Legal & compliance

Privacy Policy

Last Updated: October 20, 2026

This Privacy Policy explains how Rahawan AI ("Company," "we," "our," or "us") collects, uses, shares, and protects personal information when you visit our websites, create an account, or use our SaaS tools (the "Services"). By using the Services, you acknowledge this Policy. If you do not agree, please do not use the Services.

1. Who We Are

Rahawan AI is a universal cloud-based SaaS and autonomous SEO engine serving all modern websites, startups, e-commerce, content portals, and businesses of all sizes — with general growth engines and optional pre-tuned vertical suites — providing SEO, GEO, auditing, schema, content orchestration, keyword engines, and related automation tools. Contact: privacy@rahawan.ai · support@rahawan.ai · legal@rahawan.ai · https://rahawan.ai

Delaware LLC legal entity details will be added here upon formation via Stripe Atlas. Operational privacy requests are already accepted at the emails above.

2. Scope and Roles

  • Data Controller: For account, authentication, organization profile, and billing metadata we collect to operate the commercial relationship, Rahawan AI acts as Data Controller (or equivalent under applicable law).
  • Data Processor: For connected site workspaces (general Universal Core and optional vertical suites), crawl/audit outputs, content jobs, keyword runs / word banks configured for your properties, and similar customer workspace data, you generally act as Data Controller; we process that data as Data Processor / service provider solely to provide the Services.
  • This Policy does not cover third-party websites you analyze or platforms you connect (Google, Meta, payment processors, AI model providers, etc.), which have their own policies.

3. Data Deletion & Export

Data deletion and export requests are handled via privacy@rahawan.ai. Organization owners may also use in-product export and deletion-request tools where available.

  • Export: Upon a verified request, we will provide a portable copy of personal data we hold about you (and, where you are the organization owner, workspace data you are authorized to receive) in a commonly used electronic format within a reasonable period.
  • Deletion: Upon a verified request, we will delete or anonymize personal data within a reasonable period unless retention is required by law or for legitimate security, accounting, dispute, or fraud-prevention needs.
  • Verification: We may need to verify your identity and authority over an organization account before fulfilling a request.
  • Processors: Where we act as Data Processor, we will assist you in responding to end-user requests concerning Customer Content you control, as required by our Terms and applicable law.

4. Information We Collect

4.1 Information you provide

  • Account and profile: name, email, organization name, password hashes, role, language preference, brand profile fields.
  • Billing: billing contact, plan selection, invoice metadata, and payment status references returned by our processors.
  • Support communications: messages you send to support, privacy, or legal inboxes.
  • Optional brand assets: logos, contact details you choose to show on reports.

Rahawan AI does not store, process, or transmit full payment card numbers or CVV codes on its servers. All payments are securely tokenized and handled directly by PCI-DSS certified payment processors (including Stripe).

4.2 Information from your use of the Services

  • Site configuration: URLs, site labels, industry/vertical selection, task metadata, report summaries, request tickets.
  • Keyword runs & word banks: queries, selected keywords, and related workspace outputs you generate for authorized domains.
  • Technical logs: IP address, user agent, timestamps, CSRF/session identifiers, security events (e.g., failed logins).
  • Product analytics limited to service improvement and abuse prevention (no sale of personal data).

4.3 Credentials and secrets you store

If you store API keys, tokens, or similar secrets in our vault features, they are encrypted at rest using industry-standard cryptography and used only to perform authorized tasks for your organization. Vault secrets are never sold, never included in ordinary data exports in clear text, and are accessible only under strict operational controls.

5. How We Use Information

  • Provide, secure, and improve the Services (including authentication, auditing, reporting, keyword engines, and support).
  • Process subscriptions, invoices, and payment recovery through PCI-DSS certified processors.
  • Communicate service notices, security alerts, and (with consent or as permitted) product updates.
  • Detect fraud, abuse, and Acceptable Use violations.
  • Comply with law and enforce our Terms.
  • Develop aggregated, de-identified insights that do not identify you or your clients.

6. Legal Bases (GDPR / UK GDPR where applicable)

  • Contract: to provide the Services you request.
  • Legitimate interests: securing the platform, preventing abuse, improving reliability — balanced against your rights.
  • Consent: where required for optional cookies or marketing emails (you may withdraw at any time).
  • Legal obligation: tax, accounting, and lawful requests.

7. How We Share Information

We do not sell personal information and we do not share personal information for cross-context behavioral advertising as those terms are commonly defined under the CCPA/CPRA.

  • Service providers: hosting, email delivery, PCI-DSS certified payment processing (including Stripe), error monitoring, and similar processors under contractual confidentiality and security obligations.
  • Organization members: users you invite can see data within your workspace according to their roles.
  • Legal: if required by law, regulation, or valid legal process, or to protect rights, safety, and integrity.
  • Business transfers: in a merger, acquisition, or asset sale, subject to continued confidentiality protections.

8. International Transfers

We may process data in the United States, the United Arab Emirates, and other countries where we or our processors operate. Where required, we use appropriate safeguards (such as standard contractual clauses or equivalent mechanisms) for transfers from the EEA/UK.

9. Retention

We retain account and billing records for as long as your organization remains active and thereafter as needed for legal, tax, and dispute purposes. Task outputs, keyword-run artifacts, and logs are retained according to product settings and operational needs. Deletion timelines after a verified privacy@rahawan.ai request follow Section 3 unless a longer period is required by law or for legitimate security/accounting needs.

10. Security

  • TLS encryption in transit for the public site and app where supported.
  • Encrypted vault storage for secrets; hashed passwords; CSRF protections; rate limiting on authentication.
  • Role-based access inside organizations; operational logging of sensitive actions.
  • Payment card data is never stored on Rahawan servers; tokenization and card handling occur at PCI-DSS certified processors (including Stripe).
  • No method of transmission or storage is 100% secure; please use strong unique passwords and protect your API keys.

11. Your Rights

GDPR / UK GDPR (where applicable)

You may have rights to access, rectify, erase, restrict, object, and data portability, and to lodge a complaint with a supervisory authority. Erasure and portability requests are routed through Section 3 (privacy@rahawan.ai).

CCPA/CPRA (California)

California residents may request to know, delete, and correct personal information, and to opt out of "sale" or "sharing" — we do not sell personal information. We will not discriminate for exercising privacy rights.

UAE PDPL and other laws

Where the UAE Personal Data Protection Law or other local laws apply, we honor applicable access, correction, and deletion rights.

To exercise rights, email privacy@rahawan.ai. You may also copy support@rahawan.ai. We may need to verify your identity and authority over an organization account.

12. Cookies and Similar Technologies

We use essential cookies and similar technologies for authentication, security (including CSRF), and session continuity. We do not use non-essential advertising cookies on the core app by default. If we introduce optional analytics cookies that require consent in your region, we will present a consent mechanism.

13. Children

The Services are not directed to children under 16 (or the minimum age in your jurisdiction). We do not knowingly collect personal information from children. If you believe we have, contact privacy@rahawan.ai and we will take appropriate steps.

14. Changes to This Policy

We may update this Policy from time to time. We will post the revised version with a new "Last Updated" date and, for material changes, provide additional notice when appropriate. Continued use after the effective date constitutes acceptance of the updated Policy.

15. Contact

Privacy (deletion & export)
privacy@rahawan.ai