Privacy Policy

Last updated: 17 October 2026

This policy explains what Ilham, operated by Ali Daoud, collects, why, who processes it, and the choices you have. We do not sell your data, show ads, or use your library to train models for anyone else.

What we collect

• Account data: your e-mail address and, if you use the Telegram bot, your Telegram user ID.
• Your library: the images, videos, links and notes you save, the analyses made of them, your decisions on suggestions, collections, direction packs and taste rules.
• Usage and security logs: sign-ins, actions such as saving or sharing, and errors, kept to run and protect the service.
• Billing data: handled by Paddle. We receive your plan, subscription status and country, never your full card details.
• Client share links: if someone opens a link you shared, we store their likes and comments, and use their IP address only for rate limiting.

Why we use it

To provide the service you asked for (store, analyse and search your references, learn your taste, build directions and critiques), to keep it secure, to bill for paid plans, and to reply to you. The legal bases are the contract with you and our legitimate interest in security.

Who processes it

• Cloudflare: network, sign-in (Cloudflare Access) and secure connections.
• Alibaba Cloud Model Studio (Qwen): images and text are sent to its international API to be analysed; they are not used by us to train models.
• Telegram: only if you use the bot.
• Paddle: payments, invoices and tax, as Merchant of Record.
• Google Drive: encrypted backups. Data is encrypted on our server before upload, so Google cannot read it.

Your library is stored on servers we operate. Some processors are in other countries; we use them only for the purposes above.

How long we keep it

Your library stays until you delete it or your account. Encrypted backups keep up to 30 daily versions, so a deletion disappears from backups within about 30 days. Security logs are kept up to 12 months.

Your rights

You can ask to access, correct, export or delete your data, or object to a use of it, by writing to support@dunetask.com. We answer within 30 days. These rights apply under the Saudi Personal Data Protection Law, the EU and UK GDPR, and similar laws where you live.

Cookies

The app uses only the sign-in cookie that keeps you logged in. This site loads the Cairo font from Google Fonts, which receives your IP address. There are no analytics or advertising cookies.

Security

Access to the app requires sign-in through Cloudflare Access; data is encrypted in transit and backups are encrypted at rest. Team members only see what their role allows. Tell us about any security issue at support@dunetask.com.

Changes

We will post updates here and notify account holders of significant changes.