GDPR & Your Data Rights

1. About This Page

This page is for people in the European Economic Area, the United Kingdom, and Switzerland. It adds GDPR-specific detail to our Privacy Policy, which describes what data we collect, who receives it, and how long we keep it.

2. Controller

MeetNour LLC has no establishment in the EU or the UK. Send every data protection request or question to the address above.

3. Legal Bases for Processing

Faces and voices

Photos, videos, and audio of people are personal data. Under the GDPR they become "biometric data" only when they are processed with technical means to uniquely identify a person. MeetNour does not do that: we do not build face or voice templates and we do not identify anyone. Where the law nevertheless requires consent for this processing, we rely on the explicit consent you give in the Media & AI Processing Agreement (Article 9(2)(a)), which you can withdraw by deleting the upload or the talent.

If you upload material that shows other people, you are responsible for having a lawful basis to do so, and you confirm that you have their permission.

4. Your Rights

Automated decisions. We do not make decisions that have legal or similarly significant effects on you by automated means alone. "Nour picks" selects an AI model for a request, which affects how many credits the request costs; the cost is shown before you confirm, and you can choose the model yourself.

5. Recipients

The providers that receive personal data, and what each one receives, are listed in Section 6 of our Privacy Policy. We update that list when we add or replace a provider.

Infrastructure providers, such as our database, storage, hosting, and email providers, act as our processors under their data processing terms. AI model providers receive the content of your request in order to generate a result; they handle it under their own terms and privacy policies, and some of them act as independent controllers of the data they receive. We cannot verify or guarantee how each provider handles data after it receives it.

Payments are processed by Stripe (United States) through its Managed Payments service. Purchases are sold through Link, Stripe's checkout service, which acts as the merchant of record. Stripe receives your email address, your MeetNour account ID and what you buy from us, and the name, billing address and payment details you enter at checkout directly from you. It handles them, together with the record of each purchase, sales tax, fraud checks and payment disputes, under its own privacy policy: link.com/privacy.

6. Transfers Outside the EEA, UK, and Switzerland

MeetNour is based in the United States, so using the Service means your data is transferred to the United States. Our providers process data in the United States and in other countries, which may include Canada, Hong Kong, and mainland China. We rely on the following:

• Adequacy decisions, where the European Commission or the UK government has recognised the destination, including the EU–US Data Privacy Framework for providers that are certified under it.
• Standard Contractual Clauses, where a provider includes them in its data processing terms.
• Necessity for the contract with you (Article 49(1)(b)), where neither of the above is available: you ask us to generate content with a particular AI model, and sending your request to the company that operates that model is necessary to do it.

7. Security Measures

• Encrypted connections (HTTPS/TLS)
• Sign-in and password handling by Firebase Authentication
• API keys and assistant tokens stored only as hashes
• Requests checked on the server, restricted origins, and security headers
• Rate limits and automated monitoring for unusual activity
• Access to production systems limited to the people who need it
• Generation requests sent to AI providers without your name or email address
• Card payments handled entirely by Stripe, our payment provider

Files are delivered from long, hard-to-guess web addresses that are not protected by a sign-in. See Section 7 of the Privacy Policy.

8. Personal Data Breaches

If a personal data breach is likely to result in a risk to people's rights and freedoms, we will notify the competent supervisory authority within 72 hours of becoming aware of it, as Article 33 requires. If the risk is high, we will also notify the people affected without undue delay, as Article 34 requires.

9. Retention

Retention periods are listed in Section 9 of the Privacy Policy, and for faces and voices in its Section 4.

10. Children

MeetNour is for people aged 18 and over. We do not knowingly process the personal data of anyone under 18 as a user of the Service. If you believe a minor has created an account, email [email protected].

11. AI-Generated Content

• Everything you generate with MeetNour is produced by AI. Voices are synthetic.
• The EU AI Act and other laws require people who publish AI-generated or AI-altered content that looks real — especially content showing real people — to say that it is artificial. When you publish content made with MeetNour, that duty is yours.
• We may add visible or machine-readable markers to generated content to show that it was made by AI. You may not remove them.
• MeetNour is a content creation tool. We do not offer it for the high-risk uses listed in Annex III of the EU AI Act, and you may not use it for them.

12. Complaints

You have the right to complain to your data protection authority. EU and EEA authorities are listed at edpb.europa.eu. In the UK, the authority is the Information Commissioner's Office at ico.org.uk. We would appreciate the chance to help first: write to [email protected].

13. Changes

When we change this page we update the date at the top. If a change is material, we will tell you by email or in the app before it takes effect.