Privacy

Last updated 14 September 2026. No legal team has reviewed this text yet — this is a plain description of what the app actually does, not marketing promises.

Where your data is stored

Qawlak runs on a single server we rent from Contabo in Mumbai, India, which is outside the UAE. That server holds the app, the database, the media you upload, renders, custom fonts, local backups and access logs, and most processing happens there. When remote processing is switched on, transcription or alignment may run at Modal, as described below.

Who processes your data on our behalf

Four services only, each for one reason:

• Modal, Inc. (a US company) — used only when remote processing is switched on, to run the transcription and alignment models on GPUs whose location Modal chooses. It sees the audio extracted from your file only while transcribing or aligning, and keeps nothing afterwards.
• Resend — sends the emails (verification, password reset and notifications) only when email is switched on for the server. It sees the recipient address and the message text.
• Cloudflare R2 — keeps a nightly copy of the database, media and fonts, encrypted at rest, off the server for thirty days. The location of the backup bucket is not chosen yet; we will list it here once it is created.
• Cloudflare DNS — points the domain name at the server only, with nothing in between; it sees no request and no file content.

And two services that turn on only when we add their key; this page names them when that happens:

• PostHog (EU, Frankfurt) — usage analytics: which page was opened, and when a file was uploaded, exported or a review link opened. No cookies, no session recording, and a random id that ends when the tab closes; your name, email and file contents never reach it.
• tawk.to — live chat on the help page, loaded only when its button is pressed. It receives what you type in the chat.

We use no other party. We don't sell your data or share it with anyone for advertising. We use the workspace's videos and caption corrections to train our model unless the workspace owner turns “Help improve Qawlak” off in Settings > Data and Privacy. Turning it off stops future collection and use; it does not remove what was already used. On the Studio plan, training is off and locked. A caption line you rate (thumbs up or down in the editor) is sent to us with its audio, the engine’s text and your correction, and may be used to improve the model even when “Help improve Qawlak” is off or locked. Usage statistics (durations, languages, counts, app version) are collected either way. Source files are kept according to the “Keep source files” setting, which is independent of training.

Backups and retention

Your project stays saved until you delete it — from the project itself or by deleting your whole account. There is no automatic deletion after a time period. Deleting your account permanently and immediately deletes every workspace you are the only member of, with its content, and cannot be undone; a shared workspace passes, with its content, to a remaining member.

The database and projects are backed up once a night to Cloudflare R2, and copies older than thirty days are deleted. Deleting your account removes its data and files from the server immediately and from every backup at the next nightly backup, within 24 hours. Other data you delete, such as a single project, can remain inside backups for up to thirty days; backups are used only to restore the service after a failure.

Accounts and email

Your email address is used to sign in. When email is switched on for the server, these are sent through Resend: a verification link, a password-reset link, review comment and approval notifications to the workspace owner, and a paid-job-finished notice if you turn it on in Settings. No marketing mail. In every case the recovery code you get at signup remains the guaranteed way back into your account.

Review links

A review link you share with clients is a "bearer link" — anyone who has it can open it, comment, and approve it, with no sign-in and no identity check. Treat it like any sensitive link; don't post it publicly, and revoke it from the studio when you're done.

Who sees your data

Only your workspace's members (up to five) see your projects. The operator can reach the server for operations and support only, and opens your files only when you ask for help with a problem.

Contact

This is a pilot edition with no in-app live support yet. See the Help.