Legal

Privacy Policy

Effective date: [OPERATOR TO COMPLETE: effective date of these terms]

Draft — not reviewed by a lawyer

Retention periods and the final sub-processor list must be completed before paid subscriptions go live.

1. Data controller

The service is operated by [OPERATOR TO COMPLETE: legal name of operator (individual / sole proprietor)], resident in [OPERATOR TO COMPLETE: UAE emirate of residence], United Arab Emirates. Privacy requests: [OPERATOR TO COMPLETE: support email address - not yet provisioned].

2. What we receive and store

Invoice payloads

We receive the JSON or XML document you submit to run validation and return findings. It may include names, TRNs, addresses, line items and amounts.

  • We do not sell payloads or use them to train models.
  • We do not transmit them to tax authorities or accredited providers.
  • Retention: [OPERATOR TO COMPLETE: retention period for submitted invoice payloads].

Accounts, keys and usage

  • We store your account email.
  • We store hashes of API keys, not full keys in plain text.
  • We store usage events needed to enforce plan limits.
  • Retention: [OPERATOR TO COMPLETE: retention period for request logs and metering events].

Rate limiting

Short-lived Redis counters enforce limits and are not used for advertising or profiling.

PayPal billing

PayPal collects and processes payment credentials under its own privacy terms. We do not store your full card number, CVC or bank login. We store the PayPal subscription ID, payer ID, plan ID, payment status and billing dates needed to control paid access.

3. Why we process data

  • Contract: validation, accounts and plan enforcement.
  • Legitimate interest: security, abuse prevention and reliability.
  • Consent: optional service emails.

4. Sub-processors

Providers may include Railway, MongoDB and Redis hosts, a transactional email provider and PayPal. Final list: [OPERATOR TO COMPLETE: named sub-processor list].

5. Data location

Infrastructure may be outside the UAE. Regions: [OPERATOR TO COMPLETE: hosting regions].

6. Your rights

Request access, correction or deletion at [OPERATOR TO COMPLETE: support email address - not yet provisioned]. Response target: [OPERATOR TO COMPLETE: support response-time commitment].

7. Security

Traffic is served over TLS and API keys are hashed. No SOC 2, ISO 27001 or independent security certification is claimed.

8. Children

This business developer tool is not directed at children.

9. Changes

Material changes will be published and communicated where practical.

10. Contact

See the contact page.