Privacy Policy
1. Introduction and Identity of the Data Controller
This Privacy Policy (the “Policy”) is issued by Iyara Labs LLC, a limited liability company incorporated in the Sharjah Media City Free Zone, United Arab Emirates, under Trade Licence No. 2646487.01, whose registered address is Shams Business Center, Sharjah Media City Free Zone, Al Messaned, Sharjah, United Arab Emirates (referred to in this Policy as “Iyara Labs”, “we”, “us”, or “our”).
This Policy sets out the basis on which any personal data we collect from visitors to iyaralabs.com (the “Site”), or that visitors provide to us, will be processed by us. It applies to all personal data processed through the Site, whether submitted voluntarily by visitors or collected automatically through the technical operation of the Site.
We are committed to processing personal data fairly, lawfully, and transparently, in accordance with applicable data protection legislation, including:
(a) Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the “PDPL”), as operative in the United Arab Emirates;
(b) EU Regulation 2016/679 (the “GDPR”), to the extent applicable to the processing of personal data of individuals in the European Economic Area; and
(c) the California Consumer Privacy Act 2018 as amended by the California Privacy Rights Act 2020 (together, “CCPA/CPRA”), to the extent applicable to California residents.
Please read this Policy carefully before using the Site. By using the Site, you acknowledge that you have read and understood its terms.
2. Personal Data We Collect and the Basis on Which We Process It
2.1 Enquiries and audit-report requests
When you submit a contact form or request a comprehensive audit report, we may collect your name, work email address, company, country, selected service or package, target market, discovery source, project description, availability, time zone, the public website submitted for audit, its readiness score, and limited acquisition context described in clause 8.
Purpose. We process this data solely for the purpose of responding to your enquiry and evaluating a potential commercial engagement. We do not add contact form submissions to any mailing list, nor do we use this data for direct marketing, without your separate and express consent.
Legal basis:
(a) GDPR: taking steps at your request before entering a contract (Article 6(1)(b)), our legitimate interests in responding to business enquiries (Article 6(1)(f)), or consent where the relevant processing requires it.
(b) UAE PDPL: consent or another lawful basis available for responding to your request, as applicable. Where we rely on consent, you may withdraw it by contacting legal@iyaralabs.com.
(c) CCPA/CPRA: This data is collected for business purposes only, as defined under the CCPA/CPRA. We do not sell or share this data.
2.2 Analytics and behavioural data
We use Vercel Analytics and PostHog to understand Site usage. Our current PostHog client configuration uses memory-only persistence, disables automatic interaction capture and session recording, and does not create person profiles. Separate functional features use session storage as described in clause 8.
(a) Vercel Analytics. Vercel Analytics processes limited visit information used to produce aggregate website statistics, which may include the page path, referrer, browser, device and country-level location. Vercel states that its Web Analytics product does not use cookies or retain information that identifies a visitor across sessions.
(b) PostHog. We use PostHog for website usage and categorical service, CTA, audit, contact and WhatsApp events. The website configuration uses memory-only SDK persistence and does not create person profiles. Automatic interaction capture and session recording are disabled in this configuration. Added conversion events exclude names, emails, descriptions and audited URLs. Account-level IP processing and retention settings require separate verification; this page does not assert that IP anonymisation or a particular automatic-deletion period is enabled.
Purpose. To understand how visitors use the Site in order to improve its content, performance, and usability.
Legal basis:
(a) GDPR: Legitimate interests (Article 6(1)(f)). Our legitimate interest is in understanding patterns of Site usage and improving the visitor experience. The applicable legal basis and account-level settings require owner review. You have the right to object to this processing; see clause 6.1 below.
(b) UAE PDPL: Legitimate interests, on the same basis.
(c) CCPA/CPRA: to the extent these laws apply, analytics information is used for the business purposes described here. We do not sell personal information or share it for cross-context behavioural advertising.
2.3 AI readiness audit
When you run the free AI readiness audit, we process the public website address you submit and technical information available from that public website in order to return a readiness summary. The audit is automated and may create operational logs needed to secure, diagnose and improve the service. If you separately request a comprehensive report, the contact and audit details listed in clause 2.1 are sent to our enquiry workflow.
2.4 Security and error diagnostics
We use Sentry for application error, performance and security diagnostics. Our website configuration disables default personal-data collection and session replay. Diagnostic events may still contain technical information such as route, browser, device, timestamps, error details and network context where supplied by the service or browser. We use this information to operate and secure the Site.
2.5 Data we do not intentionally request
We do not collect, process, or retain:
(a) special categories of personal data, including health, genetic or biometric data. Please do not include such information in free-text fields;
(b) financial or payment data. The Site does not offer e-commerce or payment functionality of any kind;
(c) precise geolocation data;
(d) personal data of children under the age of 13, under any circumstances; or
(e) personal data of individuals under the age of 18, as this Site is not directed at minors.
3. Third-Party Processors
We engage the following third-party data processors in connection with the operation of the Site:
| Provider | Jurisdiction | Role | Transfer mechanism |
|---|---|---|---|
| Vercel Inc. | United States | Website hosting, edge network delivery, and cookieless aggregate analytics | Standard Contractual Clauses (EU Commission Decision 2021/914); Vercel Data Processing Addendum |
| PostHog, Inc. | United States | Product analytics and Core Web Vitals capture; memory-only SDK persistence. Session recording is disabled. Account-level IP processing requires separate verification. | Standard Contractual Clauses (EU Commission Decision 2021/914); PostHog Data Processing Agreement |
| Functional Software, Inc. (Sentry) | United States | Application error, performance and security diagnostics. Default PII collection and session replay are disabled in our website configuration. | Contractual and transfer safeguards made available by the provider, as applicable |
| Google LLC / Google Workspace | United States and other processing locations | Receives contact and comprehensive-audit requests through a Google Apps Script workflow used for enquiry records and team notifications. | Contractual and transfer safeguards made available by the provider, as applicable |
These providers process data under their applicable service terms and data-protection commitments. We configure them for the purposes described above and do not authorise them to use enquiry data for their own marketing.
We do not sell, rent, lease, or otherwise transfer personal data to any third party for marketing, commercial, or any other purpose not described in this Policy.
4. International Data Transfers
Iyara Labs LLC is based in the United Arab Emirates. Some providers and members of our technical team operate in the United States, so data may be processed outside your country.
Where applicable law requires a transfer mechanism for personal data sent internationally, we use the safeguards available under the relevant provider terms, such as approved standard contractual clauses, together with additional safeguards where appropriate.
International transfers are subject to the requirements and exceptions of applicable law. You may contact us for more information about the safeguards relevant to your data.
5. Data Retention
We retain personal data only for as long as is necessary for the purposes set out in this Policy or as required by applicable law. Once the applicable retention period has expired, personal data will be securely deleted or irreversibly anonymised in accordance with our internal data management procedures.
| Category | Retention period |
|---|---|
| Enquiries and comprehensive-audit requests | Up to 24 months from the date of submission, or until you request deletion, whichever is the earlier |
| Vercel Analytics data | Aggregated and anonymised. No personal data retention period applies |
| PostHog analytics events | The account-level retention setting requires verification; no automatic deletion period is asserted here. |
| PostHog session recordings | Session recording is disabled in the website configuration. |
| Sentry diagnostics | Retained according to the account settings and provider terms in force; retained only as long as reasonably needed for diagnostics, security and legal obligations. |
6. Your Rights
Subject to the conditions and limitations set out in applicable law, you have the rights described below in relation to your personal data. To exercise any of these rights, please submit a written request to legal@iyaralabs.com. We may require reasonable verification of your identity before processing a request. We will not charge a fee for processing a rights request unless it is manifestly unfounded or excessive.
6.1 GDPR (EU/EEA Residents)
Pursuant to the GDPR, you have the following rights:
(a) Access (Article 15): to obtain confirmation of whether we process personal data about you and, if so, to receive a copy of that data together with supplementary information about how it is processed.
(b) Rectification (Article 16): to have inaccurate or incomplete personal data corrected without undue delay.
(c) Erasure (Article 17): to have your personal data erased where no lawful basis for its continued retention exists, subject to any applicable exemptions.
(d) Restriction (Article 18): to restrict the processing of your personal data in certain circumstances, including where you contest its accuracy or object to its processing.
(e) Portability (Article 20): to receive personal data you have provided to us in a structured, commonly used, and machine-readable format, and to transmit it to another controller, where technically feasible and where processing is carried out by automated means.
(f) Objection (Article 21): to object to processing carried out on the basis of legitimate interests. We shall cease such processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or that the processing is necessary for the establishment, exercise, or defence of legal claims.
(g) Withdrawal of consent: where processing is based on consent, to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
Response time. We will respond within 30 days of receipt of a verified request. In cases of complexity or volume, we may extend this period by a further two months, with written notice provided within the initial 30-day period.
Supervisory authority. You have the right to lodge a complaint with the data protection supervisory authority in your country of residence or place of work. A list of EU/EEA supervisory authorities is available at edpb.europa.eu.
6.2 CCPA/CPRA (California Residents)
Pursuant to the CCPA/CPRA, you have the following rights:
(a) Right to Know: to request disclosure of the categories and specific pieces of personal information we have collected about you, the purposes for which it is used, and the categories of third parties to whom it has been disclosed.
(b) Right to Delete: to request deletion of personal information we hold about you, subject to certain statutory exceptions.
(c) Right to Correct: to request correction of inaccurate personal information we hold about you.
(d) Right to Opt-Out of Sale or Sharing: we do not sell personal information and we do not share personal information for cross-context behavioural advertising. No opt-out mechanism is required or available.
(e) Right to Limit Use of Sensitive Personal Information: we do not collect sensitive personal information as defined under the CPRA.
(f) Right to Non-Discrimination: we will not discriminate against you for exercising any right under the CCPA/CPRA.
Response time. We will respond within 45 days of receipt of a verified request. Where reasonably necessary, we may extend this period by a further 45 days, with written notice provided within the initial 45-day period.
Authorised agents. Requests submitted on your behalf by an authorised agent must be accompanied by written authorisation signed by you or a valid power of attorney.
6.3 UAE PDPL (UAE Residents)
Pursuant to Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the “PDPL”), we process your personal data on the following lawful bases:
(a) Contact form data: on the basis of your consent, which you provide by voluntarily submitting the contact form. You may withdraw consent at any time by contacting legal@iyaralabs.com, without affecting the lawfulness of any processing carried out prior to withdrawal.
(b) Analytics data: on the basis of our legitimate interests, as described in clause 2.2 above.
You have the following rights under the PDPL:
(a) Access: to request confirmation of whether we process your personal data and to obtain a copy of it.
(b) Rectification: to request correction of inaccurate or outdated personal data.
(c) Erasure: to request deletion of your personal data where there is no longer a lawful basis for its retention.
(d) Restriction: to request that we restrict processing of your personal data in certain circumstances.
(e) Objection: to object to processing of your personal data in certain circumstances.
(f) Portability: to receive your personal data in a structured, machine-readable format, where technically feasible.
Response time. We will respond within 30 days of receipt of a verified request.
Complaints. If you consider that we have processed your personal data in breach of the PDPL, you have the right to submit a complaint to the UAE Data Office, the federal authority responsible for oversight of data protection in the United Arab Emirates, at uaedataoffice.gov.ae.
We will update this Policy where changes to applicable law, regulatory guidance or our processing activities make an update necessary.
7. Automated Decision-Making and Profiling
We do not engage in automated decision-making or profiling that produces legal effects or similarly significant effects on any individual. No decisions concerning you are made solely by automated means.
8. Cookies and Tracking Technologies
The contact form stores a draft in sessionStorage so it can be restored within the tab session; it is removed after confirmed successful submission. Limited acquisition context—first landing path, referrer hostname and allowlisted campaign parameters—is also kept for the tab session. Optional discovery and target-market selections can be left blank. PostHog uses memory persistence separately from these form features.
PostHog analytics uses memory-only SDK persistence in our current configuration. PostHog autocapture and session recording are disabled. Sentry session replay is also disabled.
We do not use third-party advertising trackers or cross-context behavioural advertising. The Site may set a strictly functional device-preference cookie if you expressly choose a desktop or mobile view. Browser-storage and consent requirements can vary by location and configuration; we review the Site as those requirements or our tools change.
9. Children
This Site is directed exclusively at businesses and professionals. It is not intended for use by individuals under the age of 18.
We do not knowingly collect personal data from children through the Site. The Site has no user registration or account-creation feature and is not designed or marketed for use by minors.
We do not knowingly sell or share the personal information of minors for cross-context behavioural advertising.
If you have reason to believe that a person under the age of 13 has submitted personal data through this Site, please notify us promptly at legal@iyaralabs.com. We will take reasonable steps to delete such data without undue delay upon becoming aware of it.
10. Security
We implement reasonable and appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. All data transmitted through the Site is encrypted in transit using HTTPS. Our hosting infrastructure is managed by Vercel Inc., which maintains industry-standard security controls and certifications.
No method of electronic transmission or storage is completely secure. We cannot guarantee the absolute security of personal data transmitted to or stored by us. Subject to the requirements of applicable law, we shall not be liable for any unauthorised access to, or disclosure of, personal data that results from circumstances beyond our reasonable control.
In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of individuals, we will notify the relevant supervisory authority and, where required by applicable law, affected individuals, without undue delay and in accordance with applicable legal requirements.
11. Changes to This Policy
We reserve the right to amend this Policy at any time. Where we do so, we will update the “Last updated” date at the top of this page. Material changes, including changes to the purposes for which we process personal data or to the categories of data we collect, will be communicated by means of a prominent notice posted on the Site for a reasonable period prior to the change taking effect. Where required by applicable law, including under the GDPR, we will seek fresh consent before relying on amended terms as a basis for processing.
Your continued use of the Site following the posting of a non-material amendment shall constitute your acceptance of the amended Policy. We encourage you to review this Policy periodically.
12. Contact
All enquiries, rights requests, or complaints relating to this Policy or our data practices should be directed to:
Iyara Labs LLC
Trade Licence No. 2646487.01
Shams Business Center, Sharjah Media City Free Zone
Al Messaned, Sharjah, United Arab Emirates
legal@iyaralabs.com
We aim to acknowledge all enquiries within five working days of receipt.