Privacy policy

The data controller is Zaina Omar for Online Selling, a Sole Establishment licensed by the Department of Economy and Tourism, Government of Dubai under trade licence 1596159, registered at Green View 3, Al Barsha 1, Dubai, United Arab Emirates. We trade as Novolti.

We are subject to UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data. Where the EU or UK General Data Protection Regulation applies to you, we honour the rights it gives you as described below.

Reach us about anything in this policy at privacy@novolti.com.

Data you give us

• Account details — name, email address, password hash and, optionally, a telephone number and organisation name.
• Billing details — billing name, address and tax identifier. Card numbers are handled by our payment processor and never reach our servers.
• Content you create — posts, drafts, product catalogues, kitchen inventories, configuration and uploaded images, depending on the product.
• Correspondence — what you write to support, and our replies.

Data we collect automatically

• Usage data — pages and features used, timestamps and actions taken, so we can find faults and understand what to improve.
• Device and connection data — IP address, browser or app version, operating system and language.
• Diagnostics — error reports and performance traces.

Data from third parties

• Profile, page, message and metrics data from social platforms you connect, within the scopes you approve.
• Resource inventory and configuration metadata from cloud accounts you connect.
• Payment confirmations from our payment processor.

• To provide the product — creating your account, running the features you use, and storing your content. Legal basis: performance of a contract.
• To support you — answering questions and investigating faults. Legal basis: performance of a contract.
• To keep the service secure — detecting abuse, fraud and unauthorised access. Legal basis: legitimate interests.
• To improve the product — analysing aggregated usage to decide what to build. Legal basis: legitimate interests.
• To bill you — processing payments and keeping accounting records. Legal basis: performance of a contract and legal obligation.
• To send service messages — outages, security notices and material changes to this policy. Legal basis: legitimate interests.
• To send marketing — only where you have opted in, and you can withdraw at any time. Legal basis: consent.

We do not sell personal data, and we do not share it with third parties for their own advertising.

When you connect a Facebook, Instagram, WhatsApp Business, TikTok or cloud provider account, we receive only the data covered by the permissions you approve, and we use it only to deliver the feature you connected it for. We store access tokens encrypted at rest.

You can disconnect an account at any time from within the product or from the platform’s own settings. Disconnecting stops further collection; to erase what we already hold, follow our data deletion policy.

We use platform data in accordance with each provider’s developer policies, and we do not transfer it to third parties except the processors listed below.

Some features send your content to machine-learning models — for example, generating a draft post, or reading a photograph of your kitchen to build an inventory.

• Content is sent only when you use a feature that requires it.
• We instruct our model providers not to train their models on your content, and we use enterprise interfaces that make this contractual.
• Model output is generated and may be inaccurate. Review it before you publish or rely on it.
• We do not use your content to train models of our own without asking you first.

We share personal data only with processors acting on our instructions, and only as far as they need it:

• Cloud hosting and storage — to run the products and store your data.
• Model providers — to deliver AI features, as described above.
• Payment processing — to take payment and prevent fraud.
• Email delivery — to send transactional messages.
• Error and performance monitoring — to diagnose faults.

We may also disclose data where the law requires it, to enforce our terms, or to protect the rights and safety of our users. If the business is transferred, your data may transfer with it, and we will tell you before that happens.

We are based in the United Arab Emirates and our processors operate in several countries. When personal data leaves the UAE, we rely on an adequacy decision where one exists, or on standard contractual clauses with the recipient. You can ask us which safeguard applies to a particular transfer.

• Account and content data — for as long as your account is open.
• After you close your account — 30 days, so you can change your mind and export, then deletion.
• Billing and tax records — five years, as UAE law requires.
• Security and audit logs — up to 12 months.
• Support correspondence — 24 months.
• Backups — deleted data persists in encrypted backups for up to 90 days, then is overwritten.

You can ask us to:

• Give you a copy of the personal data we hold about you.
• Correct anything inaccurate or incomplete.
• Erase your data, subject to records we must keep by law.
• Export your data in a structured, machine-readable format.
• Restrict or object to processing based on our legitimate interests.
• Withdraw consent where consent is the basis, without affecting what came before.

Write to privacy@novolti.com from the email address on your account. We acknowledge within 5 days and respond within 30. We do not charge for this, and we will not treat you differently for asking. If you are not satisfied with our answer, you may complain to the UAE Data Office or your local supervisory authority.

• Encryption in transit with TLS, and at rest for stored data.
• Third-party access tokens encrypted with keys held separately from the data.
• Tenant isolation enforced at the database row, not only in application code.
• Role-based access, with staff access limited to what a role requires.
• Logged administrative access and regular dependency patching.

No system is completely secure. If a breach affects your personal data and is likely to cause you harm, we will notify you and the relevant authority without undue delay.

Our products are not directed at children under 18 and we do not knowingly collect their personal data. If you believe a child has given us data, write to privacy@novolti.com and we will delete it.

We use cookies that are strictly necessary to keep you signed in and to keep the service secure, and, where you agree, analytics cookies that tell us which features are used. You can refuse analytics cookies without losing access to any feature, and you can clear cookies from your browser at any time. We do not use advertising cookies.

We will update this policy as the products change. The date it was last revised is shown beside the contents. If a change materially affects your rights, we will tell you by email or in the product at least 30 days before it takes effect.

Privacy questions and data requests: privacy@novolti.com. Post reaches us at Zaina Omar for Online Selling, Green View 3, Al Barsha 1, Dubai, United Arab Emirates. To have your data erased, see our data deletion policy.