Privacy Policy

What we collect, why we have it, and what you can make us do about it. Written to be understood rather than to be defensible.

Last updated 10 August 2026 Written against Federal Decree-Law No. 45 of 2021 (UAE PDPL)
The short version. We collect what we need to reply to you and to run your store, and nothing else. We do not sell your data, we do not rent it, and we do not use your shoppers’ details for our own marketing. If you want your data out, or gone, ask and we will do it.

1. Who this covers

This policy covers personal data we handle as the controller — that is, data about you: visitors to this website, people who send us an enquiry, and merchants who subscribe.

It does not cover data about your shoppers that sits inside your store. For that data you are the controller and we are the processor, acting on your instructions. Section 3 explains the difference and why it matters.

2. What we collect, and why

Three things, and only three:

  • What you send us in a form. Your name, an email address or a phone number, and whatever you write in the message. Optionally your business name, what you sell and which plan interests you. We use this to reply to you, and to prepare a store if you asked for one. Nothing on our forms is required beyond a name and one way to reach you.
  • Account and billing data, if you subscribe. Your business name, address, Tax Registration Number where you give one, contact details and invoice history. We need this to provide the service and to issue a valid tax invoice.
  • Technical data that any web server records: IP address, browser and the pages requested. We use it to keep the site working and to spot abuse.

We do not ask for, and do not want, special categories of personal data — health, biometrics, religious or political information. Please do not put any of it in a form.

3. Your shoppers’ data is yours, not ours

Your customers’ names, addresses, orders and payment references live in your store because your business put them there. We hold them on your behalf so the store can function. We do not use them for our own purposes, we do not market to your customers, and we do not sell or share that data with anyone.

This is not only our policy. Federal Decree-Law No. 14 of 2023 on trading by modern technological means requires sellers to protect the privacy of consumer data and not to use it for promotional purposes without a proper basis, and it applies the UAE’s data protection legislation to how that information is used, classified and owned.

If a shopper of yours asks us to delete their data, we will refer them to you, because the decision is yours to make as controller — and then act on your instruction.

Under the PDPL, processing needs a lawful basis. Ours are:

  • Your consent — when you fill in a form asking us to get in touch. You can withdraw it at any time, and we will stop.
  • Performance of a contract — when you subscribe, we need your data to actually provide the service and to bill you for it.
  • Legal obligation — invoices and tax records have to be kept, whatever anyone would prefer.
  • Legitimate interest — keeping the platform secure, preventing fraud and abuse, and defending a legal claim.

5. Analytics and cookies

This marketing site uses Google Analytics to count visits and see which pages are read. It sets cookies in your browser and sends usage data to Google. We use it to decide what to write next — not to build a profile of you, and not for advertising.

You can block it: browsers can refuse cookies, and Google publishes an opt-out add-on. Blocking it does not affect anything on this site.

We also set a session cookie so forms work and to protect against cross-site request forgery. That one is necessary; without it a form submission cannot be verified.

6. Who else sees it

We do not sell personal data. We share it only with service providers who help us run the business, and only as far as they need it:

  • Hosting and infrastructure providers, who store the data.
  • Payment providers, who process a subscription payment. Card details go to them directly — we never see or store a full card number.
  • Analytics, as described above.
  • Messaging providers, where you have chosen to be contacted by WhatsApp or email.

We will also disclose data where a UAE court, regulator or law requires it. If that happens and we are permitted to tell you, we will.

7. Where it is stored, and transfers

Your data may be stored and processed outside the United Arab Emirates, including by our hosting and analytics providers. The PDPL permits transfers where the receiving jurisdiction offers adequate protection or where appropriate contractual safeguards are in place, and we rely on those safeguards with our providers.

If you need your store’s data to remain in a particular jurisdiction, tell us before you subscribe rather than after — it is a question we can answer honestly, and it is easier to arrange at the start.

8. How long we keep it

  • Enquiries that go nowhere: deleted after 24 months.
  • Store data after cancellation: kept for 60 days so you can export it or change your mind, then deleted.
  • Invoices and tax records: kept for as long as UAE tax law requires us to keep them.
  • Server logs: a short rolling window, then overwritten.

9. How it is protected

Traffic is encrypted in transit. Access to production data is limited to the people who need it to do their job. Backups are taken and stored separately. Card numbers never reach our systems.

No system is perfectly secure, and anyone who tells you otherwise is selling something. If a breach occurs that is likely to affect you, we will notify you and the UAE Data Office as the PDPL requires, without undue delay.

10. Your rights under the PDPL

You can ask us to:

  • Show you what personal data of yours we hold, and where it came from.
  • Correct anything that is wrong or out of date.
  • Delete it, unless we are required to keep it.
  • Give you a copy in a portable, machine-readable format.
  • Stop or limit a particular use, including withdrawing consent to be contacted.
  • Object to processing based on our legitimate interest.

Ask by writing to the address in section 13. We do not charge for this and we aim to answer within 30 days. If you think we have got it wrong, you can complain to the UAE Data Office.

11. Children

This is a service for businesses. It is not directed at children and we do not knowingly collect data about them. If you believe a child’s data has reached us, tell us and we will delete it.

12. Changes to this policy

The UAE’s data protection framework is still settling — the PDPL’s executive regulations have been slower to arrive than expected, and organisations processing UAE residents’ data are working towards full compliance. We will update this policy as that develops. The date at the top always tells you which version you are reading, and we will tell subscribers by email before any change that materially affects them.

13. How to reach us about data

The controller is Ujjwal Technolabs Private Limited, C Block, SP Villa, 403-B, Indore, Madhya Pradesh 452016, India.

Email [email protected] with “Data request” in the subject, or write through the contact page. A person handles these; there is no form to fight with.

Last updated 10 August 2026. Related: Terms of Service · Refund Policy.