Privacy policy

Updated Draft for legal review

How Elcara collects, uses and protects personal data when you use elcara.ai and when we deliver Freya and our AI services to client businesses.

1. Who we are

Elcara LLC-FZ (“Elcara”, “we”, “us”) is an applied AI lab. We work inside client businesses, connect their systems and build AI that runs business functions. Our main product is Freya, an AI chief of staff.

Our registered address is Meydan Grandstand, 6th floor, Meydan Road, Nad Al Sheba, Dubai, UAE.

This policy explains how we handle personal data when you visit our website, elcara.ai, or contact us. Section 7 covers data we handle when we deliver services to clients.

For the data described in sections 2 to 6, we are the controller. That means we decide why and how the data is used.

2. What we collect

When you contact us. If you email [email protected] or call +971 54 747 8989, we receive what you send: your name, email address or phone number, your company, and what you write or say.

When you book a call. We use Cal.com to schedule calls. When you book, Cal.com collects your name, email address, the time you pick and any notes you add. It passes those details to us so we can hold the meeting.

When you browse the site. We use privacy-friendly analytics that does not use cookies. It records things like which pages are viewed, the referring site, browser type, device type and country. It does not build a profile of you or follow you across other sites.

Technical data. Our hosting provider processes your IP address and basic request data to deliver pages and protect the site from attacks.

We do not ask for sensitive data through the website. Please do not send it to us.

3. Why we use it

We use personal data to:

  • reply to your messages and calls
  • arrange and hold calls you book
  • talk with you about working together, if you asked us to
  • understand how the site is used, in total, so we can improve it
  • keep the site secure and working
  • meet legal duties and handle legal claims

We do not use your data for automated decisions that have legal or similarly significant effects on you.

The legal reason we rely on depends on where you are and what you are doing.

  • Consent. Where the law requires it, we ask first. You can withdraw consent at any time.
  • Steps before a contract. When you ask us about our services, we use your details to answer.
  • Legitimate interests. We run site analytics and security because we have a fair interest in a working, safe site, and these uses have little impact on you.
  • Legal duties. Some records we must keep by law.

5. Cookies

Our website does not use advertising or tracking cookies. Our analytics is cookieless. We do not show a cookie banner because we do not set cookies that need one.

Cal.com may set its own cookies when you use the booking widget or page. Those are covered by Cal.com’s own policy.

6. Who we share it with

We do not sell personal data. We do not share it for advertising.

We share data only with service providers who help us run the site and our business, and only as far as they need it:

  • Cal.com, for booking calls
  • our analytics provider, for cookieless site statistics
  • our hosting and security provider
  • our email and phone providers, to receive and send messages

These providers act on our instructions under written terms. We may also share data with advisers, auditors or authorities when the law requires it, or with a buyer if our business is sold or merged.

7. Data we handle when serving clients

Our clients are businesses. When a client hires us, Freya and the systems we build work inside that client’s tools. These can include Slack or Microsoft Teams, email, calendars, documents and other business systems.

In that work, Freya may process personal data held in the client’s workspace. This can include messages, emails, files and contact details of the client’s staff, customers and partners. Freya uses this data to remember context, research, write reports and handle email. Freya asks a person at the client to approve emails, payments, sign-ups, posts and deletions before they happen.

For this data:

  • the client is the controller and decides what Freya can access and why
  • we act as a processor and follow the client’s instructions
  • a separate client agreement and data processing agreement (DPA) sets the rules

If your data is in a client’s workspace and you want to use your rights, please contact that client first. We will help them respond.

Sub-processors

To deliver our services we use sub-processors. These include providers of AI models, cloud hosting and storage. We list them in our client DPA and tell clients before we add new ones.

8. International transfers

We are based in the UAE. Some of our providers store or process data in other countries, including the United States and the European Union.

When data leaves the UAE, or leaves the EU or UK, we use safeguards the law accepts. These can include transfers to countries with adequate protection, standard contractual clauses, or the other grounds the law allows.

9. How long we keep it

We keep personal data only as long as we need it.

  • Messages and enquiries: up to 24 months after our last contact, unless we start working together
  • Booking records: up to 24 months after the call
  • Analytics: stored in total form, not linked to you; kept as long as useful
  • Records we must keep by law: for the period the law sets

Client data processed under section 7 is kept and deleted as the client agreement sets out.

10. How we protect it

We use reasonable technical and organisational measures to protect personal data. These include encryption in transit, access controls, least-privilege access for our team and for Freya, and approval steps before Freya acts outside a client’s systems.

No system is perfectly secure. If a breach affects your data and the law requires it, we will tell you and the relevant regulator.

11. Your rights

The rights you have depend on the law that applies to you.

In the UAE. Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL) applies to us. It gives rights that include the right to get information about how your data is processed, to ask us to correct inaccurate data, and to restrict or stop processing. It also includes rights to deletion and to move your data to another controller in some cases.

The PDPL does not apply in free zones that have their own data protection law, such as the Dubai International Financial Centre (DIFC) and Abu Dhabi Global Market (ADGM). We are not based in either.

In the EU and UK. If you are in the EU or UK, the GDPR or UK GDPR may apply when we handle your data. You have the right to:

  • access your data
  • correct it
  • delete it
  • restrict how we use it
  • object to how we use it, including for direct marketing
  • receive it in a portable format
  • withdraw consent at any time
  • complain to your local data protection authority

How to use your rights. Email [email protected]. We may ask you to confirm who you are. We will reply within the time the law requires. We will not charge you unless the law allows it, for example for clearly excessive requests.

Complaints in the UAE. You can complain to the UAE Data Office.

12. Children

Our website and services are for businesses. They are not meant for children. We do not knowingly collect data from anyone under 18. If you think a child has sent us personal data, contact us and we will delete it.

13. Changes to this policy

We may update this policy as our services or the law change. We will post the new version here and change the date at the top. If a change is significant, we will tell people we have a relationship with, for example by email.

14. Contact us

If you have questions about this policy or your data, contact us:

  • Email: [email protected]
  • Phone: +971 54 747 8989
  • Post: Elcara LLC-FZ, Meydan Grandstand, 6th floor, Meydan Road, Nad Al Sheba, Dubai, UAE