01Who is responsible for your data
Asly AI L.L.C-FZ, a free zone limited liability company registered in the Meydan Free Zone, Dubai, is the controller of the personal data described in this policy.
| Detail | Value |
|---|---|
| Controller | Asly AI L.L.C-FZ |
| Licence number | 2651043.01 |
| Registered address | Meydan Grandstand, 6th floor, Meydan Road, Nad Al Sheba, Dubai, United Arab Emirates |
| Privacy contact | contact@asly.ai |
This policy explains what we collect, why, who we share it with and what you can ask us to do about it. It is written to meet Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data and its implementing decisions.
02Controller or processor — which one we are
This distinction matters, because our customers are law firms and businesses who put other people’s information into our platform.
- We are the controller for data about you as our customer or website visitor: your account details, billing records, support messages and how you use the platform.
- We are a processor for the content you upload — your clients’ files, Emirates ID copies, trade licences, financial records, case data. You remain the controller of that content. We process it only on your instructions, to run the Services for you.
If you are an individual whose data was uploaded by one of our customers, contact that customer first. They decide what happens to it. We will support them in responding to you.
03What we collect
| Category | Examples |
|---|---|
| Account data | Name, work email, phone number, job title, company name, trade licence details, password (stored hashed) |
| Billing data | Billing name and address, TRN, invoices, transaction history, the last four digits and expiry of your card |
| Customer content | Documents and records you upload — agreements, powers of attorney, identity documents, financial statements, client and matter data |
| Usage data | Log-in times, IP address, device and browser type, pages and features used, error reports |
| Communications | Support emails, calls, demo requests, contact form submissions |
| Cookies | Session and preference cookies, and analytics identifiers — see clause 10 |
We never receive or store your full card number, CVV or PIN. Card data is captured and tokenised directly by our payment provider, Innovate Technologies FZCO (Telr), in a PCI DSS certified environment. We only see a token, the card brand, the last four digits and the expiry date.
04Why we use it, and on what basis
| Purpose | Lawful basis |
|---|---|
| Creating and running your account and providing the Services | Performance of our contract with you |
| Taking payment, invoicing and collecting unpaid fees | Performance of contract; our legitimate interest in being paid |
| Support, service notices and security alerts | Performance of contract |
| Keeping the platform secure, preventing fraud and abuse | Our legitimate interest in protecting the Services and our users |
| Improving features, fixing defects, measuring performance | Our legitimate interest, using aggregated or de-identified data wherever possible |
| Tax, accounting and regulatory record keeping | Compliance with a legal obligation |
| Marketing emails about our products | Your consent, withdrawable at any time |
| Establishing, exercising or defending a legal claim | Our legitimate interest; compliance with legal obligation |
We do not sell personal data, and we do not share it with third parties for their own marketing.
05Automated processing and AI
The Services use automated processing: optical character recognition to read uploaded documents, extraction of fields such as names, licence numbers and figures, and AI-assisted drafting and summarisation.
This processing supports a human decision. It does not produce a decision with legal effect about any individual on its own, and we do not use it for profiling or automated decision-making about you.
We do not use customer content to train publicly available AI models. Where we use a third-party AI provider to run a feature, we do so under contractual terms that prohibit the provider from using your content to train its models.
You may object to automated processing that affects you — see clause 9.
07Where your data is held
We host the platform with reputable cloud providers and prefer data centres in the United Arab Emirates where a suitable region is available. Some of our service providers process data outside the UAE.
Where personal data leaves the UAE, we transfer it only to a country the UAE recognises as providing an adequate level of protection, or under contractual safeguards that meet the requirements of Federal Decree-Law No. 45 of 2021, or with your explicit consent. You can ask us at any time for the current list of processors and the countries involved.
08How long we keep it
| Data | Retention |
|---|---|
| Account data | For as long as the account is active, then 12 months |
| Customer content | For the term of your engagement, then 30 days for export, then deleted or irreversibly anonymised |
| Invoices, tax and accounting records | At least 7 years, as required by UAE tax legislation |
| Security and access logs | Up to 12 months |
| Marketing consent records | Until you withdraw consent, plus a record of the withdrawal |
We may keep data longer where we are required to by law, or where it is needed for a legal claim that is live at the time.
09How we protect it
- Encryption of data in transit (TLS) and at rest.
- Role-based access control, with staff access limited to what their job requires, and logged.
- Multi-factor authentication available on customer accounts and required for our administrative access.
- Logical separation of each customer’s data.
- Regular backups, patching and dependency monitoring.
- Confidentiality obligations in every staff and contractor agreement.
No system is perfectly secure. If a breach occurs that is likely to prejudice your privacy or confidentiality, we will notify the UAE Data Office and, where required, affected individuals, without undue delay.
10Your rights
Under Federal Decree-Law No. 45 of 2021 you may ask us to:
- give you access to the personal data we hold about you, and information about how it is processed;
- correct data that is inaccurate or incomplete;
- delete your personal data, unless we must keep it by law or for a legal claim;
- restrict or stop a particular processing activity;
- transfer your data to you or another controller in a structured, machine-readable format;
- object to processing based on our legitimate interests, or to automated processing;
- withdraw consent, at any time, where processing is based on consent. Withdrawal does not affect processing already carried out.
Send requests to contact@asly.ai. We will verify your identity and respond within 30 days. We do not charge for this, unless a request is manifestly excessive or repetitive.
If you are not satisfied with our response, you may complain to the UAE Data Office.
12Children
The Services are for businesses and are not directed at anyone under 18. We do not knowingly collect personal data from children. If you believe a child’s data has reached us, contact contact@asly.ai and we will delete it.
13Changes to this policy
We may update this policy. The version in force is published on this page with its version number and effective date. Where a change materially affects how we handle your personal data, we will notify you by email or in the platform before it takes effect.
14Contact us
For any privacy question or request:
Asly AI L.L.C-FZ
Meydan Grandstand, 6th floor, Meydan Road, Nad Al Sheba, Dubai, United Arab Emirates
Email contact@asly.ai
Published by Asly AI L.L.C-FZ, Meydan Free Zone, Dubai, United Arab Emirates. Licence No. 2651043.01.