Privacy notice

Last updated: 26 September 2026

This notice describes what arabianscript.com processes when you open the site, search, or ask a question. It is as short as the site is simple: no accounts, no forms other than the search field, no cookies, no advertising.

1. Controller

M.B. Great Cyprus Holding Ltd, Grigori Afxentiou 59A, 4529 Pyrgos, Limassol, Cyprus. E-mail: info@arabianscript.com. Telephone: +49 176 74517165. No data protection officer has been appointed; the legal conditions that would require one are not met.

2. No cookies, no tracking, nothing from third-party servers

The site sets no cookies and stores nothing in your browser. It uses no analytics, advertising or embedding services. Fonts and images are served from our own server. A consent banner is therefore not required.

3. Hosting and access log

The site runs on a server of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, located in Nuremberg. Hetzner is a processor under Article 28 GDPR.

For every request the server writes one log line containing: your IP address (not truncated), date and time, the requested address including the search term or question (both are part of the address, for example /search/texts?q=…), HTTP method and version, browser and device identification (user agent), the languages set in your browser, encryption details, status code, amount of data transferred and duration.

Purpose: secure and undisturbed operation: troubleshooting, defence against attacks and abuse, verifying the quota. Legal basis: our legitimate interest in that operation, Article 6(1)(f) GDPR.

Retention: the logs are deleted by size, not by time. At most 50 MB are kept per service; the oldest lines are overwritten once the limit is reached. At the traffic of September 2026 this corresponds to about four weeks; with more traffic it is shorter. The logs are not merged with other data and are not analysed to identify persons.

4. Hourly quota

The answer service is limited to 10 answers per hour and sender and to 30 answers per day in total. A translation of the topic (section 5) counts within this quota like an answer, also when you request it in the text search. To count this, the service keeps your IP address together with the current hour in memory. The entry is deleted when the hour changes, at the latest when the service is next restarted; it is not written to disk and not passed on. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is limiting the cost that every call of the language model causes.

5. Answer service and topic translation: transmission to the model provider in the USA

When you choose the path “answer with evidence”, the platform searches its own index. If it finds passages, it transmits the wording of your question together with those passages and the instruction to answer from them alone to the API of Anthropic, PBC, San Francisco, California, USA, which generates the answer from them. If it finds no passages, the question is not transmitted.

Translation of the topic. If you ask a question in Latin script, for example in English or German, and the platform recognises the name of an author in it, it cannot look up the topic of the question in the Arabic index. In that case it transmits only the topic words to the same API of Anthropic, PBC, where a smaller model of the same provider translates them into Arabic: the words that remain after the question words and the recognised name are removed, at most six words or 80 characters, together with a fixed translation instruction. The whole question and the recognised name are not transmitted; a word that the recognition identified neither as a question word nor as part of the name, such as an addition to the name, may, however, be among the topic words. Longer topics are not translated.

On the path “answer with evidence” this translation happens automatically, and it happens before the search for passages; the topic words have then been transmitted even if the search finds no passages afterwards and no answer is generated. In the text search it happens only when you click the button “translate the topic”; without that click nothing leaves our server, and the page tells you that the topic must be in Arabic. The translation is shown on the page as a machine translation (“searched for: …”); it is never evidence and never a quotation. It is not stored and not cached; only the token count and the cost of the call are logged, not the words. A translation counts towards the quota in section 4.

Your IP address, your browser identification and any other information about you are not transmitted: our server makes the request in its own name. The provider therefore cannot identify you unless you write something about yourself into the question or the topic words.

Legal basis: Article 6(1)(f) GDPR; our legitimate interest is generating the answer you explicitly requested, which is not possible without a language model, and making the topic of a question not asked in Arabic searchable at all. Transfer to a third country: the United States are a third country within the meaning of the GDPR. For its API the provider offers a data processing agreement incorporating the standard contractual clauses of the European Commission (Article 46(2)(c) GDPR). According to the provider, API inputs and outputs are not used to train its models and are deleted within a period it sets (currently 30 days according to the provider), unless an abuse review applies. This applies to the answer and to the translation alike.

Searching manuscript records does not leave our server. Searching texts leaves it only in the one case this section describes: for the translation of the topic words after your click.

6. Links to holding institutions

Every manuscript record links to the catalogue entry and, where one exists, to the IIIF manifest of the holding institution. Only when you click such a link does your browser contact the other server, which then learns your IP address. Our server sends no referrer, so the institution does not learn which page you came from. The privacy notice of the respective institution applies to the processing there.

7. Operations area

An operations area under /betrieb/ is password-protected and intended for the operator only. It contains no visitor data. Whoever opens it leaves their login name in the log line (section 3).

8. Backups

Backups of the database are made regularly. They contain the holdings (texts, manuscript records, resolved names) but no visitor data: search queries, IP addresses and quotas are not stored in the database.

9. Historical persons in the holdings

The index names authors, scribes and former owners of manuscripts as they appear in the public catalogues of the holding institutions. These are historical persons. Contact details and names of living persons, such as cataloguers, are not taken over; the descriptive prose of the catalogues stays outside the index. Should you nevertheless find information about a living person, please write to us; we will check and remove it.

10. Encryption

The connection is encrypted with TLS. The certificate is issued by Let’s Encrypt (Internet Security Research Group, San Francisco, USA). Issuing and renewing it transmits information about our server only, no visitor data.

11. Recipients

Hetzner Online GmbH as hosting provider (section 3) and Anthropic, PBC as model provider for the answer and the topic translation (section 5). There are no other recipients. We do not sell data and do not pass it on for advertising.

12. Your rights

You have the right of access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18) and data portability (Article 20). You may object to processing based on Article 6(1)(f) GDPR on grounds relating to your particular situation (Article 21). An informal message to the address in section 1 is enough. Please note: since we store nothing about you apart from the IP address, we usually cannot attribute log lines to a person (Article 11 GDPR).

You may lodge a complaint with a data protection supervisory authority (Article 77 GDPR). The authority competent for us is the Cypriot one: Commissioner for Personal Data Protection, Iasonos 1, 1082 Nicosia, Cyprus, dataprotection.gov.cy, e-mail commissioner@dataprotection.gov.cy. You may also contact the supervisory authority of your place of residence.

13. Changes

If what the site processes changes, this notice changes; the date at the top names the current version. This notice is available in Arabic, English and German. In case of discrepancies, the English version prevails.