Privacy Policy — UAE Business Circle

1. Introduction

This Privacy Policy explains how UAE Business Circle ("we", "us") collects, uses, shares and protects personal data when you use our platform, apply for membership, attend our events, or contact us.

We process personal data in accordance with UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data and applicable implementing regulations.

2. The data we collect

2.1 Data you give us

Account & profile: name, email address, phone number (UAE numbers only), password (stored hashed — never in plain text), company, job title, industry, location, biography, tags, profile and cover images.
Business listing: business name, description, categories, location, business contact details, logo, cover image and gallery images.
Membership application: the information you submit on the application form, including your motivation for joining.
Trade licence: your licence number and the document you upload for verification.
Communications: messages you send to other members, contact form enquiries, and correspondence with us.

2.2 Data we generate

Connections, event registrations and tickets.
Profile view counts (where enabled by your membership tier).
Notifications and email delivery records.
Login timestamps and security data (failed login attempts, lockouts).

2.3 Payment data

Payments are processed by Stripe. We receive confirmation of a payment, its amount, and an identifier — we do not receive or store your full card number. Stripe's handling of your data is governed by Stripe's own privacy policy.

3. Why we use your data

To create and operate your account and membership.
To review and decide on your membership application.
To display your profile and business listing to other members and, where verified and published, to the public.
To enable networking, connections and messaging between members.
To take payment, manage subscriptions and issue refunds.
To register you for events and issue tickets.
To send service emails (verification, approval, receipts, event confirmations, security notifications).
To send newsletters and platform updates, where you have not opted out.
To keep the Platform secure and to prevent abuse.
To comply with our legal obligations.

4. What is public

Please read this section carefully — some information is publicly visible on the internet:

A verified business listing is public, including the business contact details you publish (email, phone, website, social links) and its images and description.
Your member profile is visible to other logged-in members. You can control aspects of this from Settings → Privacy, including whether you appear in the directory and who may see your contact details.

Do not publish contact details you do not want to be public.

5. Who we share data with

We share personal data only with service providers who help us run the Platform:

Stripe — payment processing.
Resend — transactional and newsletter email delivery.
Supabase — file and image storage.
Pusher — real-time messaging and notifications.
Railway / cloud hosting — application and database hosting.

We do not sell your personal data. We may disclose data where required by law, or to establish, exercise or defend legal claims.

6. International transfers

Some of our service providers process data outside the UAE. Where personal data is transferred outside the UAE, we take steps to ensure an appropriate level of protection as required by applicable law.

[LEGAL REVIEW: confirm the transfer basis and list the processing regions.]

7. How long we keep data

We keep your personal data for as long as your account is active. If you delete your account, we permanently delete your profile, business listing, trade licence, messages, connections, notifications and uploaded files.

We may retain certain records for longer where required for legal, accounting or fraud-prevention purposes — in particular, records of payments and refunds.

8. Your rights

Subject to applicable law, you have the right to:

Access the personal data we hold about you. You can request a full export of your data from Settings → Danger Zone → Request Data Export.
Correct inaccurate data — most of it you can edit directly from your profile.
Delete your account and data, from Settings → Danger Zone → Delete Account. This is permanent.
Object to or restrict certain processing.
Withdraw consent to marketing at any time — every newsletter contains an unsubscribe link, and you can turn newsletters off in Settings → Notifications.

To exercise a right we cannot service in-product, contact us.

9. Security

We protect your data with measures including: passwords stored using strong one-way hashing; short-lived access tokens with rotating refresh tokens; account lockout after repeated failed logins; encrypted connections (HTTPS); and restricted administrative access.

No system is perfectly secure. If we become aware of a breach affecting your personal data, we will notify you and the relevant authority as required by law.

10. Cookies and similar technologies

We use strictly necessary storage to keep you signed in (an access token in your browser's local storage, and a secure, HTTP-only refresh-token cookie). We use [ANALYTICS PROVIDER] to understand how the Platform is used.

[LEGAL REVIEW: complete this section to match the analytics actually deployed.]

11. Children

The Platform is not intended for anyone under 18, and we do not knowingly collect their personal data.

12. Changes to this policy

We may update this policy. Where changes are material we will take reasonable steps to notify you.

13. Contact us

For any privacy question, or to contact our data protection contact, please get in touch.

[LEGAL REVIEW: add the registered entity name, address and DPO/contact email.]