Privacy Policy
This policy explains what RUKN AL JOUDAH AI APPLICATIONS AND SERVICES L.L.C, trading as CaptchaAI, does with personal data — on this website and in the API you send your traffic to.
Last updated: 8 November 2026
1.Who we are
CaptchaAI is operated by RUKN AL JOUDAH AI APPLICATIONS AND SERVICES L.L.C, a company registered in the United Arab Emirates under commercial licence 1132943, with its registered address at Office 05-103, Al Rostamani Properties Building, Deira, Dubai International Airport, Dubai, United Arab Emirates.
We are the controller of the personal data described in this policy. For anything about privacy, write to privacy@captchaai.com.
2.What this policy covers
This policy covers both:
- the website at captchaai.com, including the dashboard, the help centre and the support ticket system; and
- the Service — the API you send CAPTCHA challenges to, and everything we process in order to return a solution.
If you are a visitor who never creates an account, only the website parts apply to you.
3.What we collect
| Category | What it is |
|---|---|
| Account | Email address, password (stored hashed, never in readable form), and the name or company name you give us |
| Sign-in with Google | If you sign in with Google, we receive your email address and basic profile information from Google. We do not receive your Google password |
| Billing | Your plan, invoices and payment history. We do not hold your card number — card details go to the payment provider, not to us |
| API usage | API key, request and response metadata, challenge type, timing, success and failure counts, thread usage |
| Challenge content | What you submit for solving. Section 5 explains this in full |
| Technical | IP address, browser and device information, and server logs. An IP address can identify you, and we treat it as personal data |
| Support | Tickets, emails and chat messages you send us |
| Cookies | See section 9 |
4.Why we use it, and our legal basis
Where the EU or UK GDPR applies to you, these are the legal bases we rely on.
| Purpose | Legal basis |
|---|---|
| Providing the Service, running your subscription and taking payment | Performance of a contract |
| Support, and answering billing or refund questions | Performance of a contract |
| Keeping the Service secure, preventing fraud and abuse, and enforcing our terms | Legitimate interests — protecting our systems, our customers and third parties |
| Accounting and tax records | Legal obligation |
| Marketing emails about the Service | Consent, which you can withdraw at any time |
| Analytics cookies | Consent, through the cookie banner |
5.The challenges you send us
This is the part most people want answered, and most providers do not answer it.
When you submit a challenge — an image, a site key, a page URL or similar — we process it only in order to return a solution to you.
Retention: We do not keep the content of a challenge after the solution has been returned to you. The request metadata described in section 3 — challenge type, timing, success or failure — is kept with our API logs for 30 days so that we can bill you correctly, support you and investigate faults.
Training: We do not use the challenges you submit to train our models.
Do not include personal data in a challenge submission if you can avoid it. If a page URL or an image you send us happens to contain personal data, it is processed under the same terms as everything else in this policy, and you remain responsible for having the right to send it to us.
6.How long we keep it
| Data | Kept for |
|---|---|
| Account data | As long as you have an account with us |
| Billing and invoices | 5 years — we are required to keep accounting records |
| API usage logs | 30 days |
| Server and access logs | 30 days |
| Support messages | As long as you have an account, and for a reasonable period after it closes so we can answer questions about past billing |
| Challenge content | See section 5 |
When you delete your account we delete or anonymise your data within 30 days, except records we are required to keep for tax or legal reasons. Backups are overwritten on their own cycle.
7.Who we share it with
We do not sell your personal data. We share it only with the providers that make the Service work, each under a contract that limits them to our instructions:
| Provider | What for |
|---|---|
| Payment providers | Taking payment and handling refunds. They receive your billing details directly — our payment providers act as merchant of record or processor for your purchase, and are named at checkout |
| Intercom | Support chat and the help centre |
| Mautic | Our own email platform — account and marketing emails |
| Google Tag Manager / Analytics | Website analytics, only if you accept analytics cookies |
| Sign-in, if you choose to use it | |
| Hosting and infrastructure | our hosting, storage and content-delivery providers |
We may also disclose data where the law requires it, or to establish or defend a legal claim. If our business is sold or reorganised, data may transfer with it, and this policy continues to apply.
8.Where it is processed
We operate from the United Arab Emirates and our infrastructure is located in the European Union. If you are in the EEA, your data is processed inside it. Because we are established in the United Arab Emirates, some data is also accessible to us there. Where data leaves the EEA or the UK we rely on Standard Contractual Clauses or another transfer mechanism permitted by law, and you can ask us for a copy.
9.Cookies and tracking
Our cookie banner lets you choose by category:
| Necessary | Sign-in, session security and CSRF protection. These cannot be switched off |
| Analytics | Google Tag Manager and Google Analytics. Off until you accept |
| Marketing | Mautic, and affiliate or referral attribution. Off until you accept |
| Functional | Intercom support chat |
When you are signed in, your analytics choice is also recorded on your account, so that purchase reporting respects it. You can change your choices at any time from the banner. More detail is in our Cookie Policy.
10.Marketing emails
We send service emails you cannot opt out of while you have an account — invoices, security notices and changes to these policies.
Marketing emails are separate, and every one carries an unsubscribe link. Unsubscribing takes effect for all marketing email and does not affect your subscription.
11.Security
Passwords are stored hashed. Traffic to the website and the API is encrypted in transit. Access to customer data is limited to staff who need it for their work.
No service can promise perfect security, and we do not. If you believe your account or API key has been compromised, tell us immediately at support@captchaai.com and we will help you rotate your key.
12.Data breaches
If a breach affects your personal data and is likely to result in a risk to your rights, we will notify the relevant supervisory authority without undue delay and within 72 hours where required, and we will tell affected customers directly where the risk is high.
13.Your rights
Depending on where you live, you may have the right to:
- access the personal data we hold about you
- correct it if it is wrong
- delete it, where we have no overriding obligation to keep it
- restrict or object to our processing
- receive it in a portable format
- withdraw consent at any time, where we rely on consent
- not be subject to a decision based solely on automated processing
If you are in California, you also have the right to know what we collect and to ask us to delete it, and we do not sell or share personal information as those terms are defined there. If you are in the United Arab Emirates, you have equivalent rights under the UAE Personal Data Protection Law.
14.How to exercise them
Email privacy@captchaai.com from the address on your account, or raise a ticket at ticket.captchaai.com.
We respond within 30 days, and within 45 days for requests under California law. We may ask you to confirm your identity first — we will not hand over an account's data to someone who cannot show it is theirs. The service is free unless a request is excessive or repetitive.
15.Complaints
If you are unhappy with how we have handled your data, tell us first at privacy@captchaai.com — most issues are resolved quickly. You also have the right to complain to your local data protection authority, and nothing here prevents that.
16.Children
The Service is not intended for anyone under 18, and we do not knowingly collect their data. If you believe a child has given us personal data, write to privacy@captchaai.com and we will delete it.
17.Automated decisions
We use automated checks to detect fraud and abuse — for example unusual payment patterns or request volumes — which may flag an account for review or suspend it. A person reviews any decision that suspends or closes an account, and you can contest it by writing to support@captchaai.com.
18.Other websites
Our site links to other websites, and the Service is used against systems we do not control. This policy does not cover them, and we are not responsible for their privacy practices.
19.Changes to this policy
We may update this policy. We post the updated version with a new date, and for significant changes we give notice on the website and by email at least 30 days before they take effect.
20.Contact
| Privacy requests | privacy@captchaai.com |
| Support and security | support@captchaai.com · ticket.captchaai.com |
| Company | info@ruknaljoudah.com |
Commercial licence 1132943
Registered address: Office 05-103, Al Rostamani Properties Building, Deira, Dubai International Airport, Dubai, United Arab Emirates
Privacy: privacy@captchaai.com · Support: support@captchaai.com
