MNKI.ai ("MNKI", "we", "our", or "us") is an AI-powered architectural rendering platform operated by MNKI.ai. This Privacy Policy ("Policy") explains how we collect, use, disclose, store, and protect your personal data ("Personal Data") when you access or use our platform available at mnki.ai and any associated applications or services (collectively, the "Service").

This Policy applies to all users of the Service regardless of geographic location. Where we have included jurisdiction-specific rights and disclosures (see Sections 10, 11, 12, and 13), such inclusions are provided as a courtesy to users who may access the Service from those jurisdictions and do not constitute an admission that MNKI is subject to, or actively operates under, the laws of those jurisdictions. MNKI's primary operations and governing law are based in Egypt.

Passive Availability Notice: The Service is primarily intended for users in Egypt and the MENA region. MNKI does not actively direct, market, or solicit business from residents of the European Union, United Kingdom, United States, or other jurisdictions outside the MENA region. If you access the Service from such a jurisdiction, you do so at your own initiative. You are solely responsible for ensuring your use of the Service complies with all laws applicable in your jurisdiction.

By creating an account or using the Service, you acknowledge that you have read, understood, and agree to this Policy. If you do not agree, please discontinue use of the Service immediately.

This Policy does not constitute legal advice. If you have specific legal concerns about data privacy, we recommend consulting a qualified legal professional in your jurisdiction.

For the purposes of this Policy:

• Personal Data — any information relating to an identified or identifiable natural person.
• Processing — any operation performed on Personal Data, including collection, storage, use, disclosure, and deletion.
• Controller — the entity that determines the purposes and means of processing Personal Data. MNKI.ai is the Controller for data processed under this Policy.
• Processor — an entity that processes Personal Data on behalf of the Controller (e.g., our third-party service providers).
• Data Subject — the natural person whose Personal Data is being processed (i.e., you).
• Consent — freely given, specific, informed, and unambiguous indication of agreement to the processing of Personal Data.
• GDPR — the EU General Data Protection Regulation (2016/679).
• UK GDPR — the retained EU law version of GDPR as it forms part of UK law pursuant to the European Union (Withdrawal) Act 2018.
• CCPA/CPRA — the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act of 2020.
• PDPL — Egypt's Personal Data Protection Law No. 151 of 2020 and its implementing regulations.
• SCCs — Standard Contractual Clauses adopted by the European Commission for international data transfers.

We collect the following categories of Personal Data:

• Account Information — your full name, email address, and profile picture, provided at registration or via Google OAuth. This is required to create and maintain your account.
• Usage Data — renders generated, modules used, credit balance, generation history, feature interactions, and timestamps of activity.
• Payment Data — transaction references, subscription plan details, and invoice records. Payment card data is collected and processed exclusively by Noon Payments and is never transmitted to or stored on MNKI servers. MNKI retains only order references, amounts, and payment status.
• Uploaded Content — images and design files you upload for AI-powered rendering. These are processed by our AI pipeline and stored temporarily as described in Section 7. They are not used to train AI models without your explicit, separately obtained, opt-in consent.
• Technical Data — IP address, browser type and version, operating system, device identifiers, referring URLs, and session tokens collected for security, fraud prevention, and service continuity.
• Communications — messages sent to or received via the in-app inbox, and correspondence with our support team, including email communications.
• Preference Data — settings, theme preferences, and UI state stored locally in your browser for session continuity.
• MNKI Wall Posts (Public Contributions) — if you choose to share output images to the MNKI Wall (available to all registered users on any plan), we collect your post details (the shared image, your caption up to 300 characters, posting timestamp, and either your first name or a flag indicating an anonymous post). Because the MNKI Wall is publicly accessible (allowing unauthenticated search indexing), any information you submit here will be publicly visible.
• MNKI Connector & API Credentials — if you connect MNKI to an external client (our MCP connector for Claude and compatible AI clients, or the MNKI Public API), we process the authorization data that secures that connection: OAuth authorization codes (single-use, short-lived) and refresh tokens (stored only as a hashed value, never in plaintext), or API keys you generate (also stored only as a hash). When you drive MNKI through such a client, the design prompts, instructions, and images you send from that client — and the renders, previews, and links we return — pass through that client to reach our Service. These are described further in Sections 5, 7, and 9.

We collect Personal Data directly from you, automatically through your use of the Service, and from third-party authentication providers (e.g., Google OAuth). We do not collect special categories of Personal Data (such as racial or ethnic origin, health data, or biometric data) in connection with the Service.

Where GDPR or UK GDPR applies, we rely on the following lawful bases for processing your Personal Data:

Where we rely on Legitimate Interests, we have conducted a balancing test and determined that our interests are not overridden by your fundamental rights and freedoms. You have the right to object to processing based on legitimate interests at any time (see Section 9).

Where we rely on Consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal.

We process your Personal Data only for the following purposes:

• To provide, operate, maintain, and improve the Service.
• To authenticate your identity and secure your account against unauthorised access.
• To process payments, issue invoices, and maintain financial records.
• To send transactional communications (account updates, credit alerts, export notifications, receipts).
• To detect, investigate, and prevent fraud, abuse, violations of our Terms, and security incidents.
• To comply with applicable legal obligations, regulatory requirements, and lawful government requests.
• To respond to your requests, questions, and support queries.
• To conduct aggregate, anonymised analytics to understand and improve usage patterns (only with your consent where required by law).
• To enforce our Terms of Service and other legal agreements.

We do not sell, rent, or trade your Personal Data to third parties. We may use your data in aggregate via Google Analytics and Google Ads for conversion tracking and measuring marketing performance, but we do not use your Personal Data for profiling or behavioural advertising. We do not use your uploaded images to train AI models without your separately obtained, explicit, opt-in consent.

Automated Decision-Making: We do not make solely automated decisions that produce legal or similarly significant effects about you (as defined under GDPR Art. 22). Our AI rendering pipeline generates outputs from your instructions but does not make decisions about you personally. If this changes, we will update this Policy and, where required, obtain your consent.

MNKI uses browser local storage (not traditional cookies) to maintain your session preferences (e.g., active view, theme, UI state) and to store your consent choice (mnki_consent).

Strictly Necessary storage is required for the Service to function and cannot be disabled. Functional and Analytics storage requires your consent where applicable law demands it.

You may withdraw analytics consent at any time by clearing your browser's local storage or by interacting with our consent banner, which will reappear on your next visit. Withdrawal does not affect the lawfulness of processing prior to withdrawal.

We use Google Analytics and Google Ads to understand how users interact with our Service and to measure the effectiveness of our campaigns. These third-party services may set cookies in your browser. For more information on how Google collects and processes data, please visit How Google uses information from sites or apps that use our services. You can opt out of Google Analytics using the Google Analytics Opt-out Browser Add-on and manage your Google Ads preferences via your Google Ad Settings. We do not sell data derived from cookies to advertisers.

We share your Personal Data only with the following categories of recipients, and only to the extent necessary for the stated purpose. All sub-processors are bound by written Data Processing Agreements requiring them to process your data lawfully, confidentially, and securely.

MNKI Connector (Claude & other MCP clients). Connecting MNKI to an external AI client is entirely at your own initiative. When you authorize such a connection (via OAuth) and then use it, the content you send from that client and the results we return flow through that client, and are handled by its operator (for Claude, Anthropic) under that operator's own terms and privacy policy — over which MNKI has no control. We share your MNKI data with a connected client only to the extent of the permissions (scopes) you approve, and only while the connection is active. You can end the connection at any time by disconnecting the connector in that client; the access tokens then go unused and expire.

We do not share your Personal Data with any other third parties except: (a) where required by law, regulation, court order, or lawful government authority; (b) to enforce our Terms of Service or defend legal claims; (c) in connection with a merger, acquisition, or sale of substantially all of our assets, in which case we will provide notice and ensure the successor entity honours this Policy or obtains your consent.

We require all third-party processors to implement appropriate technical and organisational security measures and to process data only on our documented instructions.

Your Personal Data may be transferred to and processed in countries outside your country of residence, including the United States, where our primary infrastructure is located. These countries may have data protection laws that differ from those in your country.

For transfers of Personal Data from the European Economic Area (EEA) or the United Kingdom to third countries (including the US), we rely on the following transfer mechanisms:

• Standard Contractual Clauses (SCCs) — We use the European Commission's current Standard Contractual Clauses (adopted June 2021) for transfers to service providers in third countries without an adequacy decision. For UK transfers, we use the UK International Data Transfer Addendum (IDTA) where applicable.
• Adequacy Decisions — Where the European Commission or UK ICO has issued an adequacy decision for the destination country, we rely on that decision.
• Processor Commitments — Our service providers (including Google and Twilio/SendGrid) maintain their own Transfer Impact Assessments and supplementary safeguards as part of their GDPR compliance programmes.

You may request a copy of the relevant transfer safeguards we have in place by contacting us at support@mnki.ai.

We retain your Personal Data only for as long as necessary for the purposes described in this Policy:

When you delete your account, your active Personal Data (name, email, profile, renders) is removed from our live systems within 30 days. Anonymised or aggregated data that cannot identify you may be retained indefinitely for analytics and service improvement purposes. Backups may retain deleted data for up to an additional 90 days as part of our standard disaster recovery cycle.

Payment records are retained for 7 years to comply with applicable tax and financial regulations.

Plan-based project lifecycle: Projects, chat sessions, and presentations are automatically and permanently deleted at the end of their retention window, which is measured from the time each item was created. When a project is deleted, the entire project is removed — including all renders, iterations, and uploaded or generated images inside it — regardless of when those individual items were created. Before any deletion, you will receive two warning notifications — an email and an in-app inbox message — at 7 days and again at 24 hours before the scheduled deletion date. If your paid plan is downgraded or expires, a 7-day grace period applies before the shorter retention window takes effect. Deleted content cannot be recovered. Upgrading to Pro or VIP removes the retention window entirely for the duration of your subscription.

If you are located in the European Economic Area (EEA) or the United Kingdom, you have the following rights under GDPR and UK GDPR respectively:

• Right of Access (Art. 15) — Request a copy of all Personal Data we hold about you, including the purposes of processing, categories of data, recipients, and retention periods.
• Right to Rectification (Art. 16) — Correct inaccurate or incomplete Personal Data. You can update your name or email directly from Account → Profile.
• Right to Erasure / "Right to be Forgotten" (Art. 17) — Request deletion of your Personal Data. You may delete your account from Account → Security, which removes your data from our active systems, subject to the retention requirements in Section 9.
• Right to Data Portability (Art. 20) — Download your Personal Data in a structured, commonly used, machine-readable format (TXT) from Account → Privacy & Data.
• Right to Restriction of Processing (Art. 18) — Request that we temporarily restrict processing of your data while a dispute or objection is resolved.
• Right to Object (Art. 21) — Object to processing based on legitimate interests. We will cease that processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.
• Rights Related to Automated Decision-Making (Art. 22) — As stated in Section 5, we do not engage in solely automated decision-making with legal or significant effects on you.
• Right to Withdraw Consent — Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, use the self-service tools in your Account page or contact us at support@mnki.ai. We will acknowledge your request within 72 hours and respond substantively within 30 calendar days. In complex cases, we may extend this by a further 60 days and will notify you of the extension.

We may need to verify your identity before processing your request. We will not charge a fee for reasonable requests but reserve the right to charge a reasonable administrative fee for manifestly unfounded or excessive requests.

Right to Lodge a Complaint: If you are unsatisfied with how we handle your Personal Data or your rights request, you have the right to lodge a complaint with your local supervisory authority:

• EU users — the supervisory authority in your EU member state of residence or work.
• UK users — the Information Commissioner's Office (ICO): ico.org.uk

We encourage you to contact us first so we can resolve your concern directly.

If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) grants you the following additional rights:

• Right to Know — Request disclosure of the categories and specific pieces of Personal Data we have collected about you, the sources, business purposes, and third parties with whom we share it.
• Right to Delete — Request deletion of your Personal Data, subject to certain exceptions (e.g., legal obligations, fraud prevention).
• Right to Correct — Request correction of inaccurate Personal Data.
• Right to Opt-Out of Sale or Sharing — We do not sell or share your Personal Data for cross-context behavioural advertising. No opt-out is required, but you may contact us to confirm.
• Right to Limit Use of Sensitive Personal Information — We do not collect sensitive personal information (as defined under CPRA) in connection with the Service.
• Right to Non-Discrimination — We will not discriminate against you for exercising any of your CCPA/CPRA rights.

To submit a CCPA/CPRA request, contact us at support@mnki.ai with the subject line "CCPA Request". We will acknowledge within 10 business days and respond within 45 calendar days (extendable by a further 45 days with notice).

You may designate an authorised agent to submit requests on your behalf. We may require written proof of authorisation and verify your identity before acting on the request.

MNKI's primary market is Egypt and the MENA region. The following sets out the applicable data protection rights for users in MNKI's core operating jurisdictions.

Egypt — Personal Data Protection Law (PDPL No. 151/2020)

Egypt's Personal Data Protection Law No. 151 of 2020 and its implementing regulations grant individuals in Egypt rights with respect to their Personal Data. MNKI processes data of Egyptian users in connection with its payment processing through Noon Payments and general platform use.

Under the PDPL, Egyptian data subjects have the right to:

• Be informed about the collection and use of their Personal Data.
• Access their Personal Data held by MNKI.
• Request correction of inaccurate Personal Data.
• Request erasure of Personal Data where processing is unlawful or no longer necessary.
• Object to processing in certain circumstances.
• Lodge a complaint with the Egyptian Data Protection Centre (EDPC) or the relevant competent authority under the PDPL.

MNKI obtains your consent prior to processing your Personal Data for purposes other than the performance of our contract with you, in accordance with the PDPL's consent requirements. Cross-border transfers of Egyptian residents' data are made subject to applicable transfer safeguards consistent with PDPL requirements.

United Arab Emirates — Federal Decree-Law No. 45 of 2021 on Personal Data Protection

The UAE Personal Data Protection Law (UAE PDPL), Federal Decree-Law No. 45 of 2021 and its Executive Regulations, applies to the processing of Personal Data of individuals located in the UAE. As MNKI's payment processing is provided by Noon Payments (UAE-based), and the Service is accessible to UAE residents, MNKI processes UAE users' Personal Data in connection with platform use and payment transactions.

Under the UAE PDPL, UAE data subjects have the right to:

• Be informed about the collection, processing, and storage of their Personal Data.
• Access their Personal Data and obtain a copy of it.
• Request correction or completion of inaccurate or incomplete Personal Data.
• Request erasure of Personal Data where processing is no longer necessary or lawful.
• Object to or restrict processing in certain circumstances.
• Lodge a complaint with the UAE Data Office (the competent supervisory authority under the UAE PDPL).

Cross-border transfers of UAE residents' Personal Data to countries outside the UAE are made subject to appropriate transfer safeguards, including contractual protections, consistent with the UAE PDPL's requirements.

Saudi Arabia — Personal Data Protection Law (PDPL, Royal Decree No. M/19, 2021)

Saudi Arabia's Personal Data Protection Law (Saudi PDPL), issued by Royal Decree No. M/19 in 2021 and effective since September 2023, regulates the processing of Personal Data of individuals in Saudi Arabia. Where MNKI processes Personal Data of Saudi residents in connection with their use of the Service, the following rights apply.

Under the Saudi PDPL, Saudi data subjects have the right to:

• Be informed about the processing of their Personal Data and its purposes.
• Access their Personal Data and obtain a copy in a clear and readable format.
• Request correction of inaccurate or incomplete Personal Data.
• Request destruction (erasure) of Personal Data where it is no longer required for the original purpose.
• Withdraw consent where processing is based on consent.
• Lodge a complaint with the Saudi National Data Management Office (NDMO) or the competent authority.

MNKI processes Saudi residents' Personal Data only to the extent necessary to perform the Service. Transfers of Saudi residents' Personal Data outside Saudi Arabia are conducted in accordance with the Saudi PDPL's cross-border transfer requirements, including applicable contractual safeguards. MNKI does not process sensitive Personal Data (as defined under the Saudi PDPL) without obtaining explicit prior consent.

To exercise your rights under any of the above frameworks, please contact us at support@mnki.ai. We will acknowledge your request promptly and respond within the timeframe required by the applicable law. We may need to verify your identity before processing your request.

We implement industry-standard technical and organisational security measures to protect your Personal Data against unauthorised access, alteration, disclosure, or destruction, including:

• TLS 1.2+ encryption for all data in transit between your device and our servers.
• AES-256 encryption at rest for all data stored in Firebase Firestore and Firebase Storage, applied automatically by Google Cloud infrastructure.
• Firebase Firestore security rules restricting access to authenticated, authorised users only.
• Authenticated Cloud Functions for all sensitive server-side operations.
• Firebase Storage access controls limiting file access to the owning user.
• Periodic review of security configurations and access permissions.

Data Breach Notification: In the event of a Personal Data breach that is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay and, where required by applicable law, notify the relevant supervisory authority within 72 hours of becoming aware of the breach. Our breach notification will describe the nature of the breach, the categories and approximate number of individuals affected, likely consequences, and measures taken or proposed to address the breach.

No system is completely secure. Despite our security measures, we cannot guarantee absolute security of your data. We encourage you to use a strong, unique password, enable any available two-factor authentication, and promptly report any security vulnerabilities or concerns to support@mnki.ai.

When you use the Service to generate AI-rendered images, you provide input materials (uploaded images, prompts, and parameters) that are processed by third-party AI APIs (Google Gemini / Imagen) on your behalf. The following applies:

• Your Input Data — You retain ownership of any intellectual property rights in images and materials you upload. You grant MNKI a limited, non-exclusive, royalty-free licence to process your uploaded content solely to provide the Service.
• AI-Generated Outputs — Subject to applicable law and Google's API terms, generated renders are intended for your use in accordance with our Terms of Service. MNKI does not claim ownership of your generated outputs.
• No Model Training — Your uploaded images are not used to train, fine-tune, or improve any AI model operated by MNKI or its sub-processors without your explicit opt-in consent.
• Third-Party AI Terms — Use of our AI rendering features is also subject to Google's applicable terms of service and usage policies. We encourage you to review Google's AI principles at ai.google/responsibility/principles.

You are solely responsible for ensuring that any content you upload does not infringe the intellectual property rights, privacy rights, or other rights of any third party.

The Service is not directed at, and is not intended for use by, children under 16 years of age (or 13 years of age in jurisdictions where that is the applicable minimum age). We do not knowingly collect Personal Data from children. If you believe that a child under the applicable age has provided us with Personal Data, please contact us immediately at support@mnki.ai and we will take prompt steps to delete such data from our systems.

If you are a parent or legal guardian and you are aware that your child has provided us with Personal Data without your consent, please contact us. In jurisdictions where parental consent is required for the processing of a minor's data, we will not process such data without obtaining that consent.

The Service may contain links to third-party websites, services, or integrations (for example, links to Google authentication or payment portals). This Policy does not apply to those third-party services. We are not responsible for the privacy practices or content of any third-party websites or services.

We encourage you to review the privacy policies of any third-party services you access through or in connection with the Service before providing any Personal Data to them.

To the maximum extent permitted by applicable law:

• MNKI's liability for any claim arising out of or relating to the processing of your Personal Data shall be limited to the greater of: (a) the amount you paid to MNKI in the 12 months preceding the event giving rise to the claim; or (b) USD 100.
• MNKI shall not be liable for any indirect, incidental, special, consequential, exemplary, or punitive damages arising from or relating to this Policy or the processing of your Personal Data.
• MNKI shall not be liable for any loss, damage, or breach arising from the acts or omissions of third-party processors, provided we have taken reasonable steps to ensure those processors comply with applicable data protection obligations.
• Nothing in this Section limits MNKI's liability for: (a) fraud or fraudulent misrepresentation; (b) death or personal injury caused by negligence; or (c) any liability that cannot be excluded or limited under applicable law.

Some jurisdictions do not allow the exclusion of certain warranties or limitation of liability. In such jurisdictions, the limitations above apply to the fullest extent permitted by law.

This Policy is governed by and construed in accordance with the laws of Egypt, without regard to conflict of law principles, except where applicable data protection laws of your jurisdiction (including GDPR, UK GDPR, or CCPA) grant you mandatory rights that cannot be waived by contract.

Any dispute, claim, or controversy arising out of or relating to this Policy or our processing of your Personal Data that cannot be resolved amicably shall be subject to the exclusive jurisdiction of the competent courts of Cairo, Egypt, unless your applicable local law requires otherwise.

EU and UK users retain the right to bring proceedings before the competent supervisory authority in their country of habitual residence, place of work, or the place of the alleged infringement, regardless of the governing law clause above.

Before initiating any formal legal proceeding, we encourage you to contact us at support@mnki.ai to allow us the opportunity to resolve your concern directly.

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or for other legitimate business reasons.

We will notify you of material changes by:

• Updating the "Last updated" date at the top of this page.
• Sending an email notification to your registered email address at least 30 days before the change takes effect.
• Displaying a prominent in-app notice when you next log in.

For non-material changes (such as typographical corrections or clarifications that do not affect the substance of the Policy), we will update the "Last updated" date without separate notification.

Where required by applicable law (including GDPR), material changes that affect the lawful basis for processing or expand our use of your Personal Data will require your affirmative re-consent rather than reliance on continued use. We will present you with a clear consent mechanism in such cases.

Your continued use of the Service after the effective date of non-material changes constitutes acknowledgment of the updated Policy. If you do not agree with material changes, you may delete your account before the changes take effect.

Prior versions of this Policy are available upon request by contacting support@mnki.ai.

If you have any questions, concerns, or requests regarding this Privacy Policy or our processing of your Personal Data, please contact us using the details below. We are committed to addressing your enquiries promptly and transparently.

Data Protection Officer (DPO): MNKI has assessed its processing activities and determined that the appointment of a formal Data Protection Officer is not currently mandatory under applicable law, as MNKI does not engage in large-scale systematic monitoring of individuals, does not process special categories of Personal Data at scale, and is not a public authority. Notwithstanding this, MNKI designates its support team as the primary point of contact for all data protection queries and rights requests. All privacy-related correspondence is handled with the same diligence that would be expected of a designated DPO. If MNKI's processing activities change such that a formal DPO appointment becomes required, this Policy will be updated accordingly.

This Privacy Policy was drafted for informational purposes and does not constitute legal advice. MNKI recommends that you consult with qualified legal counsel in your jurisdiction for advice specific to your circumstances. Regulatory requirements change frequently; the most current version of this Policy is always available at mnki.ai/privacy.