The short version
- Your paper belongs to you. You upload a manuscript; we run automated checks on it to produce your review, and we look at reviews to make the reviewer better. Those are the only reasons we touch your text.
- Your manuscript is never used to train any AI model, ours or anyone else's, and it is never handed to a third party for analysis. The only analysis is our own, in-house.
- Sections of your text go to third-party AI model providers through a single routing layer, only to write your review, under terms that forbid training. We do not sell your data or advertise with it.
- Your files are encrypted at rest on our EU server. Every open of a file is logged, and you can read that log on the paper page.
- Delete any paper, or your whole account, at any time. Deletion is immediate, files and versions alike, and clears from backups within 14 days. No advertising trackers. Adults (18+) only.
1. Who we are
Waraq ("we", "us") is an AI-assisted pre-submission manuscript review service at waraq.io and app.waraq.io, operated by Alurood Alilmiyya Company for Education, a limited liability company registered in the Kingdom of Saudi Arabia (Commercial Registration 7037878365), at 4309 King Abdullah Al Saud Road, Al Raed, Riyadh. We are the controller of the personal data described here. Contact: privacy@waraq.io (or support@waraq.io).
This policy covers the website, the application, our API and our emails. Waraq is for researchers and other adults; it is not directed at anyone under 18, and we delete any account we learn belongs to a minor.
2. What we collect
- Account data. Your email address (used for one-time sign-in codes; we store no passwords), plan and subscription status, a Polar customer reference, and any profile details you add. Anonymous trial accounts are deleted after 30 days of inactivity unless you sign in.
- Your manuscript and what we derive from it. The
.docxyou upload, the text we extract, the reviewed.docx, findings, score, edits and reports, every version of your accept/reject decisions, your upload questionnaire answers, and an access log of every open of the file (who, why, when). The in-app assistant also keeps a short summary of each finished review (score, edit count, top finding titles) that contains no manuscript text. - Usage and technical data. Server logs (IP address, user agent, timestamps, request paths), job traces, error reports and product-analytics events, including in-app session replays with all typed input masked (Section 8).
- Billing data. Polar Software Inc., as merchant of record, collects payment details, billing address and tax information directly. We never see card numbers; we receive subscription status, product, amounts and a customer reference.
- Communications. Emails you send us, in-app feedback, and delivery metadata for emails we send you.
We do not collect special-category data on purpose. If your manuscript contains such data (for example patient-level information), you are responsible for having the right to share it with us and our processors (Terms, Section 6).
3. Why we process it
| Purpose | Legal basis |
|---|---|
| Run your review; accounts, sign-in and security; billing and quotas; transactional email; assistant memory | Performance of a contract (legitimate interest for security; legal obligation for billing records) |
| Product newsletter | Consent (opt-in; one-click unsubscribe) |
| Quality reads (Section 7); analytics and error monitoring; preventing abuse; answering legal requests | Legitimate interest (you can object), or consent where your local law requires it; legal obligation |
We do not sell personal data, in the ordinary sense or in the sense used by US state privacy laws, and we do not share it for targeted advertising.
4. AI processing and model training
No training, ever. We do not use your manuscript, the extracted text, the findings, the reviewed file, your questionnaire answers or your feedback to train, fine-tune, distil or otherwise improve any machine-learning model, ours or a third party's.
No third-party analysis. Nobody outside Waraq analyses your paper for us. Model providers receive sections of it for one purpose, writing your review, and nothing else. The only analysis of your paper and its review is our own, in-house, to produce the review and to improve the reviewer (Section 7).
Our providers are bound to the same rule. Every provider that receives manuscript text does so under a Data Processing Addendum and API terms that prohibit training on customer inputs. If a provider cannot give that assurance, we stop routing text to it.
What the models receive. To write your review, parts of your text are sent to third-party AI model providers through a single routing layer, under contracts that prohibit training on your text and limit retention to short abuse-monitoring windows (typically up to 30 days). We do not name individual providers publicly because our review pipeline and model choices are proprietary; the categories and safeguards are the same for every provider (see /legal/data-processing). A full list of AI model providers is available to customers on request at privacy@waraq.io under confidentiality.
Provider-side logging. Our routing layer records only request metadata (timing, tokens, cost); payload logging is switched off, so the text itself is not stored there. Model providers may keep API inputs for up to 30 days for abuse monitoring; none may train on them.
Automated outputs. The score, findings and suggested edits are automated and advisory; they have no legal or similarly significant effect on you.
5. How long we keep data
| Data | Kept for |
|---|---|
Original uploaded .docx | 180 days after the last review activity, or until you delete the paper. Results stay visible; the original can no longer be re-reviewed or downloaded |
Reviewed .docx (all variants) | 365 days after the review finished, or until you delete the paper. Score and findings stay visible |
| Findings, score, reports, edits, decision versions, access log, assistant memory, account data | Until you delete the paper or account |
| Anonymous trial accounts | 30 days of inactivity, then the account and its files are deleted |
| Billing records (held by Polar) | As required by tax law, typically 7 to 10 years |
| Server and container logs, and job traces | Rotated and pruned within 90 days |
| Nightly backups (encrypted with a key held offline) | 14 days |
The 180-, 365- and 30-day limits run in a nightly automated sweep that never touches a review in progress.
Deleting is always available and immediate. Deleting a paper removes the source file, every reviewed file, every saved version and every derived record (including the access log) from our live systems at once; deleting your account removes everything we hold about you. A copy can persist in encrypted backups for up to 14 days and is then gone. You can also email privacy@waraq.io; we complete deletion within 30 days.
6. Who we share data with (sub-processors)
We share personal data only with providers that help us run the service, under Data Processing Addenda that restrict them to our instructions. The categories, with locations and retention, are at /legal/data-processing.
- EU hosting provider: the virtual server in the European Union that hosts our API, database, files, workflow engine and tracing.
- Edge network and DDoS protection (Cloudflare): DNS, edge network and DDoS protection; hosting for waraq.io and app.waraq.io.
- AI model providers, via a routing layer: receive manuscript text sections solely to generate your review, each with no training on inputs and abuse-monitoring retention of at most 30 days under its terms. The full list is available to customers on request under confidentiality (Section 4).
- Payments (Polar, merchant of record), email delivery (Resend) and product analytics (PostHog): analytics, session replay and error tracking run on PostHog's US cloud through a first-party relay on our domains; it receives your account email as the user identifier.
- Public bibliographic services: reference and journal metadata lookups. They receive only DOIs, reference titles and journal names; never manuscript text or personal data.
We may also disclose data if the law requires it, to protect our rights or users' safety, or to a successor in a merger or acquisition (with notice to you).
7. Confidentiality and quality reads
We treat your manuscript as confidential unpublished research. Nobody at Waraq reads it as part of the normal service, and it is never made public. Production access is limited to key-based SSH, purpose-limited and logged.
A small Waraq team may open a paper and its review to improve the service, in-house and under confidentiality; every such open appears in your access log. It stays inside Waraq: your paper is never handed to a third party for analysis, never added to a training set, and notes contain at most short quotations.
You can see every open. Each time your file is opened, by you, by the review pipeline, or by a member of the Waraq team, a row is written to the paper's access log, which you can read on the paper page under "Who has opened this file". The log cannot be edited and is deleted only with the paper.
8. Cookies and analytics
A session cookie set at sign-in keeps you logged in for up to 30 days; it is strictly necessary and cannot be switched off.
PostHog helps us understand how the product is used and catch errors. It sets first-party cookies and local-storage keys (prefixed ph_) shared across waraq.io and app.waraq.io. In the app it may record session replays with all typed input masked; manuscript content is not captured as text. Data goes through a relay on our own domain to PostHog's US cloud. When you create an account, we send your account email to PostHog as the user identifier so events can be tied to your account. If you are in the EU, UK or Switzerland and prefer not to be measured, email privacy@waraq.io and we will exclude you; a standard tracker blocker also stops analytics without breaking the service.
No advertising pixels, no third-party marketing cookies.
9. International transfers
Our application server is in the European Union. Cloudflare serves traffic from its global edge. Our routing layer, the AI model providers, PostHog, Polar and Resend process data in the United States or other countries. Waraq is established in Saudi Arabia; the Saudi Personal Data Protection Law (PDPL) governs our own transfers and we apply the safeguards it requires. Where the GDPR, UK GDPR or Swiss law applies, transfers rely on the Standard Contractual Clauses in each processor's Data Processing Addendum, or on an adequacy decision.
10. Security
All traffic uses TLS. Sign-in uses one-time codes rather than passwords. Your manuscript and every reviewed file are encrypted at rest with AES-256-GCM under a key unique to each file, which is in turn wrapped by a server key that exists only in our service configuration; the disk and the backups hold ciphertext. Files live on a server in the European Union with access limited to key-based SSH; backups are encrypted with a separate key held offline and kept for 14 days. Every open of a file is logged (Section 7). No system is perfectly secure; if we learn of a breach affecting you, we will notify you and any regulator as the law requires.
11. Your rights
Depending on where you live (including under the Saudi PDPL, the GDPR/UK GDPR and US state laws such as the CCPA), you may have the right to access, correct, export, restrict or delete your personal data, to object to processing based on legitimate interests, to withdraw consent, and to complain to a supervisory authority. Deletion is self-service in the app; for anything else, email privacy@waraq.io. We respond within 30 days, may need to verify your identity first, and will not treat you differently for exercising your rights.
12. Changes
We may update this policy. For material changes we will email account holders at least 14 days before they take effect and show a notice in the app. Continued use after the effective date means you accept the changes; if you do not, delete your account before then.
13. Contact
Alurood Alilmiyya Company for Education (CR 7037878365), 4309 King Abdullah Al Saud Road, Al Raed, Riyadh, Kingdom of Saudi Arabia. Privacy: privacy@waraq.io (or support@waraq.io) · Support: support@waraq.io
We have not appointed a representative in the EU or UK. If we become required to appoint one, their details will appear here.