Privacy Policy

1 · Who we are

Nuur and our Data Protection Officer

Nuur makes and sells the Nuur prayer clock in Singapore, and runs nuur.sg, the clock's settings page and the online service the clock connects to. In this policy "Nuur", "we" and "us" mean the business behind all of these.

Our Data Protection Officer is responsible for how we handle personal data and for answering questions, requests and complaints about it.

Data Protection Officer

salam@nuur.sg

Please put “PDPA” in the subject line so your message reaches the right person.

2 · What we collect

What we collect, and when

When	What	Why
You join the waitlist	Your WhatsApp number and the time you signed up.	To message you when Nuur launches and pre-orders open.
You place an order	Name, delivery address, email, phone number, any note for the courier, what you ordered and whether payment went through. Which version of our Terms of Sale you accepted, and when. Once we send your clock, its serial number, kept with your order. We never see or store your card details. While you order, your browser tab remembers the checkout it started, so going back doesn't place a second order; it forgets it when you close the tab.	To take payment, deliver your clock, honour the warranty, support you, and keep the accounting records the law requires. The serial number lets us find your order, and the warranty that comes with it, when you contact us about your clock.
Your Nuur clock is running	The clock's ID, firmware version, your settings, what it is playing, and health readings: WiFi signal strength, reconnect counts, free memory, download progress and when it last checked in.	To deliver prayer times, apply your settings within seconds, warn you if it goes offline, and send software updates.
You use the settings page	One sign-in cookie that links your browser to your clock, valid for up to 90 days. Your browser also remembers, on your phone only, whether you have seen the welcome screen and whether you closed the “add to home screen” tip.	So you stay signed in and aren't shown the tip again. Neither is used for anything else.
You write to us	Your email address or number and what you tell us.	To answer you.
Any request to our servers	Your IP address, the time and the page or service requested, in server logs.	To keep the service secure and fix faults.

What we don't collect

No microphone and no camera. The clock has no way to listen to or see anything in your home.
Your home WiFi password stays on the clock. It is never sent to us.
No accounts. The clock and the settings page work without a name, email or password.
No analytics, advertising or tracking cookies on nuur.sg or the settings page, and our pages load no third-party scripts or fonts.

3 · How we use it

How we use it, and what we never do

We use personal data only for the purposes in the table above, or for a new purpose you have agreed to. We also use it where the law requires, for example to keep tax records or to respond to a lawful request from the authorities.

We never sell or rent your personal data.
We never use it for advertising, and we don't share it with advertisers.
We only message you on WhatsApp about Nuur: the launch, pre-orders, your order and support.
Your clock's settings and readings are kept against the clock, not against a named account. Your order records which clock we sent you, by its serial number, so we can honour the warranty; we look your clock's settings and readings up from it only when you contact us about your clock.

4 · Consent

When you join the waitlist, place an order or write to us, you agree to us using your data for the purposes described here. You can withdraw that consent at any time: reply “STOP” to any of our WhatsApp messages, or email salam@nuur.sg. We'll act on it within 10 working days.

Withdrawing from the waitlist means we delete your number. For an order that's still open, we may need some details to finish delivering it or to refund you, and we keep accounting records for as long as the law requires (see How long we keep it). We'll tell you if withdrawing means we can't do something you asked for.

5 · Who else handles it

We use a small number of service providers. Each one handles your data only to provide its service to us.

Provider	What it does	Where
Google Cloud and Firebase	Hosts nuur.sg, the settings page, our service, its database and server logs.	Database and service in Singapore. Web pages are served from Google's worldwide network.
Amazon Web Services (AWS IoT Core)	Delivers instant setting changes to your clock. It sees your clock's ID and your home network's IP address while the clock is connected.	Singapore
Al-Quran recitation services (Quran Foundation, Islamic Network, QuranicAudio)	When you stream a recitation, your clock downloads it directly from them, so they see your home network's IP address. They receive nothing else from us.	Outside Singapore
WhatsApp (Meta)	Carries our messages to waitlist members, and support conversations you start with us. Order updates come by email, not WhatsApp.	Outside Singapore
HitPay	Takes your payment by PayNow or card. It receives your name, email, phone number, the order number and the amount. Your card details go to HitPay, not to us.	Singapore
Amazon Web Services (Amazon SES)	Sends your order emails: the receipt, delivery updates and anything else about your order. It handles your name, email address and the details of your order.	Singapore
Ninja Van	Delivers your clock. It receives your name, delivery address, phone number, email (for its delivery notifications) and any note for the courier.	Singapore
Our email provider	Stores messages sent to salam@nuur.sg.	May be outside Singapore

Where your data is stored or handled outside Singapore, we only use providers bound to protect it to a standard comparable to the PDPA, as the PDPA requires. We may also disclose personal data where the law requires it, or to our professional advisers under a duty of confidentiality.

6 · How long we keep it

How long we keep it

Data	Kept for
Waitlist number	Until 6 months after pre-orders close, or until you ask us to delete it, whichever comes first.
Order records	5 years after the order, as Singapore's tax and accounting rules require.
Clock settings and readings	As long as the clock is in use. Health readings are overwritten at each check-in, so we keep only the latest values. A factory reset restores the default settings and signs out every browser.
Sign-in cookie	Up to 90 days, or until you sign out or factory-reset the clock.
Messages to us	As long as we need them to help you, and no more than 2 years after the conversation ends.
Server logs	30 days.

7 · Your rights

Seeing, correcting and deleting your data

Email our Data Protection Officer at salam@nuur.sg to:

see the personal data we hold about you and how we have used it in the past year;
correct anything that's wrong;
withdraw your consent or ask us to delete your data.

We may ask you to confirm who you are first, for example by messaging us from the number you signed up with. We'll respond within 30 days, and these requests are free. If we can't do what you ask, for example because the law requires us to keep a record, we'll tell you why.

If you're not satisfied with our answer, you can complain to Singapore's Personal Data Protection Commission at pdpc.gov.sg.

8 · Security

Keeping it safe

Everything between your browser, your clock and our service is encrypted (HTTPS and TLS).
Our database is hosted in Singapore, and only the people who run Nuur can access it.
Each clock signs in with its own secret key, and we store only a scrambled (hashed) copy of it.
If a data breach could harm you, we'll tell you and the Personal Data Protection Commission, as the PDPA requires.

Children

Nuur is sold to adults. We don't knowingly collect personal data from children.

Changes to this policy

When this policy changes we'll update the date at the top of this page. If a change affects how we use data you've already given us, we'll tell you before it takes effect.

Only what we need, nothing more.