Privacy Policy

This Privacy Policy explains how UVX Technologies FZE collects, uses, shares and protects personal data when you visit our website, talk to us, use UVX, or message a business that uses UVX. It also explains the choices and rights you have.

Please read it carefully. If you have any questions, contact us at privacy@uvx.ai.

1. Who We Are and Key Terms

UVX Technologies FZE is a company registered in the United Arab Emirates, with its address at Dubai Silicon Oasis, A5 GU004, Dubai, United Arab Emirates. In this Privacy Policy:

• "UVX", "we", "us" and "our" mean UVX Technologies FZE.
• "Services" means UVX, our customer-conversation and operations software, including the UVX app at app.uvx.ai, its web and mobile applications, APIs, AI agents, chat widgets, integrations and related services. Industry solutions built on UVX, such as Zayna and Hubpost, are part of the Services for the purposes of this Privacy Policy.
• "Website" means our marketing website at www.uvx.ai, including its forms and the live-chat widget on it, and any other UVX website that links to this Privacy Policy.
• "Customer" means a business or organization that subscribes to the Services.
• "Users" means the individuals a Customer authorizes to access the Services on its behalf, such as its employees and contractors.
• "End Users" means individuals who communicate with a Customer through a channel connected to the Services, such as WhatsApp, Instagram, Messenger, TikTok, Telegram, email, SMS, a web widget or the API. End Users are typically the Customer's own customers, leads and contacts.
• "Customer Data" means the content and data that a Customer, its Users or its End Users submit to or generate in the Services, including conversations, contact records, knowledge base content and records synced from connected services.
• "Personal data" means any information relating to an identified or identifiable individual.

This Privacy Policy does not apply to third-party websites, apps or services, including those of our Customers and of the messaging channels and integrations they connect to the Services. Those are governed by their own privacy notices.

2. Our Role: Controller and Processor

How we handle personal data depends on our relationship with you.

2.1 When UVX is the controller. We decide how and why personal data is processed, and are responsible for it, when we handle:

• information about Website visitors, including people who submit our contact forms, join our mailing list or use our live chat;
• account, billing and usage information about Customers and their Users; and
• information about prospects, partners, suppliers and others who deal with us directly.

2.2 When UVX is a processor. When a Customer uses the Services to communicate with its End Users, the Customer decides what personal data is collected and how it is used. In that case the Customer is the controller and UVX processes Customer Data as a processor (or service provider) on the Customer's behalf and under its instructions, as set out in our agreement with that Customer.

If you are an End User and you have questions about how a business uses your information, or want to exercise your privacy rights, please contact that business directly and refer to its privacy notice. If you contact us instead, we will, where appropriate, pass your request to the relevant Customer.

3. Information We Collect

3.1 Website visitors. When you visit or interact with the Website, we collect:

• Contact form submissions: your name, work email address, company, phone or WhatsApp number (optional), and the details of your request. Depending on the type of request, this may include your company size, industry, the channels you want to cover, expected conversation volumes, go-live timeline, your website or LinkedIn profile, the partner track you are interested in, and your message. We also record the page the form was submitted from, the referring page, your browser's user agent and your language preference.
• Mailing list sign-ups: your email address, the date you signed up and your subscription status.
• Live chat: the live-chat widget on the Website is powered by UVX itself. If you use it, we collect the messages you send and any details you choose to share, such as your name and email address, together with technical information needed to keep the conversation going across pages.
• Device and usage information: such as your IP address, browser type, device type, operating system, language preference, approximate location derived from your IP address, referring and exit pages, pages viewed, and the date and time of your visit. We collect this through server logs, cookies and similar technologies (see Section 12).
• Communications with us: information you provide when you email us, book a demo, attend a call, report a security vulnerability or otherwise correspond with us. If you report a security vulnerability and ask to be publicly acknowledged, we may publish your name or handle for that purpose.

3.2 Customers and Users. When an organization subscribes to the Services, or when you use the Services as a User, we collect:

• Account and profile information: such as name, email address, phone number, job title, company name, login credentials, role and permissions, and profile settings.
• Billing and transaction information: such as billing contact details, billing address, tax registration details, plan and subscription details, and payment history. Payment card details are processed by our payment service providers.
• Usage and log information: such as log-in times, IP addresses, device and browser information, features used, actions taken in the account, configuration settings, and performance, diagnostic and error data.
• Support communications: information you share when you contact our support team by email or in-app chat.
• Connection information for third-party services: when a User connects a messaging channel or integration, we store the account identifiers and access credentials (such as access tokens) needed to make that connection work.
• Information from Google APIs: if a User connects a Google Workspace account, we access only the data needed to provide the features that User chooses to enable.

3.3 End Users (on behalf of Customers). When End Users message a Customer through a channel connected to the Services, we process the following information on the Customer's behalf:

• Contact details and identifiers: such as name, phone number, email address, social media handle or account ID, and profile picture, as made available by the channel or provided by the End User.
• Message content: such as text messages, voice notes, images, files and other attachments, together with message metadata such as timestamps and delivery and read status.
• Records created by the Customer: such as notes, tags, tickets, orders, appointments, operations board items and other records created by the Customer's Users or AI agents, and data synced from services the Customer connects (for example, order history from an e-commerce store or contact records from a CRM).
• AI-generated content: such as AI agent replies, conversation summaries, classifications, and evaluation and monitoring results.

3.4 Sensitive information. We do not ask for sensitive personal data, such as government identification numbers, health or genetic data, biometric data, or information about religious beliefs, through the Website. However, End Users may choose to share such information in conversations with a Customer, and Customers may store it in the Services. Customers are responsible for making sure they have a lawful basis to process any sensitive personal data and must not configure the Services to collect it unless permitted by applicable law and by their agreement with us.

4. How We Use Information

4.1 Information we control. We use personal data about Website visitors, Customers and Users to:

• operate, maintain and secure the Website and the Services;
• respond to your enquiries and to demo, sales, support and partnership requests;
• create and manage accounts, provide the Services a Customer has subscribed to, and process payments and invoices;
• send service communications, such as security notices, billing messages and information about changes to the Services;
• send newsletters and marketing communications, where you have agreed to receive them or where otherwise permitted by law (see Section 13);
• understand how the Website and the Services are used, measure performance, and improve and develop our products;
• detect, prevent and investigate fraud, abuse, security incidents and breaches of our terms;
• enforce our agreements and protect the rights, property and safety of UVX, our Customers and others; and
• comply with legal and regulatory obligations.

4.2 Customer Data. We process Customer Data, including End User personal data, only to provide the Services to the Customer, in line with the Customer's instructions and our agreement with the Customer. This includes:

• receiving, routing and sending messages across connected channels;
• generating AI agent replies, retrieving relevant knowledge base content, and running the tools, skills, scheduled tasks and integrations the Customer has configured;
• escalating conversations to the Customer's human team according to the Customer's settings;
• evaluating and monitoring AI responses for that Customer, for example to detect possible hallucinations;
• producing reports and analytics for the Customer;
• providing support when the Customer asks for it; and
• keeping the Services secure, preventing abuse, and complying with law.

4.3 Aggregated and de-identified information. We may create aggregated or de-identified information that does not identify any individual or Customer, such as overall usage statistics and performance metrics for the Services. We use this to operate, analyze and improve our services, and we may publish it, for example in reports on usage trends.

5. Legal Bases for Processing

Where the EU or UK General Data Protection Regulation (GDPR) or the UAE Personal Data Protection Law applies, we rely on the following legal bases for the personal data we control:

• Performance of a contract: to provide the Services under a Customer's subscription, manage accounts, provide support, and take steps you ask for before entering into a contract, such as preparing a demo or quote.
• Legitimate interests: to run, secure and improve the Website and the Services, understand how they are used, respond to business enquiries, market our services to business contacts, prevent fraud and abuse, and establish or defend legal claims. We only rely on legitimate interests where they are not overridden by your interests and rights.
• Consent: where required by law, for example to send certain marketing emails or to place non-essential cookies. You can withdraw your consent at any time, without affecting processing that took place before you withdrew it.
• Legal obligation: to comply with tax, accounting, regulatory and other legal requirements, and to respond to lawful requests from public authorities.

For Customer Data that we process as a processor, the Customer is responsible for identifying and relying on an appropriate legal basis, and for giving End Users any required notices.

6. AI Processing

The Services use artificial intelligence, including generative AI, to power AI agents, summaries, routing, evaluation and other features. This section explains how that works.

6.1 Third-party AI model providers. To generate a response or perform an AI task, the Services send the relevant content, such as the conversation, related knowledge base content and the Customer's agent instructions, to third-party AI model providers. The Services can route different tasks to different models, so the provider used may vary depending on the task and the Customer's configuration. The provider processes the content to return a result, which the Services then use or display.

6.2 No training of generalized models. We do not use Customer Data to train generalized AI or machine learning models. We use AI model providers under business or API terms that do not permit them to use the content we send them to train their generally available models. Some providers may keep content for a limited period, for example to monitor for abuse or to meet legal requirements, under their own terms.

6.3 Customer-specific use. Features that a Customer configures, such as knowledge bases, custom tools, skills, and AI evaluation and monitoring, use that Customer's data to serve that Customer's own AI agents and account. They are not used to improve AI agents for other Customers.

6.4 Google Workspace data. Our use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements. Data obtained through Google Workspace APIs is not used to develop, improve or train generalized AI or machine learning models.

6.5 Human review. Our personnel access the content of Customer conversations only where needed to provide support the Customer has asked for, to investigate security incidents or abuse, or to comply with law.

6.6 Automated decisions. We do not use the personal data of Website visitors, Customers or Users to make decisions based solely on automated processing that produce legal or similarly significant effects for them. Customers control how their AI agents respond to and act for End Users, and are responsible for giving End Users any notices required by law, including where End Users are interacting with an AI agent.

6.7 Our own live chat. When you use the live-chat widget on our Website, your messages may be answered by a UVX AI agent and are processed in the same way as described in this section. You can ask to speak with a member of our team at any time.

7. How We Share Information

We do not sell personal data. We share personal data only as described below.

7.1 Service providers and sub-processors. We use carefully selected service providers to help us run the Website and the Services. They may only use personal data to provide services to us, under contractual confidentiality and data protection obligations. They include providers of:

• cloud hosting, databases and infrastructure, including Amazon Web Services;
• AI models and related AI services (see Section 6);
• email delivery and other communication services;
• analytics and tag management, including Google;
• payment processing, billing and accounting;
• customer support, security and monitoring tools; and
• professional services, such as legal, audit and accounting advisers.

Customers can request current information about the sub-processors that process Customer Data by contacting privacy@uvx.ai.

7.2 Messaging channel providers. When a Customer connects a messaging channel, messages to and from End Users pass through that channel's provider. These include Meta (for WhatsApp, Instagram and Messenger), TikTok, Telegram, and email and SMS providers. Those providers process data under their own terms and privacy policies, which apply independently of this Privacy Policy.

7.3 Integrations enabled by Customers. When a Customer connects a third-party service, such as Shopify, HubSpot, Salesforce, Zoho or Slack, we exchange data with that service at the Customer's direction. The Customer's use of that service is governed by the Customer's agreement with its provider.

7.4 Within a Customer's account. Information about Users, such as their name, email address and activity, may be visible to other Users and administrators of the same Customer account.

7.5 UVX partners. If a Customer buys the Services through, or works with, a UVX partner, we may share account, subscription and usage information with that partner as needed to administer the relationship, support the Customer and calculate partner compensation. If a Customer gives a partner access to its account, the partner can see Customer Data as a User.

7.6 Legal and safety reasons. We may disclose personal data where we believe in good faith that this is required by law or legal process, or reasonably necessary to protect the rights, property or safety of UVX, our Customers, End Users or the public, including to detect and prevent fraud and security incidents.

7.7 Business transfers. If UVX is involved in a merger, acquisition, financing, reorganization or sale of assets, personal data may be transferred as part of that transaction, subject to appropriate confidentiality protections.

7.8 With your consent. We may share personal data for other purposes with your consent or at your direction.

8. International Data Transfers

UVX is based in the United Arab Emirates, and the UAE is our primary location for processing personal data. Some of our service providers, including cloud hosting, AI model, messaging channel, analytics and email providers, may store or process personal data in other countries, including countries that may not offer the same level of data protection as your own.

When we transfer personal data outside the UAE, or outside the EU or UK where the GDPR applies, we take steps to make sure it remains protected. Depending on the transfer, these may include transferring data to countries recognized as providing an adequate level of protection, using standard contractual clauses or other approved contractual safeguards, and relying on other mechanisms permitted under the UAE Personal Data Protection Law and other applicable laws. You can contact us for more information about the safeguards we use.

9. Data Retention

We keep personal data only for as long as we need it for the purposes described in this Privacy Policy, including to provide our services, meet legal, tax and accounting obligations, resolve disputes and enforce our agreements. In general:

• Contact form submissions and enquiries are kept for as long as needed to respond to you and to manage any resulting business relationship.
• Mailing list data is kept until you unsubscribe. After that, we keep a minimal record of your email address and opt-out status so that we can respect your choice.
• Account, billing and usage information is kept while the Customer's account is active and afterwards for as long as needed for legal, tax and accounting purposes.
• Customer Data is kept for the duration of the Customer's subscription and deleted or returned afterwards in line with our agreement with the Customer. Customers can delete certain Customer Data from the Services at any time. Copies held in backups are removed as those backups are overwritten in the normal course.
• Analytics data is kept in line with the retention settings of the relevant analytics provider.

When we no longer need personal data, we delete it or de-identify it so that it can no longer be linked to an individual.

10. Security

We use administrative, technical and organizational measures designed to protect personal data against unauthorized access, loss, misuse and alteration. These include encryption of data in transit and, where supported, at rest; access controls based on least privilege; authentication controls; logging and monitoring; and confidentiality obligations for our personnel and service providers.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security. Customers are responsible for keeping their account credentials safe and for managing User access within their account. If we become aware of a security incident affecting personal data, we will notify affected Customers and, where required by law, the relevant authorities and individuals.

If you believe you have found a security vulnerability, please report it to privacy@uvx.ai.

11. Your Privacy Rights

11.1 Rights available to everyone. Wherever you are located, you can ask us to:

• tell you whether we hold personal data about you and give you a copy of it;
• correct personal data that is inaccurate or incomplete;
• delete personal data that we no longer need or that you no longer want us to have;
• stop sending you marketing communications; and
• withdraw any consent you have given us.

If you have a UVX account, you can also view and update much of your profile information directly in your account settings. Some of these rights are subject to exceptions, for example where we must keep information to comply with law or to establish or defend legal claims.

11.2 United Arab Emirates. If the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) applies to our processing of your personal data, you have, subject to the conditions and exceptions in that law, the right to:

• obtain information about the personal data we process about you, including the purposes of processing and who we share it with;
• request the transfer of your personal data to another controller in a structured and machine-readable format;
• request the correction or erasure of your personal data;
• request that we restrict processing in certain circumstances;
• object to or stop processing, including processing for direct marketing purposes; and
• object to decisions based solely on automated processing that have legal consequences or seriously affect you.

You may also submit a complaint to the UAE Data Office.

11.3 European Union and United Kingdom. If the GDPR or UK GDPR applies to our processing of your personal data, you have, subject to the conditions in those laws, the right to:

• access your personal data;
• rectify inaccurate or incomplete personal data;
• erase your personal data;
• restrict our processing of your personal data;
• receive your personal data in a portable format, where processing is based on consent or contract and is carried out by automated means;
• object to processing based on our legitimate interests, and to object at any time to processing for direct marketing;
• withdraw your consent at any time, where processing is based on consent; and
• lodge a complaint with your local data protection supervisory authority.

11.4 How to exercise your rights. To exercise any of these rights, email privacy@uvx.ai with the subject line "Privacy Request". We may need to verify your identity before acting on your request. We will respond within 30 days, or sooner if required by applicable law, and will tell you if we need more time or cannot meet your request, and why.

If you are an End User of one of our Customers, please send your request to that Customer, as it controls your personal data (see Section 2.2). We will help our Customers respond to such requests.

12. Cookies and Tracking Technologies

Cookies are small text files that a website stores on your device. We and our service providers use cookies and similar technologies, such as local storage and pixels, on the Website and the Services.

Category	Purpose
Strictly necessary	Make the Website and the Services work, keep you signed in, keep the Services secure, and remember your privacy choices.
Functional	Remember your preferences and keep your live-chat conversation available as you move between pages.
Analytics	Help us understand how visitors use the Website, measure performance, and improve our content. We use Google Tag Manager to manage analytics and similar tags, such as Google Analytics.

Analytics tools may collect information such as your IP address, browser type, device information, referring and exit pages, pages viewed and the time of your visit. Google's use of this information is described in Google's privacy policy, and you can opt out of Google Analytics using the Google Analytics opt-out browser add-on.

Some pages may include content embedded from other websites, such as videos, which may set their own cookies. We do not control those cookies, and their use is governed by the relevant third party's privacy policy.

Managing cookies. Most browsers let you block or delete cookies through their settings. If you block strictly necessary cookies, parts of the Website or the Services may not work properly. Where required by law, we will ask for your consent before placing non-essential cookies.

Do Not Track. Because there is no common industry standard for responding to "Do Not Track" browser signals, the Website does not currently respond to them. You can still manage cookies as described above.

13. Marketing Communications

If you join our mailing list, or where otherwise permitted by law, we may send you emails about UVX products, features, events and news. Every marketing email includes an unsubscribe link, and you can also opt out at any time by emailing privacy@uvx.ai.

Even if you opt out of marketing emails, Customers and Users will still receive service communications that are necessary to provide the Services, such as security notices, billing messages and important changes to our services.

14. Children

The Website and the Services are designed for businesses and are not directed to children. We do not knowingly collect personal data from children under 16 through the Website or for our own purposes, and individuals under 16 may not create a UVX account. If we learn that we have collected such personal data, we will delete it. If you believe a child has provided us with personal data, please contact privacy@uvx.ai.

Customers are responsible for ensuring that any communications with children through their channels, and any processing of children's personal data in the Services, comply with applicable law, including any parental consent requirements.

15. Third-Party Websites and Services

The Website and the Services may link to, or integrate with, websites and services operated by third parties, including messaging channels and integrations. We are not responsible for the privacy practices of those third parties, and we encourage you to read their privacy policies.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our services, our practices or the law. When we do, we will post the updated version on this page and change the "Last Updated" date shown at the top of the page. If we make material changes, we will give reasonable notice, for example by email to Customers or through a notice in the UVX app, before the changes take effect.

17. Contact Us

If you have questions or concerns about this Privacy Policy or how we handle personal data, please contact us:

• Privacy enquiries and requests: privacy@uvx.ai
• General enquiries: info@uvx.ai
• Post: UVX Technologies FZE, Dubai Silicon Oasis, A5 GU004, Dubai, United Arab Emirates