Privacy Policy

1. Who we are

NXAARA AI Cloud is operated by Enterprise AI Development, Production & Advancement Global FZCO (“NXAARA”, “we”, “us”), a company registered in the United Arab Emirates with its registered office at Dubai Digital Park, Dubai Silicon Oasis, Dubai, United Arab Emirates.

This policy explains what personal data we collect, why we collect it, how long we keep it and what rights you have. It applies to this website, the NXAARA console and the NXAARA API.

2. The two kinds of data on this platform

It matters that you distinguish these, because they are treated very differently.

Account data is information about you as a customer: your name, work email, organisation, billing details, support correspondence and the actions your account takes on the platform. We control this data and this policy governs it.

Customer content is what you upload and generate inside your projects: datasets, documents, model artefacts, prompts and outputs. We process this on your instructions as a service provider. We do not decide what is in it, we do not use it for our own purposes, and where it contains personal data you are the controller of that data and we act on your behalf under our agreement with you.

3. Account data we collect

Identity and contact details you give us when creating an account or contacting us: name, work email address, organisation and, where relevant, telephone number and job role.

Billing information necessary to invoice you and meet our accounting obligations.

Usage and technical records: console and API actions, resource consumption, IP address, browser and device information, and security logs. These are used to operate the service, bill accurately, investigate abuse and diagnose faults.

Support and sales correspondence, so that we have context when you contact us again.

4. How we use account data

To provide the service, authenticate you and enforce permissions.

To bill you accurately and meet accounting and tax obligations.

To detect, investigate and prevent abuse, fraud and security incidents.

To respond to your support and sales enquiries.

To send operational notices, including service, security and billing communications. These are not marketing and you cannot opt out of them while you hold an account.

To send marketing communications only where you have opted in. You may withdraw that consent at any time and every marketing message includes a means of doing so.

5. How we treat customer content

We do not train models on customer content. Datasets you upload are used for your jobs, inside your project, and for nothing else.

We do not pool customer content across accounts, sample it for internal quality work, or use it to improve base models.

Our staff do not access customer content routinely. Access occurs only where you request support that requires it, or where we are legally compelled, and such access is logged.

Inference request logging is disabled by default. Where you enable it for a project, retention is configurable and you can delete the logs.

6. Where your data is stored

Customer content and account data are stored and processed in the United Arab Emirates. Customer content does not leave the region unless you move it deliberately.

A limited number of subprocessors may process account data outside the UAE for functions such as payment processing and email delivery. We maintain a current subprocessor list and will supply it on request.

7. How long we keep it

Account data is retained for the life of your account and for the period afterwards required by UAE accounting and tax law, after which it is deleted or anonymised.

Customer content is retained until you delete it or your account is closed. On closure we delete customer content after a short grace period, which exists so that an accidental closure is recoverable. The grace period is stated in our agreement with you.

Security and audit logs are retained on a defined schedule appropriate to their purpose.

8. Sharing

We do not sell personal data, and we do not share it for advertising purposes.

We share data with subprocessors who help us operate the service, under contracts that limit them to processing on our instructions.

We may disclose data where legally required by a competent authority. Where we are lawfully able to notify you of such a request, we will.

In a merger, acquisition or asset sale, data may transfer as part of the business. You would be notified before any such transfer takes effect.

9. Security

We apply encryption in transit and at rest, project-scoped access control, multi-factor authentication for administrative access, tenant isolation and audit logging. Our current controls and certification position are described on the security page, including what we do not yet hold.

No system is perfectly secure. If a breach affects your personal data and creates a material risk to you, we will notify you and the relevant authority as required by law.

10. Your rights

You may request access to the personal data we hold about you, correction of inaccurate data, deletion where we have no continuing lawful basis to keep it, restriction of certain processing, and a copy in portable form.

Where you are a customer, much of this is self-service in the console. For anything else, write to privacy@nxaara.com and we will respond within thirty days.

If your personal data sits inside another organisation's customer content, that organisation controls it and your request should go to them. We will assist them in responding.

11. Cookies

This website uses only the cookies necessary to make it work and to keep your session secure. We do not use advertising cookies and we do not run third-party advertising trackers on this site.

The console uses session cookies for authentication. These are strictly necessary and the console cannot function without them.

12. Children

This is a business platform and is not directed at children. We do not knowingly collect personal data from anyone under eighteen. If you believe a child has provided us personal data, contact us and we will delete it.

13. Changes to this policy

We will update this policy as the platform develops. Material changes will be notified to account holders by email before they take effect, and the effective date at the top of this page will change.

Contact

Questions about this document should go to legal@nxaara.com, or by post to Enterprise AI Development, Production & Advancement Global FZCO, Dubai Digital Park, Dubai Silicon Oasis, Dubai, United Arab Emirates.