Privacy
We ask nonprofits to be candid about how their organization actually works. That only holds up if we are equally clear about what happens to what you tell us. This page says exactly that, in plain terms, with no gap between what it promises and what the product does.
Who we are
Nasaq is a funding diagnostic for nonprofits in the Middle East and North Africa. It is built and operated by Nart Abaza and Ahmed H. Osman, working as individuals rather than through an incorporated company. We are the people who decide what happens to the data described here, and we are the people you reach when you write to us.
Write to hello@nasaq-os.com about anything on this page.
What we collect
All of it comes from you, either typed into the product or uploaded to it.
- Account details Your name, email address, and a password stored only as a cryptographic hash. If you sign in with Google, we receive your name, email address and profile picture from Google instead of a password.
- Organization profile Legal name, organization type, sector, website, country of registration, countries you work in, staff size band, annual budget band, who your programs serve, and the name and role of the person we should contact.
- Your diagnostic conversation The questions we ask and the answers you give, kept so you can leave and return to an assessment without starting over.
- Documents you upload The file itself, the text extracted from it, and the structured facts our analysis draws out of that text.
- Your results Dimension scores, the evidence cited for each, your readiness snapshot, and the report generated from them.
- Operational records How much AI processing your organization has used, and error logs that let us find and fix faults.
Why we collect it
To produce your assessment and report, to keep your account working, to enforce the free usage allowance fairly across organizations, and to contact you about your account or your results. Nothing here is collected for advertising, profiling, or resale.
Your profile and answers shape the assessment directly. Jurisdiction of registration and countries of operation drive which funding you are shown as eligible for, which is why we ask for them specifically rather than inferring them.
How AI analysis works
Nasaq uses a large language model to conduct the diagnostic conversation and to read the documents you upload. Your answers and the text extracted from your documents are sent to that provider for analysis and the result comes back to us.
We currently use Anthropic (Claude). Under Anthropic's commercial API terms, content sent through the API is not used to train their models.
AI providers are a technical choice and may change. If we move to a different provider we will name the new one here, and this page will always name the provider actually in use.
Who else handles it
Beyond the AI provider named above, a small number of service providers handle your data on our instructions so the product can run at all. We choose them for reliability and we change them when a better option exists, so we describe them by function:
- A cloud hosting and database provider, which runs the application and stores your data and uploaded files.
- An email delivery provider, which sends account emails such as verification and password resets.
- Google, only if you choose to sign in with a Google account.
If you need the current providers named, for a funder's due diligence questionnaire or your own records, ask us and we will send you the list in writing.
The marketing site is separate
This site, nasaq-os.com, uses Microsoft Clarity to understand how visitors move through our public pages. That is ordinary web analytics and it applies only to these public pages. The product itself, at app.nasaq-os.com, runs no third-party analytics and no advertising trackers of any kind. The only cookie it sets is the one that keeps you signed in.
What we never do
- We never sell your data, and we never share it with data brokers or advertisers.
- We never show your organization's answers, documents or scores to another customer.
- We never use your documents to train AI models, and neither does our AI provider.
- We never publish or name your organization in marketing without asking you first.
If we ever want to use anonymized, aggregated patterns across organizations to improve the diagnostic itself, we will say so here before doing it.
How we protect it
- All traffic to and from the product travels over HTTPS.
- Passwords are stored as cryptographic hashes and are never readable, by us or by anyone else.
- Your data is scoped to your organization. Accounts cannot read across organizations.
- Administrative access is limited to the two of us, and we use it to operate and support the service.
Shareable report links
You can generate a link that lets someone read your report without an account. That link is long and unguessable, but anyone holding it can open the report, so treat it like a document you have emailed. You choose whether to create one.
Where it is processed
Our hosting and AI providers operate outside the Middle East and North Africa, so your data is stored and processed abroad, primarily in Europe and the United States. If your funders or your national regulator require data to stay in a particular region, tell us before you upload anything and we will tell you plainly whether we can meet that today.
How long we keep it
We keep your account, profile, assessments and documents for as long as your account is open, because the point of the product is that your assessment is still there when you come back to it. We do not delete your work on a timer.
Operational error logs are kept while they are useful for diagnosing faults and are not used for any other purpose.
Getting your data deleted
Email hello@nasaq-os.com from the address on your account and we will delete it. Everything goes: your account, your organization profile, your diagnostic conversations, your uploaded files and their extracted text, and your reports.
We complete deletion within 30 days and confirm to you when it is done. Backups held by our hosting provider age out on their own schedule and are not used to restore deleted accounts.
You can also ask us for a copy of what we hold about you, or ask us to correct anything inaccurate, at the same address. There is no charge for any of this.
What to upload, and what not to
The diagnostic works from documents you would already show a prospective funder: your strategy, your annual report, your budget summary, your registration certificate, your policies and procedures.
Please do not upload files containing personal information about the people your programs serve, such as beneficiary case files, lists of names, medical or legal details, or anything about children. The assessment does not need it and cannot use it. The same goes for staff personnel files.
Beyond the free diagnostic
This page covers the free diagnostic and the report it produces. Organizations that work with us beyond that, on ongoing funding strategy and the wider platform, can agree specific terms in writing covering retention periods, data residency, deletion timelines, named subprocessors and a signed data processing agreement, matched to what their own funders and regulators require. Ask us and we will put it in front of you.
Changes to this page
When we change this page we update the version date at the top. If a change materially affects what happens to data you have already given us, we will email you about it rather than relying on you to notice.
Contact
hello@nasaq-os.com. We answer questions about this page from funders and due diligence teams as readily as from the organizations using the product.
See also our Terms of Use.