Skip to content

Data Retention & Account Deletion

Last updated: 10 July 2026

This page summarises how Norai retains account and learning data, how account deletion works, and how parents, guardians, and adult learners can request that data be removed. It supports the Privacy Policy, the Terms of Service, and the Refund Policy, and follows the same standards we apply across the Norai platform.

Norai is operated by Karsaaz EBS Ltd (United Kingdom). Billing and subscription processing are handled by Karsaaz EBS Technology Solutions FZCO (United Arab Emirates), acting as Merchant of Record.

Data retention

We retain account and learning data while an account remains active.

Retained data may include the parent or adult account profile, connected learner profiles, lesson completion records, practice activity, vocabulary progress, mastery and retention data, XP and learning activity, and session activity such as learner login and logout events.

Learning activity is linked to the learner profile and the parent managed account. We do not use learner data for advertising, profiling, or sale to third parties.

How account deletion works

Parents and adult learners may request account deletion either through the application or by contacting our support team.

When deletion is requested:

  • The account is soft deleted
  • A 30 day deletion grace period begins
  • During this period, account and learner data may still be recoverable
  • After the grace period ends, account and learner data are permanently deleted from active systems

Child learner profiles

Child learner profiles are created and managed by parents or guardians.

Parents or guardians may review, correct, or request deletion of child learner profile information at any time.

Child learner profiles can only be removed by the parent or guardian managing the account. Children do not create independent accounts and do not manage billing or subscription settings.

Device Unlinking and Device Records

Where supported, users may log out from or unlink a device connected to their Norai account.

Device records include limited technical information such as device type, device category, device model where available, operating system, app version, login status, last active time, device status, and notification token status.

This information helps Norai show and manage which device was used to access the account, support account security, manage active devices, troubleshoot device-related issues, and apply device access rules.

When a device is logged out, unlinked, or revoked, Norai may mark the device record as logged out or revoked, stop notifications to that device, and remove or invalidate related Firebase Cloud Messaging or Apple Push Notification service tokens where possible.

Norai may retain limited device audit records where needed for account security, support, fraud prevention, legal compliance, or subscription and device access verification.

Norai does not retain unnecessary device data such as exact location, contacts, microphone recordings, photo library content, or unrelated device files.

Firebase and Notification Token Deletion

When a user logs out of Norai, Norai may remove or invalidate the related Firebase Cloud Messaging token or Apple Push Notification service token where possible.

This helps prevent notifications from being sent to a device that is no longer linked to the account.

If the app is reinstalled, Norai may create or update the device record and rotate the notification token instead of relying on an old token.

Notification Consent and Audit Records

Norai may retain limited notification-related records to support consent management, delivery reliability, account security, troubleshooting, and compliance review.

These records may include notification consent status, notification category preferences, notification event records, approved template ID, recipient type, send status, provider response status, suppression reason where a notification is blocked, and related device or token status.

Norai does not retain full sensitive personal data, login tokens, QR login tokens, payment details, or full child learning records inside notification payloads.

Billing and financial records

Billing and financial records may be retained for longer periods where required by applicable tax, financial, or legal obligations.

Deleting an account does not automatically cancel active subscriptions or trigger refunds. Parents and adult learners should cancel subscriptions separately through the App Store, Google Play, or the Norai account dashboard before requesting account deletion where applicable. Refund eligibility is set out in the Refund Policy.

Your rights

Depending on your jurisdiction, you may have the right to:

  • Access personal data we hold about you
  • Request correction of inaccurate data
  • Request deletion of your data
  • Restrict or object to certain processing
  • Request a portable copy of your data To exercise these rights, contact privacy@norai.app.

How to request deletion

You can request account or learner data deletion by:

  • Using the account deletion option inside the Norai application
  • Emailing privacy@norai.app from the account email address on file
  • Contacting general support at support@norai.app Please include the account email address and, where relevant, the learner profile the request relates to so we can locate the correct records.

Security during retention and deletion

Norai uses secure transmission methods and industry standard safeguards to protect user data during retention and through the deletion process. Learning activity and synchronization events are protected during transmission and storage. We regularly review our systems and infrastructure to reduce the risk of unauthorized access, disclosure, or misuse.

Contact

For data retention or deletion related questions:

privacy@norai.app

General support inquiries:

support@norai.app

Norai is operated by Karsaaz EBS Ltd, registered in the United Kingdom. Karsaaz operates through multiple legal entities across the United Arab Emirates, United Kingdom, and Pakistan. Communications sent to these addresses are centrally received and internally routed to the appropriate entity responsible for the relevant matter, in accordance with applicable laws.