Privacy Policy

1.Who we are

ALAbrish Technologies FZCO ("ALAbrish", "we", "us") operates the ALAbrish omnichannel messaging platform and the website at alabrishtechnologies.ae. Our registered office is Building A1, Dubai Digital Park, Dubai Silicon Oasis, Dubai, United Arab Emirates.

This policy explains what personal data we handle, why we handle it, who we share it with and the choices available to you. It covers both the people who visit our website and the end customers whose conversations flow through our platform on behalf of our business customers.

2.Controller and processor roles

Our role depends on whose data is involved, and this distinction matters because it determines who you should contact about your data.

For visitors to our website, prospects and account holders, we act as the data controller and decide how that data is used. For the end customers of a business that uses ALAbrish, we act as a data processor: our customer is the controller, decides the purposes of processing, and is responsible for the lawful basis of the messages sent. If you are an end customer wanting your data corrected or erased, contact the business you were messaging; we will support them in responding.

3.Data we collect

• Account data: name, business email, phone number, company name, role and billing details supplied when you register or request a demo.
• Conversation data: message content, attachments, timestamps, delivery and read receipts, and the channel identifier (such as a WhatsApp phone number or Instagram handle) for conversations processed on behalf of our customers.
• Contact records: customer lists, segments, tags, opt-in status and opt-out history uploaded or built by our customers inside the platform.
• Usage data: pages viewed, features used, approximate location derived from IP address, browser and device type, and diagnostic logs.
• Support data: correspondence with our team, including messages sent to the ALA bot assistant on our website.
• Payment data: processed by our payment provider. We receive confirmation and the last four digits of the instrument; we never store full card numbers.

4.Why we process it

• To provide the platform: routing, delivering and storing messages across connected channels, and keeping conversation history available to the right agents.
• To operate accounts: authentication, billing, support and service notifications.
• To improve the service: aggregated analytics, debugging, performance monitoring and abuse prevention.
• To power AI features: generating suggested replies, summaries and chatbot answers. We do not use our customers' conversation content to train third-party foundation models.
• To comply with law: tax, accounting, regulatory and lawful-request obligations.
• To market responsibly: sending product and company updates to business contacts who have opted in, with an unsubscribe link in every message.

5.Legal bases

Where the UAE Personal Data Protection Law, the EU and UK GDPR, or comparable legislation applies, we rely on: performance of a contract, to deliver the service you have signed up for; legitimate interests, to secure, support and improve the platform; consent, for optional marketing and non-essential cookies, which you may withdraw at any time; and legal obligation, where retention or disclosure is required of us.

6.Messaging channels and consent

ALAbrish connects through the official WhatsApp Business, Meta, Telegram and TikTok APIs, and processing on those channels is additionally governed by each provider's own terms and policies.

Our customers are responsible for obtaining valid opt-in before messaging an end customer, for honouring opt-out requests promptly, and for respecting channel-specific rules on template approval, messaging windows and frequency. The platform provides opt-in capture, opt-out handling and frequency controls to support this, but it cannot create consent that was never given.

7.Sharing your data

We do not sell personal data, and we do not share it for third-party advertising.

• Channel providers: Meta Platforms, Telegram and TikTok, strictly to deliver and receive the messages you send.
• Infrastructure providers: cloud hosting, database, storage and content delivery vendors engaged under written data-protection terms.
• AI providers: the model provider powering assistant features, processing only the content needed to produce a response.
• Payment and finance providers: to take payment and meet accounting duties.
• Professional advisers and authorities: where required by law, regulation or valid legal process, or to establish or defend legal claims.
• Acquirers: if we are involved in a merger, acquisition or asset sale, under equivalent protection and with notice to affected customers.

8.International transfers

We are based in the United Arab Emirates and use infrastructure and channel providers that may process data in other countries, including within the European Economic Area and the United States. Where data leaves its country of origin we rely on an adequacy decision, standard contractual clauses, or another lawful transfer mechanism, together with technical measures such as encryption in transit and at rest.

9.Retention

We keep account and billing records for as long as the account is active and afterwards for the period required by UAE tax and company law. Conversation and contact data processed for a customer is retained for the term of their subscription and deleted or returned within 90 days of termination, unless a longer period is agreed in writing or required by law. Diagnostic logs are kept for a rolling period of up to 12 months. Backups are purged on their own cycle, which may extend deletion by a short, bounded interval.

10.Security

We encrypt data in transit with TLS and at rest using industry-standard encryption, enforce role-based access with audit trails, restrict administrative access to staff who need it, and monitor our infrastructure continuously. No system can be guaranteed perfectly secure, but we will notify affected customers and the relevant authority without undue delay if a breach is likely to result in a risk to people's rights.

11.Your rights

Subject to local law, you may request access to your personal data, correction of inaccurate data, erasure, restriction of or objection to processing, a portable copy, and withdrawal of consent where processing relies on it. You may also lodge a complaint with your supervisory authority.

To exercise a right, email ceo@alabrishtechnologies.com or write to us at the address below. We will verify your identity before acting and respond within 30 days. If your request concerns data we process on behalf of one of our business customers, we will forward it to them and assist with their response.

12.Cookies

We use strictly necessary cookies to run the site and keep sessions secure, and analytics cookies to understand how the site performs. Non-essential cookies are set only with your consent, which you can change at any time. Details are set out in our Cookie Policy.

13.Children

The ALAbrish platform is a business product and is not directed at children under 18. We do not knowingly collect their personal data. If you believe a child has provided us with data, contact us and we will delete it.

14.Changes to this policy

We may update this policy as the platform and the law evolve. The effective date at the top of this page always reflects the current version, and we will give account holders advance notice by email of changes that materially affect their rights.