Privacy Policy

In short

• Files you upload are stored in the UAE, encrypted, and kept as originals so you have a full record.
• We use AI services, some outside the UAE, to read documents and answer questions. They may not train on your data.
• We never sell personal data.
• You can ask to see, correct, export or delete your data at any time by writing to privacy@arakan.ae.

1. Who we are

Arakan is a compliance platform for UAE companies and the firms that advise them. This policy covers the website, the Arakan apps and the client portal.

Company

Arakan Technology Limited

Licence number

CL13727

Licensed by

DIFC Registrar of Companies

Registered address

IH-00-01-03-OF-05, Level 3, Innovation One, Dubai International Financial Centre, Dubai

Country

United Arab Emirates

Data protection contact

privacy@arakan.ae

We are a company registered in the Dubai International Financial Centre (DIFC), so our handling of personal data is governed by the DIFC Data Protection Law (DIFC Law No. 5 of 2020) and its regulations, and supervised by the DIFC Commissioner of Data Protection, with whom we are registered as a controller.

2. Our role and yours

Account data (your name, email, sign-in and billing details): we decide how this is used, so we are the controller.

Workspace data (companies, people, documents and records you or your firm put into Arakan): your organisation decides what goes in and why, so it is the controller and we process it on its behalf. If you are an adviser, you are responsible for having a lawful basis to load your clients' data. A data processing agreement is available on request.

3. What we collect

• Account: name, email, organisation, role, password (stored as a hash) or single sign-on details.
• Workspace content: company details, shareholders, directors and officers, documents and files you upload, and records you create such as filings, policies and minutes. This can include ID documents and other personal data of the people connected to a company.
• Billing: plan, credit use and invoices. Card details are held by Stripe, not by us.
• Usage: pages used, features clicked, device and browser, IP address and error logs.
• Messages: what you send us by email, forms or support requests.

4. How we use it, and why we are allowed to

• To provide the service you signed up for: running the apps, analysing documents, deadlines and reminders. Basis: our contract with you.
• To keep records that UAE law requires, such as tax and audit records. Basis: legal obligation.
• To keep the platform secure and fix problems. Basis: our legitimate interest.
• To improve the product using usage analytics. Basis: our legitimate interest; you can opt out.
• To send product news. Basis: your consent; every email has an unsubscribe link.

We do not sell personal data, and we do not use your workspace content to train AI models.

5. AI processing

Some features send document text or your question to an AI service (currently Anthropic and Google Gemini) to read, classify or answer. These services act as our processors under contracts that bar them from training on your data. They may process data outside the UAE (see section 7). Results from AI are a starting point for professional review and are not legal or tax advice.

6. Where data is stored and how it is protected

Uploaded files and originals are stored in the UAE (AWS me-central-1), encrypted at rest (AES-256) and in transit (TLS), with an integrity fingerprint and an audit trail. Access inside your workspace follows the roles your administrator sets. Our staff access customer data only to support you or keep the service running, and that access is logged.

7. Services we use and transfers outside the UAE

These services process data for us:

Where data goes outside the DIFC, we send it only to places the DIFC Commissioner of Data Protection recognises as adequate (Article 26), or under safeguards such as standard contractual clauses (Article 27). We tell customers before adding a new service that handles workspace data.

8. How long we keep data

Account data is kept while your account is open. Workspace content is kept while your organisation's subscription is active, then deleted or returned within 90 days of closing, unless your organisation sets a longer retention period. Records UAE law requires us or you to keep (for example tax records, kept for at least 7 years) are kept for that period. Backups roll off within 35 days.

9. Your rights

Under the DIFC Data Protection Law you can ask us to:

• tell you what personal data we hold about you and give you a copy;
• correct data that is wrong or incomplete;
• delete your data, where we are not required to keep it;
• limit or stop certain uses, including analytics and marketing;
• give you your data in a machine-readable form to move elsewhere;
• object to uses based on our legitimate interests, and have a person review a decision made only by automated means.

Write to privacy@arakan.ae. We reply within one month (up to two more months for complex requests, and we will tell you if so). If your data sits in a workspace run by your employer or adviser, we may pass your request to them, since they control that data. You can also complain to the DIFC Commissioner of Data Protection.

10. Cookies

We use cookies that are needed to sign in and keep you signed in, and analytics cookies (PostHog) to see how the product is used. You can block analytics cookies in your browser without losing access.

11. If something goes wrong

If a breach puts personal data at risk, we tell the DIFC Commissioner of Data Protection and affected customers as soon as practicable, as the DIFC Data Protection Law requires, and explain what happened and what we are doing about it.

12. Changes and contact

We will post changes here and email account holders about significant ones. Questions about privacy or this policy: privacy@arakan.ae.