Privacy policy

1. Scope of this policy

This policy explains how engiflow processes personal data under UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data.

For project content uploaded by an office, the office is the controller and we process it on the office's behalf. For account and billing data, we are the controller.

2. The current prototype

The current site is a prototype with no accounts and no database. What you enter is not sent to our servers; it stays in your browser. We use one cookie to remember the chosen language, and no tracking or advertising tools.

3. Data we collect

• Account data: name, email, phone and role in the office.
• Office data: trading name, licence number, address, logo and document settings.
• Project content: documents, drawings, photos, BOQs, bids and correspondence the office uploads or creates.
• Usage data: sign-in records, counts of AI feature use, and technical data such as browser type and IP address for security.
• Billing data: invoices and payment status. Card details are handled directly by the payment provider; we do not store card numbers.

4. How we use data

• To provide the service and run its features for the office.
• To invoice and manage the subscription and AI allowance.
• For support, with the office owner's approval whenever it requires viewing content.
• To protect the service against unauthorised use.
• To improve the service through aggregated usage statistics that contain no project content.

5. AI processing

When an AI feature is used, only the part of the project content it needs is sent to the model provider, solely to produce the requested result. We use Anthropic's Claude models under its commercial terms, which do not allow this data to be used to train models.

We do not use office content to train any model, and we never share it with other offices.

6. Who can see the data

• The office's users, each according to the permissions the office owner sets.
• The platform team: it sees subscription, usage and settings only, and sees project content only through temporary support access approved by the office owner, which expires after 24 hours and is logged.
• The service providers we rely on, under contracts that require them to protect the data: hosting (Railway), database and storage (Supabase), AI (Anthropic), the payment provider and the email provider.
• Public authorities, when the law requires it.

We do not sell personal data or share it for advertising.

7. Where data is kept

Data may be stored or processed on servers outside the UAE by the providers listed above. In that case we rely on the safeguards the law requires for cross-border transfers.

Enterprise offices can request a dedicated data region inside the UAE.

8. Retention

• We keep an office's data for as long as it subscribes.
• After cancellation or suspension, it is kept for 90 days to allow export or reactivation, then deleted. Backups roll over within 30 days after that.
• Billing records are kept for the period UAE tax law requires.

9. Security

• Encryption in transit and at rest.
• Each office's data is separated from the others, with role-based permissions inside the office.
• An audit log of document approvals, sending and platform team actions.
• Mandatory two-factor authentication for platform admin accounts.

10. Your rights

Under the law, a data subject can:

• Access their personal data and obtain a copy.
• Ask for inaccurate data to be corrected or completed.
• Ask for their data to be deleted or its processing restricted in the cases the law sets out.
• Object to processing, or withdraw consent where consent is the basis.
• Ask for their data in a machine-readable format.

11. How to exercise your rights

Send your request to moustafa.ghaazi@gmail.com. We reply within 30 days. If the data is part of an office's content, we may refer the request to the office as its controller.

12. Cookies

We only use what the service needs to run: the language setting and the sign-in session. We use no advertising cookies and no third-party tracking.

13. Changes to this policy

We tell users about any material change to this policy before it takes effect, and show the last update date at the top of the page.