Privacy Policy

1. Who We Are

Nabad (nabad.live) is a real-time audience polling platform operated by Scarlett Myriam Jebara, Montréal, Québec, Canada ("we", "us", "our"). She is also the person in charge of the protection of personal information at Nabad. For any privacy question or request, write to info@nabad.live.

2. What We Collect

We collect the following categories of data:

• Account data: your email address, and a hashed password if you sign up with one. If you sign in with Google or Microsoft, we receive your email address and an account identifier from that provider, and no password is stored.
• Poll content: questions, answer options, and participant responses you create or submit.
• Usage data: pages visited, features used, session timestamps, browser and device type, and your IP address, collected through server logs. IP addresses are also used to limit abuse, such as repeated sign-in attempts.
• When you create an account, we use your IP address to find your approximate country and save it with your account, so we know where our users come from. The lookup happens on our own server, using IP2Location LITE data.
• Signed-in devices: for each browser you sign in on, we keep its type (for example, Chrome on Windows), an approximate country worked out from its IP address, and when it signed in and was last active. The IP address itself is not saved, and the sign-in key is stored only as a hash. Your Account page lists these devices and lets you sign out of any of them. A sign-in lasts 30 days and is renewed while you use it. Changing or resetting your password signs out your other devices. Expired or signed-out sign-ins are deleted 30 days later, and all of them are deleted with your account.
• Billing data: subscription status and payment history. Card details are handled entirely by Stripe and never stored on our servers.
• Communications: emails you send us, including support requests.

Participants answer without a login or an account. Each response is linked to a session and a random device identifier kept in the participant’s browser, not to a Nabad identity. The host chooses how names work in each session: off (no name at all), optional (the default: participants can type a name or stay anonymous), or required (a name is needed to answer). When a name is given, the response carries it.

Language Ambassadors

If you send a translation review through our Language Ambassadors page, we keep what you send: the language, the lines you ticked or corrected, your comments, your name, your email address, your LinkedIn link if you gave one, and the three choices you made about being thanked. We use your email only to reach you about your review and, if you ticked that box, to contact you again. Your email is never shown. Your name appears on our thank-you page only if you ticked that box and only after we have used your review, and your LinkedIn link only if you ticked that box too. To change your choices or have your review deleted, write to info@nabad.live. If you delete your Nabad account, reviews sent with the same email address are deleted with it.

3. How We Use Your Data

We use the data we collect to:

• Provide and operate the Nabad service
• Manage your account and subscription
• Send transactional emails (account confirmation, billing receipts)
• Diagnose bugs and improve the platform
• Respond to your support requests
• Comply with legal obligations

New hosts also receive a welcome email, which can include an introductory offer, and one reminder a few days later if they have not run a session yet. Each of these emails has a one-click unsubscribe link, and unsubscribing stops them for good. We send no other marketing email unless you opt in.

4. Data Sharing

We do not sell your personal data. We share data only with the following service providers, strictly for operating Nabad:

• Stripe: payment processing
• Neon: managed Postgres database hosting
• Upstash: managed Redis (real-time session state)
• DigitalOcean: server infrastructure
• Google (Gemini API): spam check of participant questions and open-text answers, AI room insights and session recaps, translation of participant answers, and spelling a participant’s name in Arabic or Latin letters
• Resend: email to hosts (verification, password reset, session recaps, welcome and reminder emails) and delivery of messages sent through our contact form
• Sentry: error monitoring; receives stack traces and request context from server errors, which can include a session identifier
• Cloudflare: domain name (DNS) for nabad.live, and cookieless visit counts on our public pages
• Google (Fonts): typefaces on our pages; your browser downloads them from Google, which sees its IP address
• Google and Microsoft: signing in with your Google or Microsoft account, if you choose it

Participant text is sent to Google’s Gemini API in four situations only: on every plan, Q&A questions and open-text answers are checked for spam and off-topic content; in sessions owned by a Pro account, answers are grouped into themes, translated for participants and summarised in the session recap; on any plan, when a host asks to translate participant answers; and when a participant types a name in Arabic letters, or in Latin letters in a room that uses Arabic or Persian, that name alone is sent to suggest how it is written in the other script. Full detail, including our data region and retention terms, is on our Data & Security page.

Our database and most of these providers are in the United States, so your data is stored and processed outside Quebec and Canada. We use them only for the purposes listed here.

We may also disclose data if required by law, court order, or to protect the rights and safety of our users.

5. Data Retention

We keep your account data as long as your account is active. Sessions and their responses are kept until the host deletes them; closing a room does not delete it, and we run no automatic deletion schedule for them. A host can delete any session from their dashboard at any time. A deleted session stays in Trash for 30 days, where it can be restored, and is then removed for good with all its responses.

If you delete your account, your account, sessions and responses are deleted immediately, together with the analytics and AI records of your sessions, the messages you sent through our contact form and your mailing-list entry. Stripe keeps its own record of past payments, and we keep anything else only where the law requires it.

What goes into and comes out of each AI call is kept for up to 90 days to measure the quality of translations and themes, then deleted.

6. Cookies and Local Storage

We set three cookies, all our own: one keeps you signed in, one remembers the language you chose, and a short-lived one (10 minutes) protects signing in with Google or Microsoft. On a participant’s phone, the browser’s local storage keeps a random device identifier, the name they typed, their reading language and which questions they have answered. We use no advertising pixels anywhere. No analytics or tracking script runs on the pages a participant sees, and none runs inside the app once you are signed in: the join page, the voting page, the presenter screen, your dashboard and the editor carry none. Our public pages use Cloudflare Web Analytics, which counts visits without cookies and without identifying anyone. We also offer Google Analytics on our public marketing pages. It does set cookies, and it stays switched off until you accept it: nothing from Google loads and no Google cookie is set unless you choose Accept on the banner. If you accept, Google sets its own cookies in addition to ours. Refusing loads nothing, and you can change your choice at any time.

Change your analytics choice

Stripe may set cookies on payment pages as part of their fraud-prevention systems.

7. Security

We use HTTPS (TLS) for all data in transit. Passwords are stored as bcrypt hashes. Access to production systems is restricted to the core team.

No system is perfectly secure. If you believe your account has been compromised, contact us immediately at info@nabad.live.

8. Your Rights

Depending on your location, you may have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data
• Object to or restrict how we process your data
• Request a portable copy of your data

To exercise any of these rights, email us at info@nabad.live. We will respond within 30 days.

If you are not satisfied with our answer, you can file a complaint with the Commission d’accès à l’information du Québec, or with the privacy authority where you live.

9. Participants of Every Age

Nabad is made for rooms of every age, school classes included. Participants never create an account and are never asked for an email, phone number or password. The minimum age of 16 in our Terms applies only to hosts who open an account.

When a teacher or a school runs a session, they decide what is collected. For young classes, a host can turn names off so that answers carry no name at all. Under Quebec law, collecting personal information from a child under 14 requires the consent of a parent or guardian, so we recommend names off for those classes unless the school already has that consent.

10. Changes to This Policy

We may update this policy from time to time. We will notify registered users by email at least 14 days before material changes take effect. The "effective date" at the top of this page shows when it was last updated.

11. Contact

Privacy questions or requests? Email us at info@nabad.live.