Privacy Policy

The data controller is Zayn Consulting F.Z.E, a Free Zone entity established in the United Arab Emirates. For any privacy request, contact us at the address in Section 12.

We collect only the data needed to provide the service:

• Account data — name, email, phone, password (stored hashed by our authentication provider).
• Business data — company name, Tax Registration Number (TRN), address, bank details and logo you enter for your invoices and reports.
• Operational data — customers, invoices, payments, expenses, bills and bank statements you create or import.
• Technical data — authentication tokens and minimal logs required for security and service operation.

We process personal data to: (a) provide and operate the service (performance of a contract); (b) comply with tax and accounting obligations (legal obligation); (c) secure the service and prevent abuse (legitimate interest); and (d) improve features, including AI-assisted categorisation and reconciliation, using your own data to serve you.

Your data is logically isolated per company using database row-level security. Users can only access data belonging to the company they are a member of. Application views enforce the same access rules on behalf of the requesting user.

We do not sell your personal data. We share it only with vetted sub-processors strictly to run the service: our cloud database and storage provider (Supabase), our AI provider (Anthropic) for the AI features you invoke, and — only if you accept analytics cookies — Google (Google Analytics) for aggregate, non-advertising audience measurement. When using AI features, we send only the minimum data required (e.g. a supplier label or statement text) and never full banking credentials. We may disclose data where required by law or a competent authority.

Some sub-processors may process data outside the UAE. Where this occurs, we rely on appropriate safeguards consistent with the PDPL to protect your data.

We retain invoicing and accounting records for the period required by UAE tax law (generally seven years). Account data is retained while your account is active. On deletion request, we remove personal data that we are not legally required to keep.

We apply technical and organisational measures including encryption in transit, row-level access control, scoped signed URLs for documents, and least-privilege secrets management. No method of transmission or storage is fully secure, but we work to protect your data.

Subject to the PDPL, you may request to:

• access the personal data we hold about you;
• correct inaccurate or incomplete data;
• request deletion of your data;
• restrict or object to certain processing;
• receive your data in a portable format.

To exercise any right, contact us using Section 12. We respond within the legal timeframe.

We use strictly necessary cookies required for authentication and session management; these are always active and cannot be switched off. With your consent, we also use Google Analytics 4 to measure aggregate traffic (such as page views and traffic sources) so we can improve the product.

Analytics runs in consent mode: nothing is measured until you choose "Accept" on the cookie banner, and you can decline at any time. We do not use advertising cookies or cross-site ad tracking. Analytics data may be processed by Google outside the UAE under appropriate safeguards (see Section 6).

We may update this policy. Material changes will be notified in-app or by email. The "Last updated" date reflects the latest version.

Zayn Consulting F.Z.E — United Arab Emirates. Privacy requests: hello@getfatoora.ae.