Privacy Policy

1Information We Collect

1.1 Account Information

When you create an account, we collect the following personal information:

• Full name
• Email address
• Password (stored in bcrypt-hashed form only; we never store plaintext passwords)
• Phone number (optional)
• Profile avatar or display name (if provided)

1.2 Gameplay and Annotation Data

As you use the Service, we collect data related to your activity:

• Annotation answers and responses you submit within games
• Timing data (how long you spend on each question or game session)
• Coins earned and spent
• Experience points (XP) and level progression
• Daily streaks and login patterns
• Attention check results and quality scores
• Leaderboard rankings

1.3 Device and Technical Information

We automatically collect certain technical data when you access the Service:

• IP address
• User agent string (browser type, version, operating system)
• Screen size and resolution
• Device type (mobile, tablet, desktop)
• Language and locale settings
• Referring URL and pages visited

1.4 Contact Form Submissions

If you use our contact form or reach out to us, we collect the information you provide, including your name, email address, company name, phone number, and message content.

1.5 Payout and Verification Information

When you redeem Coins for a payout, we and the providers that help us make payouts may collect the information needed to verify you and send the payout:

• Identity and eligibility details, such as your legal name, date of birth and country of residence and, where verification requires it, an identity document and a photo of you to check against it
• Payout account details for the payout option you choose, such as an account or wallet identifier, phone number or email address
• Redemption records, including the Coins redeemed, the rate applied, the amount, the date and the payout status
• Tax information, where the law requires us to collect it

Where a verification provider compares your photo with your identity document, this may involve biometric data. Where the law requires it, we or the provider will ask for your explicit consent first.

2How We Use Your Information

We use the information we collect for the following purposes:

• Account Management: To create and maintain your account, authenticate your identity, and provide customer support.
• Game Functionality: To operate the annotation games, track your progress, award coins and XP, maintain leaderboards, and manage streaks.
• Quality Control: To evaluate the quality and reliability of annotation responses, administer attention checks, and calculate answer weighting scores.
• Analytics: To understand how users interact with our platform, improve game design, optimize performance, and develop new features.
• Communication: To respond to your inquiries, send important service updates, and notify you of changes to our policies or terms.
• Payouts and Verification: To process Coin redemptions and payouts, verify your identity, age, country and eligibility, confirm that a payout account belongs to you, and prevent fraud, multiple accounts and other abuse of our payout program.
• Security: To detect and prevent fraud, abuse, and unauthorized access to the Service.
• Legal Compliance: To comply with applicable laws, regulations, and legal processes, including the tax, accounting, sanctions and anti-money-laundering requirements that apply to payouts.

3How We Store and Protect Your Data

Your data is stored in MongoDB databases hosted on secure servers with industry-standard protections. We implement the following security measures:

• Passwords are hashed using bcrypt before storage. We never store or have access to your plaintext password.
• Authentication tokens (JWT) are stored in localStorage on web and SecureStore on mobile devices.
• All data transmissions between your device and our servers are encrypted using HTTPS/TLS.
• Access to production databases is restricted to authorized personnel only.
• We conduct regular security reviews and update our infrastructure to address emerging threats.

4Third-Party Services

We use a limited number of third-party services to operate the platform:

• MinIO: We use MinIO for file and object storage (such as dataset files uploaded by business clients). MinIO is self-hosted on our infrastructure.
• Email Services: We may use third-party email providers to send transactional emails and service notifications.
• Payment and Verification Providers: When you cash out, we share the details needed to complete the payout, such as your name, payout account details and the amount, with the payment providers that deliver it and, where verification is needed, with identity-verification providers. These providers process this information to provide their services and to meet their own legal obligations, under their own terms and privacy policies.
• Microsoft Clarity: Our public website (avenzoar.ai) uses Microsoft Clarity, an analytics service provided by Microsoft, to understand how visitors use it; our mobile apps do not use it. Clarity records how you interact with our web pages, such as the pages you view, clicks, taps, scrolling and mouse movements, together with device and browser information, your approximate location derived from your IP address, and the page language, and uses this to produce heatmaps and session recordings. Clarity may set first-party cookies on our website (such as _clck and _clsk) to recognize a returning browser and group page views into a session, and Microsoft may set its own cookies on clarity.ms and bing.com. Microsoft processes this data as described in its privacy statement: privacy.microsoft.com/privacystatement

We do not sell, rent, or trade your personal information to any third party. We do not share your personal data with advertisers. Annotation data may be provided to the business clients who created the annotation tasks, but this data is associated with anonymized player identifiers, not your personal account information.

5Cookies and Local Storage

Avenzoar uses minimal cookie and local storage technologies. Specifically:

• JWT Authentication Tokens: Stored in localStorage (web) or SecureStore (mobile) to keep you signed in.
• Language Preference: Your selected language (English or Arabic) is stored locally to persist your preference.

We do not use cookies to advertise to you. Our website uses Microsoft Clarity analytics cookies, as described in Third-Party Services above. You can block or delete cookies in your browser settings, and our website still works without them.

6Your Rights

You have the following rights regarding your personal data:

• Right to Access: You may request a copy of the personal data we hold about you.
• Right to Rectification: You may request correction of inaccurate or incomplete personal data.
• Right to Erasure: You may request deletion of your personal data, subject to any legal obligations that require us to retain certain information.
• Right to Data Portability: You may request a machine-readable export of your personal data.
• Right to Restrict Processing: You may request that we limit the processing of your personal data in certain circumstances.
• Right to Object: You may object to the processing of your personal data where we rely on legitimate interests as the legal basis.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time.

To exercise any of these rights, please contact us at contact@avenzoar.ai. We will respond to your request within 30 days.

7GDPR Compliance

For users in the European Economic Area (EEA), United Kingdom, and other jurisdictions with similar data protection laws, we process your personal data in accordance with the General Data Protection Regulation (GDPR) and equivalent legislation. Our legal bases for processing include:

• Contract Performance: Processing necessary to provide the Service you have registered for, including processing Coin redemptions and payouts.
• Legitimate Interests: Processing for analytics, security, fraud prevention, and platform improvement, balanced against your rights.
• Consent: Where required by law, we obtain your explicit consent before processing.
• Legal Obligation: Processing necessary to comply with applicable laws, such as the identity, tax and anti-money-laundering checks that apply to payouts.

If you believe we have not adequately addressed your data protection concerns, you have the right to lodge a complaint with your local data protection supervisory authority.

8Children's Privacy

Avenzoar is intended for users who are at least 13 years of age, or the minimum age of digital consent in their jurisdiction (whichever is higher). We do not knowingly collect personal information from children under this age. If we become aware that we have collected personal data from a child below the applicable age threshold, we will take steps to delete that information promptly. If you believe a child under the minimum age has provided us with personal data, please contact us at contact@avenzoar.ai.

Redeeming Coins for payouts is limited to users who have reached the age of legal majority in their country, and we may collect age information to confirm this.

9Data Retention

We retain your personal data for as long as your account remains active and as necessary to provide the Service to you. Specifically:

• Account Data: Retained while your account is active. Upon account deletion, personal data is removed within 30 days, except where legal obligations require longer retention.
• Gameplay Data: Annotation responses may be retained in anonymized form after account deletion, as they form part of the aggregated annotation datasets delivered to business clients.
• Payout and Verification Records: Retained for as long as needed to complete and support your payouts, for the periods required by tax, accounting, anti-money-laundering and other laws, and as needed to prevent and investigate fraud. These records may be kept after your account is deleted.
• Contact Submissions: Retained for up to 24 months after the last interaction, then deleted.
• Technical Logs: Server logs and IP addresses are retained for up to 12 months for security and debugging purposes, then purged.

You may request deletion of your data at any time by contacting us at contact@avenzoar.ai or through your account settings.

10International Data Transfers

Avenzoar operates from Jordan and Qatar. If you access the Service from outside these countries, your data may be transferred to and processed in Jordan or Qatar and, for payouts and verification, in the countries where our payment and verification providers operate. By using the Service, you consent to such transfers. We take appropriate safeguards to ensure your data is protected in accordance with this Privacy Policy and applicable data protection laws.

11Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make material changes, we will:

• Update the "Last updated" date at the top of this page.
• Notify you via in-app notification or email (for registered users).
• Where required by law, obtain your consent before applying material changes.

We encourage you to review this Privacy Policy periodically. Your continued use of the Service after changes are posted constitutes your acceptance of the updated policy.

12Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

• Email: contact@avenzoar.ai
• Company: Avenzoar
• Locations: Amman, Jordan & Doha, Qatar

We aim to respond to all privacy-related inquiries within 30 days of receipt.