Privacy Policy

1. Introduction

This Privacy Policy describes how UAE TAX AI ("we," "us," or "our") collects, uses, stores, and protects personal and business data when you use our tax preparation and compliance platform.

We are committed to compliance with UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL) and applicable data protection regulations.

2. Data We Collect

Account Information

• Name and email address
• Phone number (if provided)
• Company name and trade license number

Business Data

• Financial transactions and invoices
• Tax registration numbers (TRN)
• VAT data and corporate tax data

Usage Data

• How you interact with the Platform, features used, and pages visited

AI Interaction Data

• Conversations with Amin AI assistant for service improvement

Payment Data

• Processed securely through Stripe — we do not store full credit card numbers

Device Information

• Browser type, device type, and IP address for security purposes

3. Legal Bases for Processing

Under UAE PDPL Art. 5, we process your data on the following legal bases:

4. Data Storage and Security

• Data is hosted on Microsoft Azure cloud infrastructure
• All data is encrypted in transit (TLS 1.2+) and at rest (AES-256)
• Access to production data is restricted and monitored
• Regular security assessments and updates are performed
• Database backups are encrypted and maintained securely

5. AI Data Processing

AI features are powered by third-party providers. Data sent to AI services is used only to process your request and is not permanently stored by these providers. This may involve cross-border data transfer:

• What data is sent: Your chat messages, a summary of your business context (company type, emirate, tax registration status), and relevant financial summaries. We apply data minimization principles.
• Where it is processed: Third-party AI provider servers, which may be located outside the UAE
• Safeguards: Standard Contractual Clauses (SCCs) between UAE TAX AI and our AI service providers, as required by PDPL Art. 22
• Storage: AI service providers do not retain your data after processing. No user data is used to train their models.
• Your choice: AI processing requires your explicit consent. You can opt out at any time in Settings without losing access to other platform features.
• Legal basis: Explicit consent (PDPL Art. 5(1))

6. Data Sharing

We do not sell your personal or business data. We share data only with:

• Payment processor (Stripe) — for billing and subscription management
• AI service providers — for processing Amin AI interactions
• Cloud infrastructure provider (Microsoft Azure) — for hosting
• As required by UAE law — or valid legal process
• Integration partners (QuickBooks, Xero, etc.) — only receive data you explicitly authorize through connecting your accounts

7. Data Retention

• Account data is retained for the duration of your subscription and for a reasonable period after account closure to allow for reactivation and support any outstanding matters
• Financial and tax data is retained as required by UAE record-keeping requirements (minimum 5 years for VAT records under Article 78 of Cabinet Decision No. 36 of 2017)
• You may request deletion of your data, subject to legal retention requirements

8. Your Rights Under UAE PDPL

Under UAE Federal Decree-Law No. 45 of 2021, you have the following rights:

• Right of Access (Art. 13): Request a copy of all personal data we hold about you
• Right to Rectification (Art. 14): Correct any inaccurate personal data
• Right to Erasure (Art. 15): Request deletion of your data (subject to legal retention requirements under UAE tax law)
• Right to Data Portability (Art. 16): Export your data in a structured, machine-readable format
• Right to Restrict Processing (Art. 17): Limit how we process your data
• Right to Withdraw Consent: Withdraw consent for optional processing at any time
• Right to Lodge a Complaint: File a complaint with the UAE Data Office

9. Cookies & Consent

We use the following categories of cookies:

• Essential cookies: Required for platform functionality, authentication, and security. Cannot be disabled.
• Analytics cookies: Help us understand platform usage to improve our services. Require your explicit consent.
• Marketing cookies: Used for promotional communications. Require your explicit consent.

You can manage your cookie preferences at any time using the cookie consent banner or through your account settings. Withdrawing consent for non-essential cookies does not affect the lawfulness of processing based on consent before withdrawal.

10. Children's Privacy

Our service is not intended for individuals under the age of 18. We do not knowingly collect data from minors.

11. Cross-Border Data Transfers

Your primary data is stored on Microsoft Azure cloud infrastructure. The following transfers may occur outside the UAE:

All cross-border transfers are logged and monitored. You can view the Records of Processing Activities through your account settings or by contacting our Data Protection Officer.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or platform notification. Continued use of the Platform after such changes constitutes acceptance of the updated policy.

13. Data Protection Officer

In accordance with PDPL Art. 10, we have appointed a Data Protection Officer (DPO):