Privacy policy

AI Noble is currently operated by its owner, Mohammed Fahad Alghenaim, as an individual. A registered legal entity and postal address have not yet been designated; they will be added here before this policy is finalised. The current contact channel is the Contact page.

• Account data: email and name; with Google sign-in, the name, email and profile picture Google sends.
• Project data: working title, topic, type, language, author name and chosen journal, plus the understanding memo, protocol, search results, screening decisions, evidence, claims, solutions, drafts and automated reviews.
• Uploaded files: Word templates, source full texts and case records you enter.
• Contact messages: name, email, request type and message, plus a one-way hash of your IP address used for rate limiting (the IP itself is not stored).
• Technical logs: error logs, AI-call cost records, automated job status, and server logs kept by the hosting provider.

• Providing the service you request (building the paper, running the pipeline, exporting Word): performance of your request and the Terms. This data is necessary; the platform cannot work without it.
• Account security and abuse prevention (authentication, locks, rate limits): legitimate interest in protecting the service and its users.
• Replying to contact and privacy requests: at your request.
• There is currently no optional data and no marketing consent; we send no promotional messages.

• Lovable (hosting, database, authentication, file storage): stores all account, project, file and message data.
• Lovable AI gateway routing to Google Gemini models: receives the topic, source excerpts, evidence and drafts needed for each step. We have not yet verified the retention and training terms of these providers for this account, so we do not claim content is excluded from training.
• Google (only if you choose Google sign-in): receives the authentication request.
• Open scholarly databases OpenAlex, Crossref, PubMed/NCBI, Europe PMC and Unpaywall: receive search queries and DOIs only, not your account data.
• Location: processing may take place outside Saudi Arabia at these providers. We have not verified a specific location and do not claim data stays in any particular country.

• Project data is kept until you delete the project from the Projects page; deletion removes the project and everything attached to it from the live database.
• Copies may remain in the hosting provider's backups for a period set by the provider; we have not verified that period, so we do not claim immediate deletion from backups.
• Contact messages are kept until handled and can be deleted on request.
• Full account deletion is currently handled on request via the contact form (type: privacy request).

You may request access to, correction, deletion or a copy of your data, object to specific processing or withdraw any consent, as provided by applicable law, including the Saudi Personal Data Protection Law where it applies. Submit requests via the Contact page and choose "Privacy / data request". We may ask you to verify your identity first.

We use no advertising cookies and no third-party analytics or tracking tools. The site uses your browser's local storage only for the sign-in session and language choice, which are necessary for the site to work. Clearing them from your browser signs you out.

When this policy changes we bump the version number and last-updated date at the top of this page.