Privacy Policy

AI GATEWAY SUARL (TunAI), 39 Rue du Japon, Apt 1-2, 1st floor, Montplaisir, 1073 Tunis, Tunisia, is the data controller for the personal data described here. It is processed in accordance with Tunisia’s Organic Law No. 2004-63 on the protection of personal data and, where it applies to you, the EU General Data Protection Regulation (GDPR).

Questions and requests: privacy@tunai.tn.

• To provide the service (performance of our contract with you): sign you in, forward your prompts to the model you chose, store your conversations, meter usage, and manage keys, plans and balance.
• To bill you (contract and legal obligation): process payments, issue receipts, keep the accounting records Tunisian law requires.
• To keep the service safe (legitimate interest): automated screening of chat messages, rate limiting, abuse and fraud detection, security logging, enforcing the Terms of Service.
• To improve the product (legitimate interest): aggregate usage statistics, error monitoring, understanding which features are used.
• To communicate with you: receipts, low-balance and account notices, replies to your requests. We do not send marketing email unless you ask for it.

We do not use your prompts, files or conversations to train AI models, and we do not sell personal data to anyone.

We share personal data only with the providers below, each bound by its own contract and privacy terms, and only for the purpose stated. The AI model providers receive your content because that is how the service works: a prompt sent to a Claude model goes to Anthropic, a prompt sent to a DeepSeek model goes to DeepSeek, and so on. You choose which provider sees a given conversation by choosing the model.

We may also disclose data when the law requires it, to a court or authority with jurisdiction, to defend our rights, or as part of a merger or sale of the business (in which case this policy continues to apply).

TunAI is operated from Tunisia, but most of the providers above are outside Tunisia, and the AI model providers are for the most part in the United States. Your data therefore leaves Tunisia when you use the service. Transfers are protected by contracts with each provider, by encryption in transit and at rest, and by our sending only the data each provider needs. By using a model you accept that the prompt is sent to that model’s provider in the country listed above.

• Account data: for as long as your account exists, then deleted within 30 days of a deletion request.
• Conversations and uploads: until you delete them or your account.
• Moderation records (refusals, without the message): for as long as your account exists.
• API usage records: for as long as your account exists, and in any case as part of the billing records below.
• Billing and payment records: 10 years, as required by Tunisian accounting law, even after you close your account.
• Server, security and error logs: for a limited period, no longer than 12 months.
• Encrypted backups: rotated on a schedule; a deleted record disappears from backups when the last backup containing it is overwritten.

All traffic is encrypted with TLS. API keys are stored only as SHA-256 hashes; the secret is shown once and cannot be recovered by us. Database backups are encrypted with GPG before leaving the database. Access to production systems is limited to the people who operate the service and protected by SSH keys and multi-factor authentication. No system is perfectly secure; if we learn of a breach affecting your data we will tell you and the competent authority without undue delay.

You can ask us to:

• tell you what personal data we hold about you and give you a copy (access and portability);
• correct data that is wrong or incomplete;
• delete your account and personal data, except the billing records we must keep by law;
• stop or limit a particular use of your data, or withdraw consent where a use relies on it.

Write to privacy@tunai.tn from the email address on your account. We answer within 30 days and may ask you to confirm your identity first. You can delete individual conversations yourself in the chat app at any time.

If you are not satisfied with our answer you may complain to the Instance Nationale de Protection des Données à caractère Personnel (INPDP) in Tunisia, or, if the GDPR applies to you, to the supervisory authority of your country.

TunAI is not directed at children. You must be 18 or older, or at least 13 and using the service with the consent and supervision of a parent or legal guardian. We do not knowingly collect data from children under 13; if you believe a child has created an account, contact us and we will delete it.

We use only what the service needs to work and a small amount of analytics:

• Sign-in: Auth0 keeps your session token in your browser’s local storage so you stay signed in, and sets its own cookies on its domain during sign-in.
• Preferences: your theme choice is stored in local storage.
• Analytics: PostHog stores a random device id in local storage and a cookie to count visits and product events. You can block it with your browser’s cookie settings or a content blocker; the service keeps working.

We do not use advertising cookies or cross-site tracking.

When we change this policy we update the effective date at the top and, for material changes, tell you by email or in the app before they take effect. Earlier versions are available on request.

Privacy questions: privacy@tunai.tn. For everything else see our Terms of Service.