Al Ayman Privacy Policy
This policy explains what personal data Al Ayman collects, what it is used for and how you can manage it. The document complies with the requirements of UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL) and with the applicable GDPR provisions for users from the European Economic Area.
1.Who we are
Personal data controller: Al Ayman Services Gateway L.L.C-FZ. Contact address for data-related enquiries: privacy@alayman.ae.
By using the alayman.ae website and the related mobile applications, you agree to the terms of personal data processing set out below.
2.What data we collect
The Platform collects only the data required for the service to operate. It can broadly be divided into the following categories:
| Category | Data included |
|---|---|
| Account data | first name, last name, phone number, email address, profile photo, languages, age, etc. |
| Verification documents | a scan of the Freelancer Permit or Commercial License with its number and validity period — for contractors and companies only |
| Professional profile | service categories and prices, description, portfolio (description and images), reviews — for contractors and companies only |
| Requests and correspondence | the content of published requests, response history, chat messages, attached files, videos and images |
| Payment data | tokenised card data (stored by the payment provider Stripe), the history of balance top-ups and charges in AED, the history of referral accruals |
| Technical data | IP address, device type and name, browser, OS version, session identifiers, sign-in and sign-out timestamps, push tokens for notifications |
| Geolocation | the city selected by the user; precise coordinates — only with explicit consent at the moment a request is created |
3.Purposes of data processing
- providing and maintaining the operation of the platform;
- authentication by phone number via SMS codes (provider: Twilio) and by email via one-time codes (provider: Resend);
- verification of contractors' permits and licences;
- payment processing, balance top-ups, deduction of commissions and accrual of referral rewards;
- ensuring security, tracking active sessions and devices, detecting fraud;
- sending push notifications about responses, messages and request statuses (Web Push Protocol, FCM, APNS);
- moderation of correspondence and content in accordance with the Platform rules;
- resolving disputes between clients and contractors;
- improving the product on the basis of anonymised analytics;
- complying with UAE legislation and tax reporting requirements.
4.Legal bases
We process your personal data on the following bases:
- Contract. Most of the processing is necessary to perform the user agreement — authentication, responses, chat, balance.
- Law. Some data is processed in order to comply with UAE tax, anti-fraud and AML legislation, as well as when responding to official requests from law enforcement authorities.
- Consent. Marketing mailings, precise geolocation, analytics and marketing cookies — only with your explicit consent.
- Legitimate interest. Protection against fraud, session security monitoring, basic product analytics, keeping the service operational.
5.Sharing with third parties
We do not sell your data. Sharing with third parties is strictly limited and takes place only in the following cases:
- Payment providers. Certified providers for processing balance top-ups. Only the data required to carry out the transaction is transferred; card details are stored exclusively on the provider's side.
- SMS provider. Twilio — for sending one-time phone confirmation codes during registration and sign-in. Only the phone number and the text of the SMS are transferred.
- Email provider. Resend — for sending one-time email confirmation codes and transactional notifications. The email address and the content of the message are transferred.
- Translation service. Azure Translator — for machine translation of request content into English at the moment of creation (the data is anonymised before being sent). Translated texts are stored on the Platform's servers; the original text is not transferred to third parties.
- Support. Chatwoot (self-hosted) — for support enquiries. Correspondence with support is stored on the Platform's infrastructure.
- File storage. All user files (verification documents, portfolio images, chat attachments, etc.) are stored on the Platform's own infrastructure using MinIO — the data is not transferred to third-party cloud storage.
- Analytics. Google Analytics — for statistical analysis of how the Platform is used. In the course of the service's operation, technical data about visits, the device, the browser, page interactions, cookies and other identifiers required to compile analytical reports and improve the Platform may be processed.
- Error monitoring. Sentry — for error monitoring and technical diagnostics of the Platform. When a failure occurs, technical data about the event, the device, the browser, the operating system, the IP address and the diagnostic context required to analyse and fix the error may be transferred. Data transfer is limited by minimisation and filtering settings.
- Law enforcement authorities. Only upon an official request made in accordance with UAE legislation.
6.Retention periods
- Account data — for the period the account is used and thereafter for the period required to resolve possible disputes and to comply with applicable law.
- Verification documents — 5 years from the date of last activity, in accordance with UAE AML requirements.
- Chat correspondence — 3 years, after which it is anonymised.
- Payment and balance history — 7 years, in accordance with UAE tax accounting requirements.
- Session data and security logs — for as long as the account exists and thereafter for the period required to ensure security, prevent abuse, resolve disputes and comply with legal requirements.
- Push tokens — until revoked by the user or until the token expires.
7.Your rights
In relation to your personal data, you have the right to:
- obtain a copy of the data we hold about you;
- correct inaccurate information via your profile settings or by writing to support;
- request that the use of your account be discontinued — the profile stops being displayed and available to other users; certain information may be retained to the extent and for the period required to comply with the law, resolve disputes and ensure security;
- manage active sessions and terminate them from your account settings;
- restrict or withdraw your consent to marketing mailings and push notifications;
- transfer your data to another service in a machine-readable format;
- lodge a complaint with the UAE supervisory authority — the UAE Data Office.
Please send requests to privacy@alayman.ae. The response time is up to 30 calendar days.
9.Data security
The Platform applies technical and organisational protection measures:
- Data is transferred between the client and the server over a secure TLS/HTTPS channel;
- Sensitive data is protected at the storage level: refresh tokens are stored as hashes, and access to verification documents is restricted;
- JWT rotation: each refresh token is bound to a specific session and device, so the compromise of one session does not affect the others;
- User files are stored in an isolated self-hosted MinIO storage; public access is allowed only for certain non-personal files, while sensitive files are available exclusively via temporary presigned URLs and through authorised endpoints;
- Employee access to administrative functions is separated by roles and follows the principle of least privilege (RBAC);
- Error monitoring is carried out via Sentry with minimisation and filtering of personal data in traces.
In the event of a personal data breach, we will notify you and the UAE Data Office within 72 hours of detecting the incident, if the breach may pose a risk to your rights and interests.
10.Minors
The Platform is intended for users over the age of 18. We do not knowingly collect data from minors. If it turns out that an account belongs to a person under the age of 18, that account will be deleted and the data destroyed.
11.Changes to this policy
The Platform may update this policy. The current version is always published on this page together with the date of the last update. By continuing to use the service after a new version is published, you accept the changes made. An archive of previous versions is available on request at privacy@alayman.ae.
12.DPO contacts
Please address questions relating to the processing of personal data to our Data Protection Officer:
Email: dpo@alayman.ae