Effective date: 1 June 2026
Last updated: 5 October 2026
Last reviewed by counsel: 1 June 2026
1. Who We Are
SovereignEG ("we", "us") operates an AI inference API for customers in Egypt and the broader MENA region. This policy explains how we collect, use, and protect your information.
2. Information We Collect
| Category | What | Why |
|---|---|---|
| Account information | Email, first and last name, organization name, hashed password (none if you only use Google sign-in), when you accepted our Terms and when you last signed in | Authentication, billing, support |
| Google sign-in (if you use it) | Your Google account ID, name, email address and profile photo | Authentication |
| Business profile (optional) | Company, website, industry, how you plan to use the platform, team size | Onboarding, support |
| Website analytics (first-party) | Pages viewed, referring site and campaign tags (UTM), a random per-visit ID, and your user ID when signed in | Understanding how our website is used |
| Website analytics (Google Analytics) | On our public website pages only (never the signed-in console): pages you view and the page you came from (without query strings, apart from campaign tags such as utm_source), page titles, interactions such as scrolling, clicks on links to other sites, file downloads and starting a form (never what you type), your IP address (used to estimate approximate location), device and browser details — collected by Google Analytics using cookies (see the Cookie Policy) | Understanding how visitors find and use the website |
| Advertising measurement | On our public website pages only: the page you view (without query strings, apart from campaign tags), your IP address and browser details, sent to LinkedIn through an image request. LinkedIn may link the visit to a LinkedIn account using its own cookies (see the Cookie Policy) | Measuring our LinkedIn advertising and, where we choose to, showing our LinkedIn ads to past website visitors |
| Phone number | Your mobile number, and when you confirmed it with a one-time code sent by SMS or WhatsApp | Abuse prevention, welcome-credit and coupon eligibility, support |
| API usage metadata | Model, token count, latency, status code, timestamp | Billing, quota enforcement, service improvement |
| Payment information | Credit balance, transaction history and invoices (EGP amounts), payment method (card or mobile wallet), card brand and masked card number (which can show the first six and last four digits), and Kashier's order and transaction references. If you save a card, we also keep Kashier's card token and the card's expiry date. You enter full card numbers, security codes and wallet numbers on Kashier's hosted payment page; full card numbers and security codes never reach us, and we do not keep wallet numbers | Billing |
| Technical logs | IP address, request ID, user agent | Security, debugging |
What We Do NOT Collect or Store
- Prompt content — your messages to the model are processed in memory and never persisted.
- Completion content — model outputs are streamed to you and never stored.
- Hosted playground chats — the one exception: chats and files you add in the hosted playground are stored securely so you can come back to them later.
- Training data — we do not use your inputs or outputs to train or fine-tune models.
3. How We Use Your Information
- To provide and bill for the Service
- To enforce rate limits and quotas
- To detect and prevent abuse and fraud, including by comparing the IP addresses and email patterns of accounts
- To send service updates, security and account notices, receipts and credit reminders
- To send product news and offers by email and as dashboard banners. You can unsubscribe at any time with the link in each such email; service, security and account notices are still sent
- To understand how our website and dashboard are used (pages visited, how you found us) and improve them
- To measure our advertising on LinkedIn, using page views from our public website pages only
4. Data Retention
| Data | Retention |
|---|---|
| Account data | Deleted on request: email support@sovereigneg.com. Deletion takes effect immediately. Usage records, request logs and the phone-number hash described below are kept as stated in this table |
| Verified phone numbers | The number is removed with the rest of your account data. A keyed one-way hash of it (never the number itself) is kept with no expiry, including after account deletion, only to stop the same number from claiming the welcome credit again or being verified on another account |
| Usage metadata | Per-request records (model, token counts, latency, status, cost): 13 months, including after account deletion. Daily usage totals: kept as aggregated statistics with no automatic expiry |
| API keys | We store only a one-way hash of each key and its last 4 characters. Revoking a key does not delete it: revoked keys stay in your organization's key list, marked as revoked. Keys in your personal organization are deleted when your account is deleted; keys in a team organization stay with that organization's records |
| Request logs (time, request ID, endpoint, model, status, latency, client IP address, user agent, and the error message of a failed request) | 90 days |
| Application logs | 30 days |
| Website analytics (first-party) | 180 days |
| Website analytics (Google Analytics) | Event-level data no longer than 14 months |
| Advertising measurement (LinkedIn) | Kept by LinkedIn under its own policy; LinkedIn states that it removes identifying information within 7 days and deletes the remaining pseudonymised data within 180 days |
5. Data Location
Account records and usage metadata are stored in our application infrastructure in Egypt. A nightly backup of account records, usage statistics and model usage metadata is stored with Amazon Web Services in Frankfurt, Germany, and kept for about 30 days. Card and mobile-wallet payments are processed in Egypt by Kashier, our payment service provider. Standard inference requests may be routed to vetted upstream model providers as required to operate the Service; dedicated Egypt-hosted deployments are available on request for regulated workloads. Website analytics and advertising-measurement data from our public website pages are processed by Google and LinkedIn, including in the United States. See Sub-processors for current third-party services.
6. Sub-processors
See our Sub-processor List for current third-party services. We notify customers at least 30 days before adding a new sub-processor. LinkedIn receives advertising-measurement data from our public website pages as an independent controller, not as our sub-processor; see LinkedIn's Privacy Policy.
7. Your Rights
You may:
- Access your data via the API (
/v1/usage,/v1/credits) - Request data export by emailing support@sovereigneg.com
- Request account deletion
- Withdraw consent (by closing your account)
- Opt out of website analytics and advertising measurement on our public pages, whether or not you have an account, as described in the Cookie Policy
8. Security
See our Security & operations page for our security posture, threat model, and vulnerability reporting process.
9. Cookies
See our Cookie Policy. We use first-party cookies to keep you signed in and to remember your selected organization and project. We also run our own first-party page-view analytics: it records the pages you visit and the site that referred you, and links them to your account when you are signed in. On our public website pages only, Google Analytics sets analytics cookies on our domain, and LinkedIn may read and set its own linkedin.com cookies to measure our advertising. We set no advertising cookies on our own domain. The sign-in and sign-up pages load Google's "Sign in with Google" button, and Google may set or read its own cookies there.
10. Changes
Material changes will be communicated via email or dashboard notice at least 30 days before taking effect.
11. Contact
Privacy questions: support@sovereigneg.com