This policy explains how Moheet Corpus — a research connector built on the Model Context Protocol (MCP) over a digital corpus of Ahlulbayt Library publications — collects, uses, and protects your data, in compliance with the General Data Protection Regulation (GDPR).
1. Data Controller
The data controller is SADIQOON TECHNOLOGIES LTD (registered in England & Wales, No. 17120720). For any privacy enquiry or to exercise your rights, write to info@sadiqoon.uk.
2. Data We Collect
- Your Google account email and display name — via OAuth 2.1 sign-in through our own identity provider (auth.sadiqoon.com), with your Google account as the sole source of identity; we never see your password and require no form. Used solely to verify your identity and manage access authorisation.
- Your research query texts and tool-usage log — with each query your assistant sends to the corpus we record the query text, the tool name, the timestamp, the originating IP address, the connecting client type (Claude, ChatGPT or another), and the response duration and status — to operate the service, monitor the health and performance of the connector and the corpus, prevent abuse, and compile aggregate statistics. We do not use it for advertising, profiling or model training.
We do not collect your location, your contacts, or your conversations with your AI assistant beyond the queries sent to the corpus. We show no advertising and never sell your data to anyone.
3. Purpose and Legal Basis
We process your data on the basis of your consent (GDPR Art. 6(1)(a)), given when you sign in with Google and connect the connector, and our legitimate interest (Art. 6(1)(f)) in securing the service and preventing abuse. The purpose is strictly: operating the service, controlling access, and improving retrieval quality. We make no automated decisions with legal effect on you.
4. Sharing with Third Parties (Technical Sub-processors)
- Google LLC — sign-in (OAuth), server hosting (Google Cloud), and language processing of some queries (Gemini).
- Cohere Inc. — processing of query text for semantic embedding and reranking.
- Groq Inc. — language processing for research-query formulation.
These providers receive only the query text needed for processing; your data is not used to train their models, under enterprise usage agreements. We share your data with no other party except under a binding legal obligation.
5. Retention
Query logs are retained for twelve months, then deleted or anonymised. Account data is kept for as long as your account is active. Upon deletion of your data (see Data Deletion), it is erased within thirty days at most.
6. Your Rights
Under the GDPR you have the rights of access, rectification, erasure, restriction of processing, objection, and data portability. Write to info@sadiqoon.uk; you may also escalate to the supervisory authority in your country of residence. You may revoke the connector's authorisation at any time from your assistant's settings (Connectors) or by writing to us, and delete your account entirely from the Data Deletion page.
7. Security
All connections are fully encrypted (TLS); access is via OAuth 2.1 with your Google account, provisioned automatically on first sign-in and suspendable in case of misuse; the corpus tools are read-only and modify no content; and the infrastructure is isolated in independent containers.
8. Changes
We may update this policy; the date above reflects the latest revision. Continued use of the service after an update constitutes acceptance of it.