Privacy Policy

QAIZEN TECH DWC-LLC (“we”, “our”, or “us”), a company registered in Dubai South (DWC), United Arab Emirates, is committed to protecting and respecting your privacy.

This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website www.qaizen.io. This policy complies with the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL) and aligns with the European Union General Data Protection Regulation (GDPR) standards.

Please read this policy carefully. Each section states the legal basis on which we rely.

We collect minimal personal information, limited to what is strictly necessary for our business purposes:

2.1 Information You Provide Directly

When you submit one of our contact forms (“Talk to us about your AI pilot” in the Labs, “Let's Talk” or the form at the bottom of the home page) or contact us directly, we may collect:

• Full name
• Email address
• Company name
• Phone number, if you give it
• Your answers to the optional questions on budget, decision timeline and what is holding your pilot back
• Any additional information you choose to include in your message

2.2 Automatically Collected Information

When you visit our website, we may automatically collect:

• IP address (anonymized where possible)
• Browser type and version
• Device type and operating system
• Pages visited and time spent on each page
• Referring website address

Vercel Analytics (cookieless) measures page views and clicks on the site's buttons for everyone, with the campaign that brought the visit. Google Analytics 4 and Microsoft Clarity run only if you accept analytics cookies (see section 4).

2.3 Where Your Enquiry Came From

When you submit a form, we record the page you submitted it from, the domain of the website that referred you and any campaign tags in the link you followed (utm_*). We keep this with your enquiry, on the basis of our legitimate interest in knowing which channels bring enquiries (GDPR Art. 6(1)(f)). If you have accepted analytics, this information is kept in your browser's session storage until you close the tab, so that it survives a change of page. It is never used to track you across other websites.

2.4 Booking a Call

Our booking links open our scheduling page on Cal.com (Cal.com, Inc., United States), which books calls for us as our processor. It receives your name, e-mail address, the time you choose, your time zone and your answers to its questions, and the campaign tags of the link you came from (utm_*), never an ad click identifier. We use them to hold the call and to know which channels bring calls (GDPR Art. 6(1)(b), steps you ask for before a contract, and Art. 6(1)(f), our legitimate interest). We keep a booking until the call and its follow-up are over, and for at most 24 months. Cal.com processes data in the United States under Standard Contractual Clauses or the EU-US Data Privacy Framework. If your browser is set to a time zone in the Americas, the booking link opens the same calls on hours suited to the Americas; the time zone is read in your browser to choose the link, and it is neither stored nor sent to us.

The Labs tools (production readiness check, Shadow AI assessment, AI ROI calculator) score your multiple-choice answers, or compute the figures you type, without asking for your name. Please do not type confidential or personal information into the advisor chats.

• Production readiness check: your answers are scored in your browser and we do not store them. They travel only in the result link, after its “#”, which browsers do not send to a website. If an e-mail security tool rewrites that “#” and the link reaches our server, the server sends it straight back with the answers restored after the “#”; our hosting provider (Vercel) keeps the address of that request in its request log for one hour on our current plan, and at most a day. We only count, anonymously, that a check was started or completed and that its booking link was clicked: the counter keeps daily totals, with no answers, IP address or identifier. If you ask for your result by e-mail, your address and the result are sent to us and handled as described below for e-mail addresses given in the Labs.
• Stalled-pilot cost calculator: the amounts you type are computed in your browser and are not sent to us. If you accept analytics, we record only that a calculation was made, whether a business-case value was entered, a range of months stalled and the page language, never an amount. Microsoft Clarity session recordings mask the form and the result of this calculator, and the ROI estimator's results, whatever the recording settings.
• Agent replays: the recorded runs play in your browser, and no AI model runs while you watch. On the partner replay pages, if you accept analytics, we record that a run was played, the decision you took at the held exception (approve or decline) and whether the summary for your security reviewer was copied, with the scenario and the page language only: no text, amount or identifier. The summary itself is copied to your clipboard and never sent to us. Microsoft Clarity session recordings mask the end screen of these pages.
• AI analysis: when an AI analysis or roadmap is generated, and for any message you type in an advisor chat, your answers and messages are sent through OpenRouter (OpenRouter, Inc., United States) to an AI model provider (for example Anthropic, Google, OpenAI or xAI). We request zero-data-retention routing and refuse use for training. The model provider may cache the prompt for a few minutes to answer faster. Cloud hosts of these models may keep abuse-monitoring logs for up to 30 days, and in some cases up to 90 days.
• Generated text: each AI analysis (Shadow AI assessment or ROI calculator) is stored for 2 hours after it is generated, whether or not you use it, so that the advisor chat can build on it and an ROI analysis can be e-mailed to you on request. Each time the advisor chat or a request you send us reads it, the 2 hours start again, so it lasts as long as the conversation that uses it. Like a conversation, it is linked to a pseudonymised IP group and can only be read back from that group.
• Advisor conversations: your messages to an advisor chat and its replies are kept for 2 hours after your last message, linked to a pseudonymised IP group (a keyed hash of your IP address, or of its network prefix for IPv6, never the address itself). We keep them only so that the conversation can continue and so that it can be attached to a request you send us; after 2 hours they are deleted. A conversation you attach to a request is kept with that request, as described below.
• E-mail addresses given in the Labs: an e-mail address you enter to unlock or receive an analysis is kept as an enquiry, with the tool's result summary, and forwarded to us so that we can reply. We keep it until the enquiry is closed and for at most 24 months.
• Abuse protection: your IP address is used as a counter key to limit requests. Each counter expires at the end of its limit window, which is 24 hours at most, and is held by our database provider (Upstash, through Vercel). The basis is our legitimate interest in keeping the service secure (GDPR Art. 6(1)(f), Recital 49).
• Enquiries and e-mail: enquiries are stored in our database (Upstash, through Vercel) and e-mails are delivered by Resend (Resend, Inc., United States).

We use the information we collect exclusively for the following purposes:

• To respond to your consultation requests and inquiries
• To communicate with you about our services
• To send you relevant information you have requested
• To improve our website functionality and user experience
• To comply with legal obligations under UAE law

Important: We do not sell, rent, trade, or otherwise transfer your personal information to third parties for marketing purposes. Your data is never monetized.

4.1 Strictly Necessary

Your cookie choice is remembered in your browser's local storage so that we do not ask again on every page. When you open the booking page from the end of a partner replay, that page keeps a short note in this tab's session storage (the scenario, your decision and that the replay had ended) so that the Back button brings you to the same end screen; it is read once and deleted, and the browser deletes it when the tab closes. When you read the site in a language other than your browser's (a page you opened in that language, or the language of an ad you followed), a session cookie, NEXT_LOCALE, keeps that language for the rest of your visit; it holds only the language code and is deleted when you close the browser. None of these needs consent.

4.2 Analytics (Only With Your Consent)

Nothing below is loaded before you click “Accept” in the banner. You can withdraw at any time with “Cookie settings” at the bottom of every page.

• Google Analytics 4 and Google Tag Manager (Google Ireland / Google LLC): visit statistics; cookies _ga and _ga_* (up to 2 years); data kept for the retention period set in our Google Analytics account (2 to 14 months).
• Microsoft Clarity (Microsoft): anonymised session analytics; cookies _clck (1 year) and _clsk (1 day).

4.3 Without Cookies

Vercel Analytics and Vercel Speed Insights count page views and clicks on the site's buttons (which button, and the campaign tag that brought the visit) and measure page speed, without cookies or personal identifiers; they run for every visitor.

Google and Microsoft may process data in the United States; both are certified under the EU-US Data Privacy Framework and its UK extension.

We implement appropriate technical and organisational measures to protect your personal data against unauthorised or unlawful processing, accidental loss, destruction, or damage. These measures include:

• Encryption of data in transit using TLS/SSL protocols
• Secure hosting infrastructure provided by Vercel
• Regular security assessments and updates
• Access controls limiting data access to authorised personnel only

When a page on this site tries to load something our Content Security Policy does not allow, your browser may report it to us; these reports are stored only as daily counts of the rule concerned, the blocked host and the kind of page (such as “a blog post”), with no IP address and no full URL, and are kept for 35 days.

Under UAE PDPL and GDPR (where applicable), you have the following rights regarding your personal data:

• Right of Access: Request a copy of the personal data we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete data.
• Right to Erasure: Request deletion of your personal data.
• Right to Data Portability: Receive your data in a structured, commonly used format.
• Right to Withdraw Consent: Withdraw your consent at any time.
• Right to Object (GDPR Art. 21): Object at any time to processing based on our legitimate interest, including direct marketing, which then stops.
• Right to Lodge a Complaint: Complain to your data protection authority.

To exercise any of these rights, please contact us at contact@qaizen.io. We will respond to your request within 30 days.

We run a regular, small-volume outreach programme (a few messages per week) to professionals whose role relates to putting AI systems into production, to present our consulting services. This section is the detailed notice referred to in those messages.

Your right to object: you can object to any further contact at any time. Reply "stop" or write to contact@qaizen.io and we will not contact you again.

• Data: name, job title, employer, work e-mail address and public professional profile URL, plus the public job posting that prompted the contact.
• Sources: public job postings and B2B contact directories (for example Icypeas, Dropleads, LeadMagic, Trykitt, Tomba, Findymail, QuickEnrich, Leadsforge or Moltsets), accessed through the Treg data platform. The message names the directory used.
• Purpose and legal basis: presenting a service related to your role, on the basis of our legitimate interest (GDPR Art. 6(1)(f)): the direct marketing of our B2B services to professionals whose role they concern. We rank prospects automatically by company fit and public hiring signals; this ranking has no legal or similarly significant effect on you. Messages are drafted with software from public data, then reviewed and sent individually by a person; no automated decision is made about you.
• Retention: if we do not contact you, your data is deleted within 7 days of the planned outreach (14 days at most). If we contact you, it is deleted 3 years after collection or after your last reply to us, whichever is later. If you reply "stop", we delete your details from our prospecting records at once; we keep only a keyed hash of your e-mail address, profile URL and name, for as long as we prospect, so that we never contact you again, and our exchange stays in our mailbox for up to 3 years as evidence of your objection.
• Your rights: besides objecting, you may request access, rectification, erasure, restriction or portability of your data, and complain to your data protection authority (for example the CNIL in France, the ICO in the UK, the Autoriteit Persoonsgegevens in the Netherlands or the Data Protection Commission in Ireland).
• Recipients and location: QAIZEN TECH DWC-LLC is the controller and processes the data in the United Arab Emirates, a country without an EU or UK adequacy decision; access is restricted to authorised personnel. Processors acting for us: the Treg data platform (contact lookups) and Google Workspace (our mailbox). LinkedIn, when we write to you there, is an independent platform acting under its own privacy notice. The directories named in the message are independent sources that supply the data under their own privacy notices. We have not yet appointed a representative in the EU or the UK under Art. 27 GDPR / UK GDPR.

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: