1. Scope and responsibility
This notice explains how ThinQa handles personal data when you sign in, use its design and exploration tools, generate reports or images, submit fabrication jobs, or contact us. Our principal Qatar framework is Law No. 13 of 2016 on Protecting Personal Data Privacy. Additional privacy laws may apply depending on your location and the processing involved.
ThinQa is a project under development, not an incorporated company. The project team handles the service in its own capacity and does not issue this notice on behalf of HBKU or QEERI. These institutions are not designated by this notice as the service operator, data controller or guarantor. References to team members’ affiliations do not imply institutional endorsement or responsibility for the service. Being unincorporated does not remove the applicable privacy duties, and this notice cannot override the actual processing arrangements or responsibility imposed by law.
2. Data collected
Account data includes your Firebase user ID, email address, display name, profile photo, sign-in provider information, account dates, credits and token usage. Google or GitHub handles federated sign-in; ThinQa does not ask for your Google or GitHub password. Firebase manages authentication credentials and tokens.
Workspace data includes conversations, prompts, reports, images, uploaded documents and media, design specifications, generated models, project knowledge, learning preferences, ratings, fabrication requests and error reports. Such content can contain personal or confidential information if you include it.
Technical data includes workflow and job identifiers, delivery status, timestamps, security and operational logs, and browser or device details. Hosting and network providers may process IP addresses. Optional PostHog analytics is described separately below. We also record policy acceptance, sign-in session timestamps, adult confirmation, privacy choices and requests.
3. Purposes and processing grounds
We process necessary account and workspace data to authenticate users, deliver requested AI and fabrication services, save work, manage credits, respond to support requests and protect the service. Necessary service processing serves the purposes described here, subject to applicable Qatar law. Accepting the terms does not authorize unrelated uses of your data.
Optional analytics and promotional emails require separate choices. Your content is not authorized for model training, research publication or unrelated research reuse simply because you use ThinQa. Any proposed identifiable research reuse needs a separately explained basis and, where required, consent and institutional approvals.
4. Providers and international processing
Firebase / Google Cloud provides authentication, application hosting, file storage and the Firestore email queue. MongoDB stores account, project, session, job and support records. Google Gemini processes content needed for AI responses, reports and images. Google Drive and fabrication workers handle relevant job inputs and prototype outputs. Email delivery infrastructure processes recipients and message content; requested report emails may include design content.
PostHog uses its United States endpoint for optional product analytics. The application is hosted using US infrastructure. Other providers may process data in countries where they or their subprocessors operate; processing is not limited to a single region. Contact hello@thin.qa for questions about a specific processing activity.
Data may be processed outside Qatar. International processing remains subject to applicable privacy requirements. Our use of overseas infrastructure does not mean your data is stored exclusively in Qatar.
5. AI processing and confidential information
AI requests send relevant content to Google. Under Google’s Gemini terms, paid-service processing does not use prompts and responses to improve its products, while unpaid-service processing permits broader use and human review. Data use depends on the applicable service terms and billing arrangements; this policy does not provide a blanket assurance that all provider processing excludes model improvement. Paid services may still retain limited safety logs.
Do not submit children’s data, health records, identification documents, credentials, other special-nature personal data, or confidential designs without appropriate authority and an approved processing arrangement. We do not claim that every AI input is anonymous or that provider processing is confined to Qatar.
6. Optional analytics, marketing and browser storage
Analytics is off until you choose it in Privacy choices. If enabled, PostHog receives linkable account/workflow identifiers, device details, timings and outcome categories. The configured event filter excludes chat text, reports, uploaded files, model contents, names, email addresses and private file URLs. Session recording and automatic interaction capture are disabled; the analytics SDK uses memory persistence.
You can reject optional processing and still use essential services. Analytics withdrawal stops new browser events immediately and, once saved, stops server worker events for your account. It does not automatically erase historical events; you may request erasure. Anonymous visitors’ choices apply to this browser; account choices are saved separately.
Promotional updates require affirmative opt-in, including for existing accounts without a consent record. Withdraw in Privacy choices or account settings, or contact hello@thin.qa. Requested reports, security notices and necessary account communications are separate from promotional mail.
Firebase sign-in uses essential browser storage. The server uses a short-lived HttpOnly authentication cookie. ThinQa also uses browser storage for privacy choices, workflow state and recovery drafts. Shared-device users should sign out and clear site data when appropriate.
7. Sharing and authorized access
Public sharing requires an explicit publication action. Anyone with the link may view and copy the shared conversation, report and linked content. Disabling sharing prevents future access through that share page but cannot retract copies already obtained or independently shared file links.
Files can use token-bearing download URLs; anyone who obtains such a URL may be able to access that file. Authorized personnel and providers may access data as needed for service operation, support, security, fabrication or legal duties. Do not publish someone else’s personal data or proprietary content without authority.
8. Retention and deletion
Retention must be limited to what is necessary for each stated purpose. Job activity records have a configured 30-day expiry. Account content otherwise remains until deletion is requested or another justified retention criterion applies; comprehensive automatic expiry is not yet implemented. Deletion timing depends on the systems involved and any applicable retention requirements.
Request deletion in account settings or by contacting hello@thin.qa. A recorded request disables optional account processing and public sharing and enters a tracked review. It does not instantly erase all copies. Review covers MongoDB, Firebase Authentication and Storage, Firestore mail, Google Drive, workers, email delivery, PostHog and backups. Required legal retention, pending processing and backup expiry must be explained when applicable.
A restricted request record may be retained to coordinate cleanup, record decisions and demonstrate handling. Deletion is complete once outstanding provider copies and any applicable retention exceptions have been reviewed and addressed.
9. Rights, security and complaints
Under applicable Qatar law, you may request access and a copy, correction, withdrawal of consent, objection to inappropriate or excessive processing, and deletion when the relevant conditions apply. Requests are subject to identity verification and applicable exceptions. Email hello@thin.qa, describing the request without sending passwords or unnecessary identification.
If your concern is unresolved, you may complain to Qatar’s competent personal-data protection authority through the National Cyber Security Agency’s published channels. Rights under another jurisdiction are assessed where that law actually applies; worldwide access alone does not establish GDPR applicability.
We use access controls and provider security measures, but no system is risk-free. Security incidents require assessment and notification to affected individuals and the competent authority where Qatar’s applicable threshold is met.
10. Adults and policy changes
ThinQa’s AI service is restricted to adults aged 18 or older. We do not offer a child-directed service under this policy. If you believe a child’s information has been submitted, contact us for review and removal. Adult self-confirmation is an eligibility control and does not constitute verified identity or age proof.
Material changes will be communicated with a new policy version. Where a new purpose needs consent, we will request it separately; continued use is not a substitute for that consent.