Privacy Policy
Last updated: 15 September 2026
Your privacy matters.
Rahma Security is built to help protect people in their everyday digital lives.
That protection may involve analysing calls, messages, emails, links, files and device security information. We understand that some of this information can be personal or sensitive.
Our approach is simple:
Collect what is necessary.
Use it for clear purposes.
Protect it properly.
Keep it only as long as necessary.
Give you control.
This Privacy Policy explains how Rahma Security collects, uses, stores and protects personal data.
It applies to the Rahma Security website, application and related services.
Who is responsible for your data?
Rahma Security is developed and operated by Rahma Growth Solutions.
For data protection purposes, the organisation responsible for determining how and why personal data is processed is referred to as “Rahma Security”, “we”, “us” or “our” in this Privacy Policy.
Legal entity: Rahma Growth Solutions
Trading name: Rahma Growth Solutions / Rahma Security
Registered address: BP 95, 3083 Sfax, Tunisia
Privacy email: niina@rahmagrowthsolutions.com
Website: https://www.rahmagrowthsolutions.com and www.security.rahmagrowthsolutions.com
If we are required to appoint a Data Protection Officer, the relevant contact details will be provided here.
Our privacy principles
SPrivacy is not something we want to add after building the product.
It is part of how Rahma Security is designed.
Data minimisation
We aim to collect and process only the information reasonably necessary for the security service being provided.
Purpose limitation
Information collected for security should be used for security and other clearly defined lawful purposes — not for unrelated activities.
Privacy by design
We consider privacy and security during product design, development and operation.
User control
Where applicable, we provide ways for you to access, correct, delete, restrict or object to the processing of your personal data.
Transparency
We want you to understand what information is being processed and why.
What information may Rahma Security process?
The information we process depends on the features you use.
We may process the following categories of information.
Account information
This may include:
- Name
- Email address
- Account type
- Account settings
- Authentication information
- Subscription information
- Account security information
We do not ask you to provide personal information that is unnecessary for the service.
Device information
Rahma Security may process information about devices connected to your account or protected by the application.
This may include:
- Device type
- Device name
- Operating system
- Application version
- Security status
- Trusted-device status
- Administrator-device status
- Backup-administrator status
- Device approval information
- Relevant security events
- Technical diagnostic information
This information is used to provide and maintain security features, not to create unnecessary personal profiles.
Caller and call security
If you use caller-security functionality, Rahma Security may process information associated with calls for security analysis.
Depending on the information available, this may include:
- Telephone number
- Caller or organisation information
- Country or numbering information
- Carrier information
- Numbering area information where relevant
- Organisation or industry information
- Security indicators
- Risk score
- Risk classification
- Analysis result
- Recommendation
The purpose is to help you understand potential risk associated with a call.
A Rahma Security risk assessment does not mean that a person or organisation has committed fraud or any other offence.
Risk assessments are based on the information and security indicators available to the service at the time.
Messages and SMS
If you enable message-security functionality and provide the required permissions, Rahma Security may process information contained in relevant messages.
This may include:
- Message content necessary for security analysis
- Sender information
- Telephone number
- Links contained in messages
- Security indicators
- Risk assessment
- Security score
- Recommendation
The purpose of this processing is to help identify potential scams, phishing attempts, suspicious links, impersonation and other security risks.
We do not use private message content for advertising.
Where a security function can be performed locally on your device, we seek to use local processing where technically and securely appropriate.
Email security
If you connect an email account to Rahma Security, the application may access information necessary to provide the email-security features you have selected.
This may include:
- Sender address
- Recipient information where necessary
- Subject
- Email body
- Reply-to information
- Message identifiers
- Links
- Domains
- Attachments or attachment information
- Security indicators
- Risk score
- Analysis results
- Recommendations
- Relevant timestamps
Email information may be analysed for indicators associated with:
- Phishing
- Impersonation
- Fraud
- Suspicious links
- Credential requests
- Payment requests
- Social engineering
- Malicious or unexpected attachments
- Downloads or installation requests
- Remote-access requests
Connected accounts
When you connect an email account, Rahma Security uses the permissions you authorise for the selected functionality.
You may disconnect a supported account through the relevant account controls.
Disconnecting an account stops future access through that connection, but does not automatically mean that information already lawfully retained by Rahma Security has been deleted.
You may request deletion where applicable.
Automatic email protection
If you enable automatic email protection, supported connected accounts may be periodically checked for new messages.
Relevant messages may then be analysed automatically for security purposes.
You can disable automatic protection through the relevant settings where that functionality is available.
Links
Rahma Security may analyse links submitted to or encountered by supported security features.
Analysis may consider information such as:
- Domain
- URL structure
- Suspicious-domain indicators
- Potential impersonation
- Destination information
- Other technical security indicators
The purpose is to help determine whether a link may present a security risk.
No security service can guarantee detection of every malicious or fraudulent website.
Files and attachments
Where file and attachment analysis is available, Rahma Security may process information necessary to assess potential security risks.
This may include:
- File name
- File type
- File metadata
- Security characteristics
- Relevant content required for analysis
- Analysis result
- Risk score
- Recommendation
We aim to minimise the information processed and retain it only for as long as necessary.
Security analysis and scoring
Rahma Security may generate:
- Risk scores
- Security classifications
- Explanations
- Warnings
- Recommendations
- Security events
These may be based on information from the relevant security feature.
A security score is an automated security assessment intended to support a security decision.
It is not a determination that an individual is dishonest, criminal, fraudulent or otherwise unsafe.
Rahma Security does not intend to use security scores to make decisions about employment, credit, insurance, healthcare, education or other similarly significant matters.
Artificial intelligence and automated analysis
Some Rahma Security features may use automated analysis or artificial intelligence.
Where AI is used, it may assist with:
- Security classification
- Pattern analysis
- Risk assessment
- Explanation
- Recommendations
AI-assisted results may not always be correct.
Rahma Security therefore presents automated analysis as security assistance, not as an infallible determination.
Where applicable law requires additional information or transparency regarding an AI system, we will provide the relevant information.
We will not knowingly use AI systems in ways prohibited by applicable law.
Why do we process personal data?
We may process personal data for the following purposes.
Providing Rahma Security
To create accounts, provide security functionality and operate the service.
Security analysis
To detect, analyse and explain potential security risks.
Notifications
To provide security alerts, warnings and recommendations.
Device and account security
To protect accounts, authenticate users and manage trusted devices.
Service reliability
To maintain, troubleshoot and improve the reliability and security of the service.
Customer support
To respond to questions, requests and technical problems.
Fraud and abuse prevention
To detect and prevent misuse, attacks, fraud and other harmful activity.
Legal compliance
To comply with legal and regulatory obligations.
Our legal bases under GDPR
Where GDPR applies, we process personal data using an appropriate legal basis under Article 6 GDPR.
Depending on the circumstances, this may include:
Contract
Processing necessary to provide the service you have requested or to perform our agreement with you.
Legal obligation
Processing necessary for us to comply with a legal obligation.
Legitimate interests
Processing necessary for legitimate interests such as maintaining security, preventing fraud, protecting our systems and improving service reliability, where those interests are not overridden by your rights and freedoms.
Consent
Where consent is required, we will ask for it.
Where processing is based on consent, you may withdraw that consent at any time.
Withdrawing consent does not affect processing that was lawful before consent was withdrawn.
Sensitive and special-category information
Rahma Security does not seek to collect special-category personal data unnecessarily.
However, communications can naturally contain information about people’s private lives, health, beliefs, relationships, finances or other sensitive matters.
For example, an email or message being analysed for security purposes could contain information that the user did not specifically provide to Rahma Security for that purpose.
We therefore seek to minimise the collection, access, processing and retention of such information.
We do not ask users to provide sensitive information simply to create a normal Rahma Security account.
Where special-category data is processed and GDPR requires an additional legal condition under Article 9, we will identify and apply the appropriate condition.
Do we sell your personal information?
No.
Rahma Security is not built around selling personal information.
We do not intend to sell private communications or security information for advertising purposes.
Security information should serve the security purpose for which it was provided.
Data minimisation and local processing
Where technically and securely appropriate, Rahma Security may perform processing locally on your device.
Local processing can reduce the amount of information that needs to leave your device.
However, not every feature can necessarily operate entirely locally.
Where information needs to be processed by Rahma Security systems or authorised service providers, we aim to limit the information to what is necessary for that function.
Who may process your information?
Rahma Security may use carefully selected service providers to operate parts of the service.
These may include providers supporting:
- Cloud infrastructure
- Authentication
- Database services
- Email connectivity
- Security infrastructure
- Notifications
- Payment processing
- Application distribution
- Customer support
- Technical monitoring
Where a provider processes personal data on our behalf, we seek to ensure that an appropriate contractual relationship and data-processing safeguards are in place.
A list of relevant subprocessors may be made available here:
Firebase, DreamHost, Gmail / Microsoft / Yahoo / iCloud
International data transfers
Some service providers may operate outside the European Economic Area.
Where personal data is transferred outside the EEA and GDPR requires safeguards, we will use an appropriate lawful transfer mechanism.
This may include:
- An EU adequacy decision
- Standard Contractual Clauses
- Appropriate supplementary safeguards
- Another lawful mechanism recognised by applicable law
We will not knowingly transfer personal data internationally without an appropriate lawful basis.
How long do we keep your information?
We do not keep personal data indefinitely.
Retention depends on:
- The type of information
- Why it was collected
- The feature being used
- Whether you continue to use that feature
- Security requirements
- Legal obligations
- Accounting requirements
- Dispute resolution
- Legal claims
Where possible, we will define specific retention periods.
Where a precise period cannot reasonably be determined in advance, we use appropriate criteria to decide when information should be deleted or anonymised.
We aim to avoid retaining underlying communication content longer than necessary.
Deleting your information
Where applicable, you can request deletion of your personal data.
Rahma Security may also provide deletion controls within the application.
When an account is deleted, we will seek to delete or anonymise associated personal information unless we have a lawful reason to retain it.
Information may need to be retained where necessary for:
- Legal obligations
- Fraud prevention
- Security
- Accounting
- Dispute resolution
- Establishing, exercising or defending legal claims
Where information must be retained, we will restrict its use to the relevant lawful purpose.
Your rights under GDPR
Where GDPR applies, you may have the following rights.
Right of access
You may request access to personal data we hold about you.
Right to rectification
You may ask us to correct inaccurate or incomplete information.
Right to erasure
You may request deletion of your personal data where the legal requirements are met.
Right to restriction
You may request restriction of processing in certain circumstances.
Right to data portability
Where applicable, you may request your personal data in a structured, commonly used and machine-readable format.
Right to object
You may object to certain processing, including processing based on legitimate interests.
Right to withdraw consent
Where processing is based on consent, you may withdraw that consent.
Rights relating to automated decision-making
Where applicable, you may have rights concerning decisions based solely on automated processing that produce legal or similarly significant effects.
How to exercise your rights
To make a privacy request, contact:
niina@rahmagrowthsolutions.com
Please provide enough information for us to identify your account and understand your request.
We may need to verify your identity before fulfilling certain requests.
This protects your information from being disclosed to someone who is not authorised to receive it.
We will respond within the timeframe required by applicable data-protection law.
Children’s privacy
Some Rahma Security services may be designed for families.
Where children use Rahma Security App, the applicable account structure, permissions and consent requirements may depend on the child’s age, country and the service being used.
We aim to process children’s information only where necessary for the relevant service and in accordance with applicable law.
Where parental or guardian authorisation is required, appropriate measures will be used.
Parents or legal guardians may contact us regarding a child’s personal data.
Family accounts
Family accounts may allow an authorised family administrator to receive certain security information concerning connected family members or devices.
The purpose of this functionality is security and account management.
Family administrators must use this access responsibly and lawfully.
Rahma Security is not designed to provide unrestricted access to another person’s private communications merely because they belong to the same family account.
The information available to an administrator depends on the specific feature, permissions and account configuration.
Business and organisation accounts
When Rahma Security App is used by an organisation, the organisation may be the data controller for certain processing activities, while Rahma Security may act as a data processor.
The exact roles depend on the service and processing involved.
Where Rahma Security acts as a processor, we process personal data according to the organisation’s lawful instructions and the applicable data-processing agreement.
Where Rahma Security determines the purposes and means of particular processing, we may act as the controller for that processing.
Business customers may therefore receive additional privacy and data-processing documentation.
Administrator access
Business and organisational accounts may allow authorised administrators to receive security events, risk information and device information.
Administrators are responsible for ensuring that their use of this information is lawful and appropriate.
Rahma Security does not authorise administrators to use security information for:
- Unlawful surveillance
- Harassment
- Discrimination
- Unrelated profiling
- Other unlawful purposes
Organisations remain responsible for ensuring that their use of Rahma Security complies with applicable employment, privacy and data-protection requirements.
Cookies
Our website may use cookies and similar technologies.
These may include:
- Strictly necessary cookies
- Security cookies
- Preference cookies
- Analytics cookies
- Marketing cookies, where applicable
Where consent is required, we will request consent before placing non-essential cookies.
You may be provided with controls to manage your cookie preferences.
Further information will be provided in our Cookie Policy.
Security
We use appropriate technical and organisational measures designed to protect personal data.
These may include:
- Access controls
- Authentication
- Encryption where appropriate
- Secure communications
- Least-privilege access
- Logging and monitoring
- Secure development practices
- Vulnerability management
- Security testing
- Backup and recovery procedures
- Incident-response procedures
No internet-connected system can guarantee absolute security.
However, security is fundamental to Rahma Security and is considered throughout the design and operation of the service.
Personal-data breaches
If we become aware of a personal-data breach, we will assess and investigate the incident and take appropriate measures to contain, remediate and prevent recurrence.
Where GDPR requires notification to a supervisory authority, we will notify the relevant authority within the applicable legal timeframe.
Where the breach is likely to result in a high risk to individuals’ rights and freedoms, we will notify affected individuals where required.
Security vulnerabilities
Rahma Security App is a security product, so responsible vulnerability reporting is important to us.
If you believe you have discovered a security vulnerability, please contact:
niina@rahmagrowthsolutions.com
Please provide enough information for us to understand and investigate the issue.
We ask that suspected vulnerabilities are reported responsibly and that you avoid publicly disclosing exploitable details before we have had a reasonable opportunity to investigate.
We intend to maintain our vulnerability-management and security-incident processes in line with applicable legal and regulatory requirements.
EU cybersecurity requirements
Rahma Security takes applicable European cybersecurity requirements seriously.
Where relevant to our products and services, we will consider requirements arising under EU cybersecurity legislation, including the Cyber Resilience Act.
The Cyber Resilience Act introduces cybersecurity requirements for products with digital elements, including vulnerability-management and reporting obligations. Certain reporting obligations begin applying from 11 September 2026, while the principal requirements apply from 11 December 2027.
Our compliance programme will be developed in accordance with the requirements applicable to Rahma Security and its products.
EU artificial intelligence requirements
Where Rahma Security uses artificial intelligence, we will consider applicable requirements under the EU Artificial Intelligence Act.
We will seek to:
- Identify AI systems used by the service
- Assess their applicable legal classification
- Provide required transparency
- Maintain appropriate documentation
- Apply appropriate human oversight where required
- Manage relevant risks
- Avoid prohibited AI practices
Not every automated security feature is necessarily an AI system under the AI Act, and the obligations depend on the technology and use case.
Changes to this Privacy Policy
We may update this Privacy Policy when:
- Our services change
- New features are introduced
- Our data-processing activities change
- Legal requirements change
- Security practices improve
The latest version will always be published on this page with its update date.
Where changes are materially important and the law requires additional notice, we will provide that notice.
Contact us
If you have questions about privacy, data protection or how Rahma Security handles personal information, please contact us.
Rahma Security
Rahma Growth Solutions
Legal entity: [INSERT LEGAL ENTITY]
Address: [INSERT ADDRESS]
Privacy: [INSERT PRIVACY EMAIL]
Security: [INSERT SECURITY EMAIL]
General enquiries: [INSERT GENERAL EMAIL]
Our Privacy Commitment
Rahma Security exists to help people feel safer in a digital world.
We believe that protecting people should not require unnecessary access to their personal information.
Security and privacy should work together.
Our commitment is simple:
Collect less.
Explain clearly.
Protect properly.
Give people control.
Delete what is no longer needed.
Rahma Security — security around everyday digital decisions.