What Rasid collects, why, and what this processing does not prevent. Written to be read by the people it concerns, not only by lawyers.
Last updated: 21 September 2026
Rasid is an early-warning service on incitement against migrants, refugees and UN agencies in Libya. It is operated by Rakeeza, a Libyan company, and is intended for UN agencies and humanitarian organisations working on protection.
The purpose is the early measurement of a public phenomenon so that protection actors can act before harm occurs. The purpose is not the surveillance of individuals.
Public posts and comments from public pages and groups on Facebook, and from Telegram, TikTok and X. We collect the text, the time, the public source it appeared in, and its link.
We never join a private group, never send a friend request, and never contact anyone. Material that is not already visible to any reader is not collected at all.
The author’s identity is converted to a keyed hash at the moment of capture, before the record is written. We store no name, no account identifier and no profile field.
Hashing the author protects the database: anyone who obtains a copy of it cannot tell who wrote what. It does not make an author unfindable. The text of an item is shown to subscribers, a distinctive sentence from it can be searched for, and the original post carries its author’s name.
We say this because it is true and because claiming otherwise would mislead. What we do about it: subscribers see only a short lead, opening the full text takes a deliberate click and is recorded against the reader’s name, subscribers are never given the link to the post, there is no facility to search by author or to list an author’s posts, and access is restricted to the contracting organisation.
Processing is carried out on the mandate of the contracting organisation and for the protection purpose set out in that mandate. Rakeeza acts as a processor on that organisation’s documented instruction and does not act on the data on its own account.
Consent is neither available nor appropriate: seeking the consent of a person publishing incitement would defeat the purpose and would alert them.
Item text and author hashes are deleted twenty-four months after capture. Two things remain after that: aggregate statistics, which point to no individual, and the small sample reviewed by a human adjudicator, because it is the basis on which the accuracy of the classification is measured.
Contracted subscribers only, scoped to their organisation. We do not sell or license the data to anyone. It is never given or sold to any Libyan state security body — a written contractual commitment, not merely a policy.
A limited set of providers is used to run the service (EU hosting, text classification, encrypted backup storage, email delivery). They are listed in full in the data protection pack available to contracting organisations.
If you are the author of a collected item, you can write to us to object to the processing or to ask that specific material be deleted. We can delete a specific item by its link, and delete everything collected from a named public source.
What we cannot do: we cannot find everything written by a named person, because we do not store who wrote what. That limitation follows from the same hashing that protects you, and it is stated here so it is not discovered in the middle of a request.
To object, request deletion, or ask anything: privacy@rasid.net.ly. We reply within thirty days.
On a server inside the European Union (Germany). Traffic is encrypted and no database port is exposed publicly. An encrypted backup copy is held by a storage provider in the United States, under a key that provider never receives.
One step leaves the European Union: the text of an item (and of the post it replies to, if any), without the author hash, source name or link, is sent to the automated classification provider in the United States for the duration of the request, and a label comes back. It is not used to train that provider’s models.