  • When you request deletion, your connected social accounts are disconnected and their access tokens revoked, and your profile at our social publishing provider (Ayrshare) is deleted
  • For 7 days after your request you can undo the deletion. Undo restores your content, but you will need to reconnect your social accounts
  • Other personal information is deleted or anonymized within 60 days
  • Backups may be retained for up to an additional 90 days

Data Security

We implement industry-standard security measures including:

  • Encryption in transit (TLS 1.3) and at rest (AES-256)
  • Strict access controls and authentication
  • Regular security monitoring and auditing

Data Breach Notification

If a personal-data breach occurs that may harm your data or your rights, we will notify the relevant supervisory authority without undue delay (generally within 72 hours where required), and we will inform affected users without undue delay, with enough detail for you to understand the risk and take protective action. We maintain a written incident-response process and an internal record of incidents.

Your Rights

Depending on where you live, you may have the right to access, correct, update, delete, or receive a copy of your personal data, to object to or restrict certain processing, and to withdraw consent at any time. To exercise any of these rights, contact us at [email protected]. You can also exercise many of these rights, including deleting your account, from within the Service settings.

You also have the right to lodge a complaint with a data protection authority. If you are in the Kingdom of Saudi Arabia, you can file a complaint with the Saudi Data & AI Authority (SDAIA) through its personal data protection portal: https://dgp.sdaia.gov.sa/wps/portal/pdp/home/. If you are in the European Economic Area or the United Kingdom, you can complain to your local data protection authority.

Children's Privacy

The Service is not intended for individuals under the age of 18. We do not knowingly collect data from children.

Contact Us

The data controller responsible for your personal data is Millennium Techno Computer Consultancy Co. W.L.L (operating as Nashr), a limited liability company registered in the Kingdom of Bahrain (Commercial Registration No. 124175), Manama, Kingdom of Bahrain.

For privacy-related questions or to exercise your data privacy rights:

Changes to This Policy

We will notify you of material changes to this Privacy Policy via email or through the Service before the changes become effective.

changelog

privacy-v2-2026-09-28 (2026-09-28)

  • AI suggestions now need your separate, explicit consent; named our AI routing and model providers.
  • Disclosed push notification token, device model and IP-derived country.
  • Disclosed that comment text (usernames removed) may be sent to AI providers when AI suggestions are on, and the legal basis for it.
  • Clarified deletion: social access revoked and publishing profile deleted at your request; undo within 7 days restores content but you reconnect your social accounts.
  • Added the SDAIA complaint route.

privacy-v1-2026-09 (2026-09-07)

  • Initial release of the Privacy Policy.