Who is responsible for your data
A recorded owner decision, awaiting legal wording
UPQAR, operating from Riyadh in the Kingdom of Saudi Arabia, is responsible for the personal data this notice describes, and its processing falls under the Kingdom's Personal Data Protection Law. For any question or request about your data, write to info@upqar.ai.
UPQAR is provided by the company registered in the Kingdom of Saudi Arabia under commercial registration number 1009126662, whose registered name is written in Arabic in the Arabic text of this notice. That company is the controller of that data.
The company's name, its commercial registration number, the country, the city and the law the processing falls under are the owner's, given on 2026-09-29, and the address for writing is the one the owner named on 2026-09-28. The name is written as the owner gave it.
What we hold
The account identity as it reaches us from the UPQAR platform: the issuer and subject, and an e-mail address if the platform sends one. We create no password and store none.
Your work: your boards and their contents, the files you upload or generate, and the prompts and parameters of each generation.
The accounting record: what was reserved, settled and returned, and any correction support applied to your account.
The record of your agreement to these documents: which version you accepted, when, and in which language you read it.
Short-lived operational logs of requests and errors. Request headers are filtered by an allowlist, and the authorisation header, signed URLs and any key are never written to them.
What we do not hold
No IP address, no browser fingerprint and no device identifier in the record of your agreement to these documents. The record proving you read the privacy notice must not be the most identifying one we keep.
We use no third-party tracking or analytics service in this application, and we set no advertising cookies.
Browser error reports are written as one log line and are never stored in a table, and their free text is scrubbed on both sides before it is written.
Who else sees it
To generate an image, a clip or a voice track, your prompt and input files are sent to an outside provider that runs the model. That is what the service is and it cannot be provided without it. We do not sell your data and do not share it for marketing.
An authorised support operator can see your account, its accounting and your runs in order to answer a question, and every action they take is recorded against their name.
The operating infrastructure — the database and file storage — runs with hosting providers we work with.
The providers that render your work are named in the clause below, which is the one place the product names them; who hosts the database and the file storage is not among them, and that clause says why. The places of processing and the legal basis for any cross-border transfer are still text waiting on counsel.
The providers, by name
The clause above says that an outside provider renders your work. These are the providers, and this is what each of them receives. The list is read off the code that calls them rather than from anybody's memory: no name is here that this software does not call, and no name it calls is left out.
BytePlus Ark renders still images and video clips. It receives your description, the settings of the generation, and a short-lived link to each reference image you attach, which it fetches from our storage with that link. A video generation also carries a one-way hash of the run's own identifier, because that endpoint asks for an identifier; it is not an identifier of you, and nothing of yours is inside it.
fal.ai renders the remaining still-image grades on its queue, and the same three things reach it: the description, the settings and the links to your references. The models that queue stands in front of are Google's and OpenAI's, so what reaches fal.ai reaches them with it.
ElevenLabs renders voice. It receives the text you asked to be spoken, the voice you chose, the speed, the name of the model that is to speak it, and — where that model accepts one — a language code we work out from the text itself. Nothing else goes: no board, no image, no file you uploaded.
None of them is told who you are. Your name, your e-mail address, the account identity the platform hands us, your balance and your board's name all stay here. What does reach them alongside the work is the link to each reference, and a link is not anonymous: it points into our storage at a path beginning with the internal identifier of your account, and the link to a file of yours carries that file's name as well. That identifier is ours and means nothing outside this service — it is not your name, and nobody holding it can turn it back into you — but it is the same identifier on every link, so a provider that kept the links could tell that two generations came from one account. Beyond that, what crosses is the work and its settings, and the hash named above.
Who hosts the database and the file storage is a setting of the deployment rather than a fact about this software, so this clause cannot read it off the code the way it reads the rest. That name — with the places of processing and the legal basis for any cross-border transfer — is waiting on the owner and counsel.
What is processed outside the Kingdom
A recorded owner decision, awaiting legal wording
The providers named in “The providers, by name” run outside the Kingdom of Saudi Arabia, so what reaches them is processed abroad: the work and its settings, and the links and the hash that clause lists. None of them is told who you are, but the work itself can be personal data — a reference image that shows a person, or a name in a description or in text you ask to be spoken — and so can the account identifier and the file name a reference link carries. Where it is, that personal data is processed abroad too.
The legal basis for that transfer, and where the database and the file storage are hosted, are still the owner's and counsel's to write.
The owner's decision of 2026-09-29, written in our words as the owner's position rather than counsel's wording; the owner and counsel will revise it.
For how long
A deleted board stays restorable from the trash for a window stated on the trash page itself, then is permanently purged.
A deleted account is reclaimable for a window stated on your account page. After it, your boards go, and the files you uploaded or generated are deleted out of our storage along with any export file you had asked for. The pictures operation cards made from your files go with them — a crop, a blur, a composite, each a copy kept so the same work is not done twice: the files are deleted out of our storage first and their records afterwards, in that order, so that nothing is left in storage that no record can name. What Studio saved in your own browser is not ours to reach and stays there until you clear it. Two records survive afterwards, with your identity detached: the accounting record, and the record of your agreement to these documents.
An export file you ask for is deleted after a short, stated window, because one file gathering your boards, the details of your files and your receipts and charges should not sit in storage any longer than it takes you to download it.
What you can do
Export your data from your account page: your boards as they stand, your file metadata, and your receipts and accounting record, in one file reached through a short-lived signed link. It is not everything: the image, video and audio files themselves are not in it, and neither is a Studio project, which is saved in the browser you made it in rather than on our servers. The file says so itself, in both languages.
Delete your account from the same page, and undo that deletion within its window. Asking closes everything else at once, though: inside the window the account can only read the state of that window and cancel — no board opens, and no copy can be asked for. So export before you ask.
Restore what you deleted from the trash within its window.
Your statutory rights
A recorded owner decision, awaiting legal wording
The Personal Data Protection Law gives you the right to know how and why your personal data is collected and used — which is what this notice is for — to see the data we hold about you and have a copy of it in a readable form, to have it corrected, completed or updated where it is wrong, incomplete or out of date, and to have it destroyed once we no longer need it, except what the law requires us to keep. Where we rely on your consent, you can withdraw it.
To use any of these rights, write to info@upqar.ai. We answer within 30 days, and using a right never changes how we treat your account. Much of it you can already do yourself, as “What you can do” describes.
If you think we have handled your data against the law, you can complain to the Saudi Data and Artificial Intelligence Authority (SDAIA).
The owner's decision of 2026-09-29, written in our words from the Personal Data Protection Law of the Kingdom of Saudi Arabia, as the owner's position rather than counsel's wording; the owner and counsel will revise it. The 30 days are the period the law's Implementing Regulations set for answering a request; they allow one further 30 days in some cases if the person is told the reason beforehand, and we do not rely on that extension.
Anyone under 18
A recorded owner decision, awaiting legal wording
The service is not for anyone under 18, and we do not knowingly hold their data. If you believe someone under 18 has an account with us, write to info@upqar.ai so that their data can be deleted.
The owner's decision of 2026-09-29, written in our words as the owner's position rather than counsel's wording; the owner and counsel will revise it.
Keeping it safe
A recorded owner decision, awaiting legal wording
We protect what we hold with technical and organisational safeguards: your files are reached through short-lived signed links, and a board you share shows its files to whoever holds its link, until the time you chose runs out or you withdraw the link; keys and signed links are kept out of our logs; and every action a support operator takes is recorded against their name. No service can promise that data is perfectly secure, and we do not.
If a breach puts your data at risk, we tell the authority, and we tell you where the law requires it.
The owner's decision of 2026-09-29, written in our words as the owner's position rather than counsel's wording; the owner and counsel will revise it. The safeguards the first paragraph names exist in the software, and the clauses above describe them.
Changes to this notice
This notice is published with the terms and the other two documents as one set, under one date. A new version is published on this page with its date, and the app asks you to agree to it, as “Changes to these terms” describes. Until a version has been published, this page says so and shows no publication date, and the app does not ask you to agree.