Privacy Policy
Last updated 1 October 2026
Draft for review — these documents will be finalised with a UAE-qualified lawyer before launch.
This policy explains how [Company legal name] ("we") handles personal data in GovDesk UAE, in line with UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data. We act as the controller of account data, and as a processor for the company data you enter.
1. Data we collect
Account data: name, email, password (stored securely by our authentication provider) and your role.
Company data you enter: company profile, documents, tasks, deadlines, and employee records such as names, job titles, nationality and document expiry dates.
Technical data: log-in times, device and browser information, and security logs.
We do not ask for passport or Emirates ID numbers in forms; documents you upload may contain them and are stored privately.
2. Why we use it
To provide the service (deadlines, reminders, document storage, the AI assistant), keep it secure, give support, meet legal obligations, and improve GovDesk. We do not sell personal data or use it for advertising.
Our legal bases are performing our contract with you, your consent where required, our legal obligations, and our legitimate interest in keeping the service secure.
3. AI processing
When you upload a document or ask the assistant a question, the relevant content is sent to our AI provider to produce the result. The assistant receives your company profile but not passport or Emirates ID numbers. Providers are contractually restricted from using your data to train their models where that option is available.
4. Who we share it with
Service providers that host and run GovDesk: database and file storage (Supabase), hosting (Vercel) and AI processing (OpenAI). Some may process data outside the UAE; where they do, we rely on the safeguards allowed under UAE data-protection law.
Authorities, only where the law requires it.
5. How long we keep it
While your account is active, then up to 90 days after closure for backups, unless the law requires longer (for example, tax records). You can ask us to delete data sooner.
6. Security
Each company's data is isolated at database level, files are private and opened only through links that expire after 60 seconds, and access depends on each member's role. No system is perfectly secure; we will notify you and the relevant authority of a breach as required by law.
7. Your rights
You can ask to access, correct or delete your personal data, restrict or object to processing, withdraw consent, and receive a copy of your data. Employees whose data a company has entered should contact that company first; we will help it respond.
Contact [privacy@your-domain]. You may also complain to the UAE Data Office.
8. Children
GovDesk is a business tool and is not intended for anyone under 18.
9. Changes
We will post any changes here with a new date and notify account owners of significant changes.