Privacy Policy

Version: 3.3 Effective date: 1 November 2026 Last updated: 20 October 2026

Version française · Versión en español

Where Athina AD is offered. Athina AD accounts and plans are offered only to individuals resident in, and organisations established in, the United States, Canada or Mexico. The service is not offered to customers elsewhere. OMAC (FZE), based in the UAE, makes and operates Athina AD. Paid plans are sold by OMAC's authorised reseller, AI For The Blind Corporation, as the Terms of Sale explain. These documents are provided in English, French and Spanish. This market restriction does not waive any rights or obligations that applicable law requires.

This policy explains what personal information Athina AD collects, why, who receives it, how long it is kept, and the choices and rights you have. It applies to the Athina AD website (athinaad.com), the Athina AD web app, the Athina AD apps for iPhone and Android, and the emails and support we provide.

The short version

• Athina AD is made and run by OMAC (FZE), a company in Sharjah, United Arab Emirates. OMAC decides how your information is used and is responsible for it.
• Paid plans are sold by our reseller, AI For The Blind Corporation. It receives only the details of your purchase, never your videos or results (Section 8.3).
• We use submitted content to provide your requested descriptions and narration, and for the limited support, security and legal purposes explained below.
• We do not sell personal information or use it for targeted advertising. We do not use customer content to train AI or authorise providers to do so. Section 5 explains the business/API terms and separate provider retention.
• Our staff open your videos only for six specific reasons, listed in Section 7, such as when you ask us for help.
• Exporting to YouTube is optional and happens only when you ask. If you connect a YouTube channel, we use Google's upload permission only to upload a video you have confirmed. You can disconnect at any time (Section 5.1).
• Original videos are deleted 30 days after the job starts. You can delete any job, or your whole account, at any time. A deleted account can be restored for 30 days.
• You can ask to see, correct, download or delete your information. Write to support@athinaad.com.
• Athina AD is for people 18 and older.

1. Who we are

Athina AD is operated by OMAC (FZE) ("OMAC", "we", "us"), Trade Licence No. 11651, issued by the SRTI Free Zone Authority:

Block B, Office B58-111, Sharjah Research Technology and Innovation Park, University City, Sharjah, United Arab Emirates, P.O. Box 66636

OMAC is the controller of the personal information described in this policy, which means we decide how and why it is used. There is one exception: when an organisation (such as a school or a company) uploads videos, the organisation decides what is in them, and we process those videos on its behalf (see Section 10).

Who sells Athina AD plans. In the United States, Canada and Mexico, paid plans are sold by our authorised reseller, AI For The Blind Corporation, a nonprofit corporation in Texas ("the Reseller"), which takes payment through its own Stripe account. Plans are bought only on athinaad.com. OMAC remains responsible for the service and for your account; the Reseller is responsible for the sale and keeps its own sales records. Section 8 explains who receives what.

Contact for anything in this policy: support@athinaad.com.

2. What this policy does not cover

• Stripe. Stripe's own Privacy Policy covers the payment details you give Stripe at checkout.
• The Reseller's own sales records. When you buy from AI For The Blind Corporation, its own privacy policy covers the records it keeps of that sale (Section 8.3).
• Our Facebook and WhatsApp community groups. These run on Meta's services under Meta's own privacy policies. See Section 12.
• YouTube. When you give us a YouTube link or connect a YouTube channel to export a video, YouTube's own terms and Google's privacy policy also apply. See Section 5 and Section 5.1.
• onemoreaicompany.com, OMAC's company website, has its own short privacy policy.

3. The information we collect

3.1 Information you give us

3.2 Information collected automatically

3.3 Information we receive from others

3.4 What we do not collect

• Payment card details. Stripe handles them; we never see or store them.
• Your Google or YouTube password. If you connect a YouTube channel, you sign in on Google's own authorization screen. We never ask for or receive your Google or YouTube password.
• Health diagnoses. We do not require a disability or medical diagnosis to use Athina AD and do not infer one for advertising. Accessibility preferences or health information may appear in material you choose to submit or support messages. We limit its use to the requested service/support and other purposes permitted or required by applicable law; do not submit unnecessary sensitive information.

4. How we use your information, and why we are allowed to

We use information for the purposes below. Where applicable privacy law requires a legal basis, the relevant bases are:

• Contract: we need it to provide the service you signed up for.
• Legitimate interests: we have a genuine business reason, and it does not override your rights. You can object to these uses (Section 16).
• Consent: you said yes. You can withdraw your consent at any time.
• Legal obligation: the law requires it.

If we ever want to use your information for a purpose not listed in this policy, we will tell you first, and ask for your consent where the law requires it.

5. How your videos are described by AI

1. Google AI analyses your submitted content. We send the video or other content needed for the selected feature to Google's Gemini service to produce a description. For a YouTube submission, the link and relevant video information are processed to provide the requested description and playback. YouTube's and Google's terms also apply. This policy does not authorise bypassing YouTube access or download restrictions.
2. A voice is created from text. Google speech services or, where that feature uses it, OpenAI speech services receive the narration text and relevant voice settings.
3. OpenAI may receive text and audio. We use OpenAI business/API services for text refinement and relevant speech features. An OpenAI transcription feature sends audio to OpenAI; text refinement and speech generation send the relevant text. We limit what is sent to what the selected feature requires.
4. No AI training permission. OMAC does not use customer content to train AI models and does not authorise suppliers to use it for that purpose. We select business/API processing under terms that exclude model training on customer content unless the customer business opts in; OMAC does not authorise such an opt-in for Athina customer content. Google's paid Gemini API terms and OpenAI's API/business terms describe these protections. Provider safety, abuse-monitoring, operational and legally required retention are separate from training. OMAC's upload schedule is in Section 14; it is not a promise that every provider copy is deleted within 48 hours. Official terms and notices are linked in Section 8.6.
5. How the AI names people. The AI uses a person's name only when the name is spoken in the video, shown on screen, or typed in by you. It never identifies anyone from their face or appearance. When a name is not known, it describes the person instead, for example "a woman in a red coat".
6. AI can make mistakes. Descriptions may be wrong or incomplete. Please check them before relying on them or publishing them.
7. Results are labelled as made by AI. Audio and text we generate carry a hidden, machine-readable label saying they were made by AI. On some plans, results also start with a short spoken message from Athina AD that says so (Section 11).
8. Automatic safety checks. Our system and Gemini automatically check videos against safety rules. A job that fails the check is not processed, and you can ask a person to review the decision by writing to us. Account bans are always decided by a person, never automatically.

YouTube. Athina AD uses YouTube API Services. By submitting a YouTube link, or by using Export to YouTube, you also agree to the YouTube Terms of Service, and Google handles information under the Google Privacy Policy. Video information we receive from YouTube is refreshed or deleted within 30 days. The YouTube-link feature uses only public, non-authorized YouTube data: it does not ask for your YouTube login details, does not use OAuth authorization to access your YouTube account or channel, and does not upload, edit, delete, like, comment on or otherwise change anything on YouTube. The separate, optional export feature described in Section 5.1 uses OAuth authorization only when you grant it, and only to upload a video you choose.

Athina AD's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. You can also review the YouTube API Services Terms of Service and the YouTube Developer Policies.

5.1 Connecting a YouTube channel to export videos

Where Athina AD offers the optional Export to YouTube feature and you choose to use it, you can connect a YouTube channel through Google's authorization screen and ask us to upload a video output to that channel. Export is available only for video outputs generated from a file you uploaded to Athina AD. Connecting a channel is separate from signing in to Athina AD, and the Google account you connect may be different from your Athina AD account.

Permission we request. We request only Google's YouTube upload permission (https://www.googleapis.com/auth/youtube.upload). We use it only to upload a video you have chosen and confirmed. We do not use it to read your private YouTube data or to view, edit or delete other videos, comments, playlists, subscriptions or analytics on your channel.

Information we access, collect and store.

• Authorization tokens issued by Google when you connect a channel. The long-lived refresh token is stored encrypted. Short-lived access tokens are used only to perform an upload you requested or to confirm that the connection is still valid.
• The details you confirm for each export, such as the title, description, tags, category, title and audio languages, privacy setting, audience (made-for-kids) setting, altered or synthetic content disclosure, and the thumbnail image you choose, upload or generate.
• Information YouTube returns, such as the video ID and link, the channel ID and channel name, and the upload and processing status or any error.
• Records of your choices, such as when you connected or disconnected a channel and when you confirmed each export.

How we use and share this information. We use it only to upload the video you choose with the details you confirm, show you the upload status and link, keep or end the connection, troubleshoot a failed upload, prevent abuse, and comply with law and Google and YouTube policies. We upload only after you review and confirm each export, and we do not upload, publish, edit or delete anything on your channel on our own. When you confirm an export, we send the selected video file from our cloud storage to YouTube together with the details and thumbnail you confirmed. After the upload, the video and its details are held by YouTube under YouTube's terms and the Google Privacy Policy, and you manage them in YouTube. We do not sell this information, use it for advertising, or use it to train or fine-tune an AI model. We share it only with Google and YouTube to perform the upload, with the hosting and storage providers listed in Section 8.1 that store it for us, with authorised staff as described in Section 7, or where required by law (Section 19).

Suggested details and thumbnails. Where offered, you can ask us to suggest export details or to generate a thumbnail, or you can fill in every detail yourself. To suggest a title, tags and other details, we send Google's Gemini API information we already hold for the job, such as its summary, story, key events, scene titles, original file name and narration language. To generate a thumbnail, we send Google's Gemini API a frame taken from your video, the job's summary and any notes you write about the thumbnail you want; the thumbnail is an edited version of that frame, not an image created from text alone. We show you every suggestion and generated thumbnail to review, edit or replace, and nothing is uploaded until you confirm the export. Suggestions and thumbnails are AI-generated and can be wrong, so check them before you confirm. This processing is covered by the business/API terms described in item 4 above, and we do not send Google or YouTube any information from your connected channel for it.

How long we keep it. The periods are listed in Section 14. In short, tokens are kept only while your channel is connected, and the export details and information returned by YouTube are kept for no longer than 30 days unless refreshed from YouTube while your channel is still connected.

Disconnecting and revoking access. You can disconnect your YouTube channel in Athina AD at any time. When you disconnect, we revoke our access with Google right away and delete the stored tokens and the YouTube information described above as soon as possible and within 7 days. You can also revoke Athina AD's access at any time through the Google security settings page at https://security.google.com/settings/security/permissions. We check at least every 30 days that our authorization is still valid. If it has been revoked or can no longer be refreshed, we delete the related tokens and YouTube information as soon as possible and within 30 days of the revocation. Disconnecting or revoking access does not remove videos already uploaded to YouTube; you can delete them in YouTube.

Questions or complaints. If you have questions or complaints about how we handle information from your connected YouTube channel, write to support@athinaad.com (Section 22).

6. What you can see and keep

• Creator plan: your results are kept in My Described Videos until you delete them or your account.
• Free and Basic plans: we do not keep your results for you. Download your files from the results page. Once you leave that page or start a new description, they are no longer available to you, and our systems delete them within 24 hours of the job finishing. Nothing from these plans appears in My Described Videos.
• Enterprise: as agreed in your organisation's contract.
• Top-up minutes you buy add to your plan's minutes. They do not change your plan's rules on storage or on the Athina AD message and sponsor clips (Section 11).

7. When our staff look at your videos

Our staff open a user's videos or results only in these six situations, and only the videos concerned:

1. You ask us for help with a job. If you contact us about a video, we will open that video and its results to look into it.
2. A job failed or produced a faulty result and we are fixing the problem.
3. Quality checks on a small sample of results, to make descriptions better.
4. A safety or abuse report, or your request to review an automatic safety block.
5. A copyright notice about that video.
6. A legal order we must obey (Section 19).

Authorised access is limited to the situations above and the information needed. OMAC's CEO works from the UAE and its contracted lead developer from Egypt. The developer is under a confidentiality contract. We require named, role-limited access, confidentiality, appropriate two-step sign-in for privileged access and records of relevant access. Access must end when no longer needed; neither person may use customer information for an unrelated personal purpose.

Testing with your video. Sometimes a real video helps us test an improvement. We will only keep a copy for testing if we ask you about that specific video and you say yes. Saying no never affects your service, and the copy is deleted when you delete the video.

8. Who receives your information

We never sell your personal information, and we never share it for targeted advertising.

8.1 Service providers that work for us

We use the providers below for the stated work under the terms applying to the relevant service. Where they process information on our behalf, we require appropriate contractual protection. Some also act independently for their own billing, security, fraud-prevention or legal purposes, as explained in their notices. OMAC remains responsible for its own duties.

We publish this list here and will update it before adding a new provider. Business customers are told in advance (Section 10).

8.2 Payments: Stripe

Your Seller, AI For The Blind Corporation, takes payment through its own Stripe account. You enter card details directly with Stripe. OMAC receives the purchase information described in Section 3.3 to switch on your plan and to handle cancellations, refunds and disputes for the Seller. Stripe also uses some information for its own purposes, such as preventing fraud, under its own Privacy Policy. Athina AD is not sold inside the apps, so Apple and Google receive no subscription-payment information from these purchases.

8.3 Our Reseller

AI For The Blind Corporation promotes and sells Athina AD plans in the United States, Canada and Mexico. When you buy, it is the seller: its Stripe account receives the information needed for the sale (your name, email address, billing address, the plan you bought and the payment), and it keeps that information for its own legal, tax and accounting obligations, under its own privacy policy. Our staff work in the Reseller's Stripe account to handle your cancellations and refunds on its behalf.

Apart from those sales records, we do not give the Reseller personal information about Athina AD users. It does not receive your videos, your results or how you use the service; it sees only totals, for example how many people bought a plan. All support, account emails and surveys about Athina AD come from OMAC. If you contact the Reseller about Athina AD, it passes your message to us. OMAC keeps the purchase records it needs for its own legal, tax and accounting duties.

8.4 Advertisers

Advertisers never receive your personal information. We may tell them totals only, for example how many results included their clip. See Section 11.

8.5 Other cases

• Legal requirements: when a valid law, court order or government request requires it (Section 19).
• To protect people: when necessary to prevent serious harm, fraud or a security threat.
• If OMAC's business changes hands, for example in a merger or sale, your information may pass to the new owner, who must keep the promises in this policy. We will tell you first.
• With your permission, in any other case.

8.6 Official provider information

The following explain the providers' own terms, privacy notices and data-processing commitments:

• Google Cloud: Data Processing Addendum and Google Privacy Policy.
• Firebase: Data Processing and Security Terms and privacy and security information.
• Gemini API: service terms, including paid-service content protections and Google processor terms.
• OpenAI business/API services: Data Processing Addendum, API data controls and retention and Privacy Policy.
• Brevo: service terms, including its DPA, Privacy Policy and published storage locations.
• Namecheap Private Email: Data Processing Addendum and Privacy Policy.
• Stripe: Data Processing Agreement and Privacy Policy.

These links explain supplier handling; they do not replace this policy, transfer OMAC's responsibilities to a supplier, or make you a party to every supplier contract. A processing term applies according to the relevant service agreement and roles. We do not claim that a hyperlink alone executes a separate agreement or transfer safeguard.

8.7 YouTube and Google, at your direction

YouTube is not a service provider that works for us; it is a service you choose to use. When you submit a YouTube link, we retrieve the public video information described in Section 3.3 through YouTube API Services, and YouTube and Google may receive the link, API request information, your IP address and ordinary device or network information when their services are contacted. If you use Export to YouTube, we send YouTube the selected video file, the thumbnail you chose, and the title, description and settings you confirmed, using the authorization you granted, and YouTube returns the information described in Section 5.1. YouTube then holds the uploaded video under its own terms and the Google Privacy Policy. Our use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements (Section 5).

9. People who appear in videos

Videos can show or mention people other than the user who uploads them. We process those people's images, voices and names only to describe the video for the user who uploaded it, and we apply the same protections: no AI training, no identification from faces, deletion on the same schedule. The person who uploads a video must have the right to do so.

If you appear in a video processed by Athina AD and have a question or concern, write to support@athinaad.com.

10. Organisations: schools, companies and other business customers

When an organisation uploads videos, the organisation decides what goes in, and is responsible for having permission from the people in them. We process those videos on the organisation's documented instructions for the agreed service. Our Data Processing Addendum is available on request at support@athinaad.com and becomes binding when accepted or validly incorporated into the organisation's agreement; publishing a template does not sign it for an unidentified customer. Questions from people in those videos should go first to the organisation; we will help it respond.

For the organisation's staff accounts (sign-in, security and billing), OMAC remains responsible as described in this policy.

11. Advertising and the Athina AD message

• The Athina AD message. Results on the Free and Basic plans may begin with a short spoken message from Athina AD: a thank-you, a note that the description was made by AI, and how to contact us. It contains no information about you.
• Sponsor clips. In future, results on the Free and Basic plans may include a short clip from a company that makes accessibility products. Never on the Creator plan.
• Advertisers never receive your personal information, only totals.
• A clip is never chosen based on who you are.
• We use no advertising networks, advertising cookies or tracking.

12. Emails and community groups

• Account emails (verification, password reset, job updates, purchase and renewal notices, important changes to our terms) are sent to everyone with an account.
• News and offers are sent only if you ticked the box to receive them when you signed up, or later in your settings. It is never ticked for you. Every such email has an unsubscribe link.
• Our WhatsApp and Facebook groups are optional. We share an invitation link; you join through WhatsApp or Facebook yourself, and we never collect your phone number to add you. Inside those groups, Meta's privacy policies apply, and other members may see your name, profile and, on WhatsApp, your phone number.

13. Cookies and similar technologies

Website and web app:

The sign-in pages load Google's Firebase sign-in software from Google's servers, which means Google receives your IP address when those pages open. Stripe's checkout pages set their own cookies to process your payment and prevent fraud.

We use no analytics, advertising or tracking cookies on the website or the web app. If this ever changes, we will update this policy first and ask for your permission before any such cookie is set.

Mobile app: crash reports (on, with an off switch) and usage statistics (only if you allow them), as described in Section 3.2. The app does not collect your phone's advertising identifier and does not track you across other companies' apps or websites.

14. How long we keep your information

15. Deleting your videos and your account

• Delete a job: use the delete button beside it in My Described Videos.
• Delete your account: in the app, open Profile and choose Delete my account. On the website, open Account, choose Delete my account, enter your password and confirm with Delete account. If you can no longer sign in, email support@athinaad.com from the address on your account. Step-by-step instructions are at athinaad.com/delete-account.
• 30 days to change your mind: when you ask to delete your account, it is locked at once, you are signed out on every device, and we email you the date it will be deleted. For 30 days you can sign in on the website or in the app and choose Restore my account; everything is kept as it was. After 30 days the account and its information are permanently deleted from our live account systems, and we email you to confirm. This cannot be undone.
• Subscriptions: your subscription stops renewing as soon as you ask to delete your account, so you are not charged again. Restoring the account does not restart it: we ask whether you want to restart monthly billing. If the account is permanently deleted, any paid time and remaining top-up minutes end then, as Section 5.4 of the Terms of Sale explains.
• YouTube channel: if you connected a YouTube channel, we revoke that connection with Google when you ask to delete your account, and delete the related tokens and YouTube information as soon as possible and within 7 days, without waiting for the 30-day restore period to end. If you restore your account, you need to connect your channel again. Deleting information we hold does not delete content or information stored by YouTube, including videos you already exported to your YouTube channel; delete those in YouTube.
• Removal from live systems: a deleted job is removed from our live systems within 30 days. A deleted account is removed from our live account systems when its 30 days end. Recovery copies and retained records follow the separate periods below.
• Recovery copies: deleted storage files remain recoverable for 7 days after each stored version is deleted. Database recovery history lasts up to 7 days after deletion. These periods are separate from the 30-day account restoration window.
• Server logs and archives: normal server logs are kept for 90 days after they are written; Google's required administration audit logs for 400 days. Copies sent to a separate archive currently have no automatic expiry rule, so account deletion does not itself erase every archive copy. Such copies, exports and authorised staff-held copies may be retained only while reasonably needed for a documented security investigation, support matter, legal claim or legal obligation. We assess the relevant purpose and applicable legal periods when handling a deletion request, restrict access and use, and delete or anonymise the information when that reason ends. The absence of an automatic expiry rule does not authorise indefinite use or retention. We do not promise that all copies disappear after seven or 90 days. Email correspondence has the separate two-year period in Section 14.
• Provider-controlled copies: suppliers may retain separate security, abuse-monitoring, recovery or legally required records under the applicable service terms. Their deletion processes can continue after a file disappears from your account; these copies are not available to you as ordinary account content. See the notices in Section 8.6. We do not promise zero retention at every supplier.

• Other records kept after your account is deleted: in addition to the recovery copies, server logs and archives described above, the items in Section 14 that are kept for a stated reason (the record of accepting our terms, purchase records we must keep by law, security records until their 12 months end, and totals that cannot identify you), a record that the deletion was completed (it keeps only a one-way scrambled (hashed) form of your email address, not the address itself), and our email conversations with you, which follow their own 2-year period. Stripe, and the Reseller for its own sales, keep purchase records as their own policies describe; OMAC’s purchase-record retention is described in Section 14.
• Legal holds: if we receive a formal legal order to preserve certain information, we keep that information until the matter ends, even if you asked us to delete it.

16. Your rights

Wherever you live, you can ask us to:

• See the personal information we hold about you and get a copy of it.
• Correct it if it is wrong.
• Delete it.
• Download it in a common format, to keep or move elsewhere.
• Object to our uses based on legitimate interests, or restrict how we use it while a concern is checked.
• Withdraw your consent at any time: unsubscribe from news, change the app's usage-statistics choice, disconnect your YouTube channel in Athina AD or revoke access through your Google security settings (Section 5.1), or tell us.
• Ask a person to review an automatic safety decision.

How: email support@athinaad.com from the address on your account, or tell us which account it concerns. This includes requests about a submitted YouTube link or a connected YouTube channel. We may ask you to confirm your identity. We acknowledge ordinary enquiries within two calendar days, including weekends and public holidays, using Gulf Standard Time (GST), UTC+4. We respond to rights requests within 30 days, subject to any shorter legal deadline or a lawful extension; if an extension applies, we explain it within the time the law requires. This support target never delays an urgent incident notice or a shorter statutory deadline. We never treat you differently for using your rights.

Complaints. Please contact us first, and we will try to resolve it. You also have the right to complain to a data protection authority. The authorities for each region are listed in Section 17.

17. Information for your region

17.1 Market scope and information from elsewhere

Athina AD accounts and plans are offered only to customers in the United States, Canada and Mexico. This policy still explains information processed through the website, enquiries, earlier use or customer-supplied content, including information about people in other countries. A sales restriction does not remove privacy obligations where the law applies. OMAC has not appointed an EU or UK representative. Any legally required representation must be arranged if the relevant processing requires it; this notice does not claim an exemption. Contact support@athinaad.com about privacy rights, including rights arising from earlier use.

17.2 United States

• What we collect: the categories in Section 3 — identifiers (name, email, IP address, customer reference, and the YouTube channel ID and name if you connect a channel), your age range, internet activity (security records, job records), approximate location (country), commercial information (plans bought), and audio and visual content (videos and results). We do not build profiles about you. Sources: you, your device, Stripe and Google/YouTube (Section 3). Purposes: Section 4. Recipients: our service providers (Section 8) and, when you buy a plan, our Reseller (Section 8.3).
• Sensitive information: your account email and password are used only to let you sign in.
• We do not sell or share personal information for cross-context behavioural advertising.
• Your rights: to know, correct and delete your information, and not to be treated differently for using these rights. You may use an authorised agent; we may ask the agent for proof of your permission.
• Appeals: if we decline your request, reply to our answer with the word "appeal", and a different person will review it within 45 days. If you are still not satisfied, you may contact your state's Attorney General.

17.3 Canada

• Person in charge of the protection of personal information (including for Québec): OMAC's Director, reachable at support@athinaad.com.
• Information stored outside Canada. Your information is stored and processed in the United States and the other countries described in Sections 8 and 18, and may be accessible to the courts and authorities of those countries under their laws.
• Complaints: to the Office of the Privacy Commissioner of Canada (priv.gc.ca) or, in Québec, to the Commission d'accès à l'information (cai.gouv.qc.ca). Provincial commissioners also exist in Alberta and British Columbia.

17.4 Mexico

This policy is our full privacy notice (aviso de privacidad integral) for people in Mexico.

• Controller (responsable): OMAC (FZE), at the address in Section 1.
• Your ARCO rights: you can ask to access, rectify and cancel your personal information, and oppose its use; you can also withdraw your consent or limit how we use or disclose your information, by writing to support@athinaad.com. Tell us your name, the email address on your account, what you are asking for and, if you act for someone else, proof that you represent them. We reply within the period the law sets.
• Purposes: the uses in Section 4 that we need to provide the service (account, describing your videos, purchases, security, support, legal obligations) are necessary purposes. Sending news and offers, mobile usage statistics, and keeping a video for testing are secondary purposes: they are not necessary, and you can refuse them at any time by writing to support@athinaad.com or in your settings, without affecting your service.
• Transfers: we do not transfer your information to third parties that use it for their own purposes, except in the cases in Section 8.5 that the law allows without your consent. Your purchase information is collected by the Reseller at checkout for the sale (Section 8.3).
• Changes to this notice: we will tell you about them as Section 21 explains.
• Complaints: to the Mexican authority responsible for protecting personal data held by private parties.

17.5 Other applicable privacy rights

The market restriction does not remove privacy rights or access to a competent privacy regulator where another law applies to information we process. Contact support@athinaad.com to exercise those rights. The rights, deadlines and safeguards that applicable law requires take priority.

17.6 Existing information

A change in the countries we serve does not itself authorise new uses of previously collected information or cancel earlier privacy commitments.

17.7 United Arab Emirates

OMAC is subject to the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021). You may complain to the UAE Data Office.

18. Where your information is stored, and how it is protected

Where. Core Athina application hosting, database and checked storage are on Google Cloud in the United States. OMAC's authorised CEO and contracted lead developer access information from the UAE and Egypt, respectively, for the limited purposes above. Our suppliers process information in the locations described in Section 8, including European email infrastructure and other countries permitted under the relevant service terms. Serving customers in the United States, Canada and Mexico does not mean that processing happens only in those countries; information about Canadian and Mexican customers is stored in the United States. Where applicable law restricts a transfer, we must use a valid safeguard or lawful exception for that transfer, such as the applicable standard contractual clauses, before the restricted processing occurs. This policy does not itself execute those clauses or claim a provider certification that has not been verified.

Security. We require protection in transit and at rest, role-limited authorised access, confidentiality, appropriate multifactor authentication for privileged access and records of relevant security/access events. No system is perfectly secure. If a personal-data breach requires notice, we notify affected people and the relevant authorities within the applicable legal deadlines. These commitments are not an independent security certification.

19. Legal requests

We disclose information to police, courts or government authorities when required by applicable law or a valid binding order, or when another lawful disclosure described in Section 8.5 is necessary to protect people or address serious fraud/security threats. We limit the information to what the lawful purpose requires and tell you where permitted and appropriate. A legal preservation duty can require retaining specified information until the duty ends; it does not authorise unrelated indefinite retention.

20. Age limit

Athina AD is for people 18 and older. We do not knowingly collect information from anyone younger. If we learn that someone under 18 has created an account, we delete it.

21. Changes to this policy

If we make an important change, we will email you and show a notice in the app and on the website 30 days before it takes effect. A change does not retrospectively authorise an incompatible new use of information already collected; any additional notice, consent or other legal requirement must be satisfied first. Small changes that do not affect your rights, such as correcting a typing error, may take effect when published. The date at the top shows the latest version. Earlier versions are available on request.

This policy is available in English, French and Spanish. For people in Québec, the French version applies; for people in Mexico, the Spanish version applies; otherwise, the English version applies if they differ.

22. Contact us

• Privacy questions and requests: support@athinaad.com
• Post: OMAC (FZE), Block B, Office B58-111, Sharjah Research Technology and Innovation Park, University City, Sharjah, United Arab Emirates, P.O. Box 66636