MNKI (mnki.ai) is an AI-powered architectural visualisation and design platform operated by Amkna Group For Engineering Services, a company established in the Arab Republic of Egypt, with its registered office at Office M05, Golden Gate Tower, Autostrad Rd, Maadi, Cairo, Egypt ("MNKI", "we", "our", or "us"). MNKI is the controller of the personal data described in this Privacy Policy ("Policy").

This Policy explains how we collect, use, share, store, and protect personal data when you use mnki.ai, the MNKI web application and its workspaces, the MNKI Public API, the MNKI MCP connector, and our community channels (together, the "Service").

The Service is operated from Egypt and is intended mainly for users in Egypt and the MENA region. This Policy applies to all users. Sections 10 to 12 set out additional rights under specific laws. Those sections are provided as a courtesy to users who may access the Service from the places concerned, and they do not, in themselves, mean that those laws apply to MNKI.

Please read this Policy together with our Terms & Conditions. Where we rely on your consent for a specific kind of processing, we ask for it separately. Reading this Policy is not the same as giving consent.

• Personal Data: any information relating to an identified or identifiable individual.
• Processing: any operation performed on Personal Data, such as collecting, storing, using, disclosing, or deleting it.
• Controller: the organisation that decides why and how Personal Data is processed. For this Policy, that is MNKI.
• Processor: an organisation that processes Personal Data on the controller's behalf, such as our cloud and AI providers.
• GDPR / UK GDPR: EU Regulation 2016/679 and its UK equivalent.
• CCPA/CPRA: the California Consumer Privacy Act, as amended by the California Privacy Rights Act.
• Egyptian PDPL: Egypt's Personal Data Protection Law No. 151 of 2020 and its Executive Regulations.
• SCCs: the Standard Contractual Clauses adopted by the European Commission for international transfers of personal data.

• Account data: your name, email address, and profile picture or avatar, provided when you register or through Google sign-in. We also keep a normalised form of your email address (for example, lower-cased), which we use to detect repeated sign-ups (see Section 9).
• Plan and eligibility data: your plan, your credit balances and usage, your organisation membership and role, and, where it applies, your student status and the university email domain used to verify it.
• Payment data: order references, amounts, currency, subscription status, and invoices. To process payments, your name, email address, phone number (if you have given one), and country are sent to Noon Payments. You enter your card details directly on Noon's secure payment page. MNKI never receives or stores your full card number. For subscriptions, Noon keeps a card token so that renewals can be charged, and we store only the masked card number (for example, the last four digits) and the token reference.
• Your content: the images, sketches, drawings, DXF and model files, prompts, instructions, reference clips, and audio you submit, and the Outputs generated from them. This includes AChAt conversations and the per-conversation "design memory" AChAt uses to keep context, MNKI Video projects and generation jobs, MNKIpresent decks, and CAD jobs.
• Collaboration data: if you use MNKISpace, we collect workspace membership, invitations (including the email addresses of people you invite), tasks, comments, and activity. If you share to the MNKI Wall, we collect the image, your caption, the time of posting, and whether you posted under your first name or anonymously. Wall posts are public. If you participate in MNKI Community (mnki.ai/community), we collect the topics, comments, attachments, tags, reactions, votes, reports, and challenge entries you submit, together with your public Community profile (an opaque profile identifier that does not expose your internal account ID, your display name, avatar, bio, reputation points, tier badge, and official flair). Community topics, comments, leaderboards, and public profiles are publicly visible and indexed by search engines.
• Usage and activity data: the features and modules you use, your generation history and metadata, timestamps, when your account was created, and a "last active" time that is updated periodically while you use the Service.
• Technical data: IP address, browser and operating system, device identifiers, your device's time zone (which we use to work out your country for pricing and currency), referring URLs, and session tokens.
• Connector and API data: if you connect an external client (our MCP connector for Claude and compatible clients, or the Public API), we collect the authorisation data that secures the connection. OAuth codes are single-use and short-lived. Refresh tokens and API keys are stored only as hashes. We also process the prompts, images, and 3D Sandbox scenes you send through that client, and the results we return.
• Communications: in-app inbox messages, emails with our support team, and messages you send to our Discord community bot.
• Referral and Partner Program data: if you use a referral link or code, or refer others, we record who referred whom, the code used, when the referral was made, when a qualifying purchase happened, and the rewards or commissions that resulted. To detect self-referrals and abuse, we keep salted, one-way hashes (not the IP addresses themselves) of the IP address a referred account signs up from and of the last few IP addresses a referrer used to open Refer & Earn, and we compare the email domain and organisation of the two accounts. If you apply to the Partner Program, we also collect your application (website, audience, channels, and message), your country of residence, your confirmation that you are 21 or over, any advertising licence number (for example, a UAE Advertiser Permit or a Saudi Mawthooq licence), and a record of your acceptance of the Partner Program Agreement. Partners are currently paid in MNKI credits, so we do not collect bank or payment-account details for the Partner Program.
• Records of your choices: the version of the Terms you accepted and when you accepted it. Your cookie/analytics and referral-attribution consent choices are stored in your browser.

We collect this data directly from you, automatically as you use the Service, and from authentication providers (Google) and organisations that invite you. We do not intentionally collect special-category or sensitive Personal Data, such as health, biometric, or religious data. Please do not include it in your uploads or prompts.

Where we rely on legitimate interests, we have weighed our interests against your rights. You can object at any time (see Sections 10 to 12). Where we rely on consent, you can withdraw it at any time. Withdrawing consent does not affect processing that took place before you withdrew it.

We do not sell your Personal Data. We do not use it for profiling or personalised advertising. We do not use your uploads or Outputs to train AI models without your opt-in consent.

Automated processing: AI models generate your Outputs, and automated safety systems may block requests that appear to breach our Acceptable Use Policy or a provider's policies. These systems do not make decisions about you that have legal or similarly significant effects. If you think a request was blocked in error, contact support@mnki.ai and a person will review it. In the referral and Partner Programs, automated checks can only place a reward or commission on hold. A member of our team with authority to change the outcome reviews every hold, and you can ask for a review at support@mnki.ai.

We use your browser's local storage and IndexedDB for things the Service needs to work, such as keeping you signed in, remembering your preferences, and saving 3D Sandbox and MNKI Video editor projects on your device. With your consent, Google Analytics and Google Ads also set cookies, and we remember a referral code you arrived with.

Google Consent Mode. The Google tag loads on our pages with analytics and advertising storage set to "denied" until you accept. While consent is denied, Google does not set or read analytics or advertising cookies. It may still receive limited, cookieless signals (such as the fact that a page was loaded, together with your IP address and browser information), which Google uses in aggregated form to model measurement. If you accept, cookies are enabled.

You can change your choice at any time under Account → Privacy & Data → "Reset cookie preferences", or by clearing your browser storage, which makes the banner appear again. You can also use the Google Analytics opt-out add-on and your Google Ad Settings. For more on how Google uses this data, see How Google uses information from sites that use its services.

Our pages also load fonts from Google Fonts and a small badge image from a third-party site. Loading these sends your IP address and browser information to those providers.

6.1 Service providers (processors). We share Personal Data only with the providers below, and only as far as needed for the stated purpose. They act on our instructions under data-processing terms that require confidentiality and security.

Under their commercial API terms, our AI providers do not use your content to train their models. They may keep inputs and outputs for a limited period (typically up to about 30 to 55 days, depending on the provider) to detect abuse and meet legal obligations.

6.2 People you choose to share with.

• MNKI Wall: anything you post is public and can be indexed by search engines.
• MNKISpace: workspace members can see the projects and renders you link, your tasks, comments, and activity, and your name and email address.
• Organisations: if you are a member of an organisation or university account, its administrators can see your name, email address, credit quota, and credit usage broken down by feature, engine, and resolution. Other members cannot see your membership record. Administrators cannot see your prompts, images, or projects unless you share them.
• Referral and Partner Programs: the person or partner who referred you sees only aggregated numbers (clicks, sign-ups, and paying customers) and masked entries such as plan, country, and date. They never see your name, email address, content, or activity.
• Connected clients: if you connect MNKI to Claude or another MCP client, the content you send and the results we return pass through that client. The client's operator (for Claude, Anthropic) handles them under its own terms and privacy policy, as an independent party that MNKI does not control. We share data with a connected client only within the permissions (scopes) you approve and only while the connection is active.

6.3 Other disclosures. We may also disclose Personal Data: (a) where required by law, regulation, court order, or a lawful request from an authority; (b) to enforce our Terms or to establish, exercise, or defend legal claims; (c) to report child sexual abuse material or imminent threats to life; and (d) to a successor in a merger, acquisition, or sale of our business. In case (d), we will notify you, and the successor must honour this Policy.

MNKI is based in Egypt, but our main infrastructure is in the United States (Google Cloud; our database is in a US multi-region), and some providers operate elsewhere, as shown in Section 6. Your Personal Data will therefore be transferred outside your country, including to countries whose data protection laws may differ from yours. You give your explicit consent to these transfers when you accept our Terms (Section 1.7), which applies to all users worldwide. In addition, we rely on the safeguards below where the law of your country provides them.

• For data of users in Egypt, we make transfers in line with Articles 14 to 16 of the Egyptian PDPL and Article 16 of its Executive Regulations. We are applying to the Personal Data Protection Center for the licences and permits these provisions require, within the compliance period set by the law. Your consent to these transfers is given when you accept the Terms (Section 1.7).
• For data originating in the EEA or the UK, we do not rely on consent alone. We rely on adequacy decisions (including the EU-US Data Privacy Framework, where a provider is certified) or on the SCCs and the UK Addendum included in our providers' data-processing terms.
• For data of users in the UAE and Saudi Arabia, we rely on the contractual safeguards required by the UAE and Saudi data protection laws.

You can ask for more information about these safeguards at support@mnki.ai.

Plan-based deletion. When a project, chat session, presentation, or video job reaches the end of its retention period, the entire item is permanently deleted, including all renders, iterations, and images inside it, regardless of when those were created. Before any deletion, we send warnings by in-app inbox message seven days and again 24 hours in advance, and by email too unless you turn deletion reminder emails off under Account → Notifications. If your paid plan is downgraded or ends, a seven-day grace period applies first. Deleted content cannot be recovered.

Account deletion. You can delete your account under Account → Security. Within 30 days, we delete from our active systems your profile, projects, renders, chats, presentations, video and CAD jobs, API scenes, Wall posts, uploaded and generated files, inbox, organisation memberships, and connector credentials. We then keep only the records listed above for payments, anti-abuse, support, and legal claims. Deleted data may remain in encrypted backups for up to 90 days, after which it is overwritten. We may keep anonymised statistics that cannot identify you.

• Correct: update your name and avatar under Account → Profile.
• Export: download a JSON-formatted copy of your account data (your profile, plan and credits, inbox, generation metadata, and payment history) under Account → Privacy & Data. Your images and Outputs can be downloaded from the workspaces where they are stored. For anything else, contact us.
• Delete: delete individual items, Wall posts, or your whole account (Account → Security).
• Cookies: change your analytics choice under Account → Privacy & Data.
• Connectors: revoke API keys or disconnect the MCP connector at any time.

The re-signup check (a normalised copy of your email address) runs for all accounts. We use it only to prevent people from repeatedly creating accounts to obtain free credits.

If you are in the EEA or the UK, you have the right to:

• access your Personal Data (Art. 15);
• rectify it if it is inaccurate (Art. 16);
• erase it, the "right to be forgotten" (Art. 17), subject to the retention in Section 8;
• restrict processing (Art. 18);
• data portability, meaning a copy in a machine-readable format (Art. 20);
• object to processing based on legitimate interests (Art. 21);
• not be subject to solely automated decisions with legal or similarly significant effects (Art. 22), which we do not make; and
• withdraw consent at any time.

To exercise these rights, use the tools in Section 9 or email support@mnki.ai. We will respond within one month. For complex requests, we may extend this by up to two further months, and we will tell you if we do. We may need to verify your identity first. Requests are free of charge unless they are manifestly unfounded or excessive.

You may complain to the supervisory authority where you live or work. In the UK, that is the Information Commissioner's Office (ico.org.uk). We encourage you to contact us first so that we can try to resolve your concern.

If you are a California resident and the CCPA applies to us, you have the right to know what Personal Data we collect, use, and disclose (the categories are in Sections 3 and 6), and the right to delete it and to correct it. You also have the right not to be discriminated against for exercising these rights.

We do not sell Personal Data. Google Ads conversion tracking may count as "sharing" for cross-context behavioural advertising under the CCPA. It runs only if you accept cookies in our banner. You can opt out at any time by resetting your cookie preferences and choosing "Essential only". We do not collect sensitive personal information as defined by the CPRA.

To make a request, email support@mnki.ai with the subject "CCPA Request". We will confirm receipt within 10 business days and respond within 45 days, which we may extend by a further 45 days with notice. You may use an authorised agent. We may ask for proof of the agent's authority and verify your identity.

Egypt: Personal Data Protection Law No. 151 of 2020

Under the Egyptian PDPL, you have the right to:

• know what Personal Data we hold about you, and access it;
• withdraw any consent you have given;
• have inaccurate data corrected, amended, or completed;
• have processing limited to a specific scope;
• have your data erased when it is no longer needed or is processed unlawfully;
• object to processing that conflicts with your fundamental rights and freedoms;
• be informed of any personal data breach affecting you; and
• complain to the Personal Data Protection Center (PDPC).

We process your data on the legal bases in Section 4, which include your consent, the performance of our contract with you, our legal obligations, and our legitimate interests. We respond to requests within the time limits set by the PDPL and its Executive Regulations.

United Arab Emirates: Federal Decree-Law No. 45 of 2021

UAE residents have the right to information, access, correction, erasure, restriction, and objection, and to data portability, within the limits set by the UAE PDPL, including the right to object to decisions based solely on automated processing. You can complain to the UAE Data Office.

Saudi Arabia: Personal Data Protection Law (Royal Decree M/19)

Saudi residents have the right to be informed, to access and obtain a copy of their data, to correction, to destruction of data that is no longer needed, and to withdraw consent. You can complain to the Saudi Data & AI Authority (SDAIA).

To exercise any of these rights, contact our Data Protection Officer at support@mnki.ai. We may need to verify your identity.

We use technical and organisational measures appropriate to the risk, including:

• TLS encryption for all data in transit;
• encryption at rest for our database and file storage, applied by Google Cloud;
• access rules that limit private data to its owner and to the people you choose to share with;
• authenticated server-side functions for sensitive operations, and a web application firewall;
• hashing of API keys and refresh tokens; and
• regular review of our security configuration and staff access.

Some files are delivered through links that include an access token. Anyone who has such a link can open the file, so please share download links with care. Public Wall images are accessible to everyone.

Breaches. If a personal data breach occurs, we will notify the competent authorities and affected users within the time limits required by law. For example, the Egyptian PDPL requires notification to the Personal Data Protection Center within 72 hours, and GDPR requires notification to the supervisory authority within 72 hours where it applies. Our notice will describe the breach, its likely consequences, and the steps we are taking.

No system is completely secure. Please use a strong, unique password, and report any vulnerability to support@mnki.ai.

To generate Outputs, we send your Inputs to the AI providers listed in Section 6: Google Gemini (including Gemini Omni, Lyria, and Imagen-class image models), Black Forest Labs, OpenAI, BytePlus ModelArk, and Anthropic (for CAD design). These providers process your Inputs on our behalf.

• You keep your rights in your Inputs. Ownership of Outputs is covered in Section 4 of our Terms.
• Neither MNKI nor its providers use your content to train AI models without your explicit opt-in consent (see Section 6.1 on providers' temporary abuse-monitoring retention).
• Some providers add invisible provenance watermarks to Outputs (for example, Google SynthID in some videos).
• Please do not upload images of identifiable people, or other people's personal data, unless you have a lawful basis to do so.

The Service is intended for adults aged 18 or older and is not directed at children. We do not knowingly collect Personal Data from anyone under 18. If you believe that a child has given us Personal Data, contact support@mnki.ai and we will delete it promptly.

The Service links to, and integrates with, third-party services such as Google sign-in, Noon's payment page, Discord, and MCP clients. Their own privacy policies apply to data you give them directly. We encourage you to read them.

This Policy is governed by the laws of Egypt. Disputes about it are resolved as set out in Section 21 of our Terms. This Policy is issued in English only; any translation is for convenience and has no legal effect, and to the fullest extent permitted by applicable law the English version governs. Nothing in this Policy limits any right you have under mandatory data protection law, including your right to complain to a supervisory authority, or any right to compensation that the law gives you and that cannot be limited by contract.

We may update this Policy. Changes take effect on the date we publish them, which is shown as the "Last updated" date. When we make a material change, we will tell existing users with a notice in the app at the time of the change, before we process personal data in any new way that the change describes. Where the law requires it, for example when a change relies on new consent, we will ask for your consent rather than relying on your continued use. Earlier versions are available on request.

In line with the Egyptian PDPL, MNKI has appointed a Data Protection Officer. The DPO handles all privacy questions and rights requests.