English version 2026-09-25. Versioned copy. For privacy and contractual questions: vegalysuae@gmail.com.
Vegalys | Privacy Notice
Version: 2026-09-25
Provider: ALTAIR CONNECT - F.Z.E
Language: English only
Publication date: 25 September 2026
Status: Published Privacy Notice.
Privacy Notice
Who we are and how to contact us
Vegalys is operated by ALTAIR CONNECT - F.Z.E, a Free Zone Establishment - Limited Liability, licence and registration 53850, issued by the Free Zones Authority of Ajman. Our registered address is B.C. 1301562, Ajman Free Zone C1 Building, Ajman Free Zone, Ajman, United Arab Emirates.
For privacy questions or requests, contact vegalysuae@gmail.com with the subject “Privacy”. Do not send passwords, complete payment-card details or identity documents unless we request a proportionate verification through an appropriate channel.
What this notice covers
This notice covers visitors, business prospects, customer contacts and authorised account users when we decide why and how their personal data is processed, for example for account administration, billing, security and enquiries. We act as controller for those activities, subject to the applicable legal framework.
The initial business-data Service accepts genuinely anonymised datasets only, not identifiable or merely pseudonymised records. Customers must anonymise data before uploading it, including filenames, metadata and free text; removal of names alone is insufficient if individuals remain identifiable. This restriction does not make account emails, user information or billing contacts anonymous.
If a distinct activity lawfully requires personal-data processing on a Customer’s behalf, its own privacy information and our completed DPA govern that activity after its scope is approved. No personal business-dataset upload is authorised by this notice or by the existence of the conditional DPA framework. Questions about records processed on a Customer’s instructions should normally be directed to that Customer; we assist or route requests appropriately.
The initial offering is directed to business customers in the United Arab Emirates and European Union, not to children or personal consumer accounts. This intended audience does not remove the rights of individuals whose data is processed.
Information we process and where it comes from
| Category | Examples and source | Purpose |
|---|---|---|
| Business contacts | Name if provided, work email, company, role, correspondence; supplied by you or an authorised colleague | Answer enquiries, administer the business relationship and support |
| Account information | Email, password hash, verification/reset records, language preference and account timestamps; supplied or generated during use | Authenticate users, recover access and manage accounts |
| Subscription and billing | Billing contact/details, plan, Stripe customer/subscription references, status, invoice and payment records; supplied by the Customer and payment provider | Take authorised payments, issue invoices and administer renewals/cancellations |
| Technical and security information | IP address, browser/device information, request/error and security events where generated by the service/infrastructure | Deliver, troubleshoot and protect the Service |
| Transactional messages | Recipient address, message content and delivery metadata where supplied by the email provider | Verification, password recovery, service and billing communications |
| Customer-uploaded business content | Genuinely anonymised datasets and associated non-personal content only; not a permitted source of personal business records | Perform the contracted business workflow; account/contact metadata is assessed separately |
Payment-card details are entered through the payment provider’s hosted flow rather than a card-entry form operated by Vegalys. The application uses payment references and statuses; we do not ask users to email card details.
If a Customer or colleague supplies your business contact information, we use it for the relevant business/account purpose and provide the information required by applicable law. Mandatory account or billing fields are identified when requested; without necessary information we may be unable to create an account, provide access or complete a transaction.
Purposes and legal grounds
We use data only for specified purposes and on an available legal ground. Acceptance of commercial Terms is not blanket consent to all personal-data processing; where consent is required, it is requested separately and may be withdrawn without affecting the lawfulness of earlier processing.
For activities subject to the GDPR, the grounds depend on the activity and relationship:
| Activity | Ground, according to the actual relationship |
|---|---|
| Enquiries or a contract directly with an individual acting professionally | Requested pre-contractual steps or contract necessity, where the individual is the contracting party |
| Corporate contacts, employee accounts and ordinary service administration | Legitimate interests in communicating with the business and providing its requested service, after assessing necessity and the individual’s rights |
| Account/infrastructure security and fraud prevention | Legitimate interests in protecting users and the Service, subject to safeguards and any applicable legal duty |
| Invoice records and legally required responses | Compliance with an identified applicable legal obligation; otherwise another valid, documented ground |
| Optional marketing or non-essential tracking, if introduced | Separate consent where required; no such activity is authorised merely by accepting this notice |
| Separately approved processor activities | The Customer identifies its lawful basis; we follow its documented instructions and the DPA; initial business datasets must remain genuinely anonymous |
For processing governed by UAE law, we rely on consent or a specifically available exception, such as qualifying contract necessity, legal obligations or legal claims, according to the actual activity. GDPR legitimate interests are not automatically imported into the UAE framework.
Who receives data
Access is limited to authorised personnel and service providers who need the information for the specified purpose, under appropriate duties. Relevant categories are application/database/file hosting and backup providers, payment providers, transactional-email providers, the business-contact mailbox provider, and professional advisers or competent authorities where disclosure is justified.
We use Njalla for the VPS hosting our application, database and customer files. This describes the application infrastructure, not every recipient of account, payment or email data.
The current application design uses Stripe for payment flows, Resend for transactional email and a Gmail contact mailbox. The applicable entities, roles and safeguards depend on the activity and relevant provider terms. Payment providers may process some data as independent controllers, while a provider processing on our or the Customer’s instructions may act as processor; roles are assessed by activity, not assigned indiscriminately.
We do not authorise sale of Customer Data, advertising use of Customer-uploaded records or training of general-purpose AI models on those records. A restructuring or transfer of the business may involve necessary disclosures under confidentiality and applicable law; any new purpose requires its own lawful assessment and information.
International processing and safeguards
Our operator is established in the United Arab Emirates. Hosting, support access, payment processing and email delivery must each be considered separately when assessing international processing; this notice makes no promise that all categories remain in a single territory.
Where applicable, we will identify the relevant overseas recipients or categories, the countries or transfer circumstances necessary for meaningful information, and the safeguards relied upon. Information or a copy of applicable safeguards may be requested from our privacy contact, with appropriate redaction to protect third parties and sensitive security information without preventing effective exercise of rights.
Exact datacenter street addresses, server identifiers and security architecture are not included in this public notice. This presentation choice does not permit omission of required information about international disclosures or safeguards.
Retention
We retain personal data only for its justified purpose and applicable legal requirements, then delete it or irreversibly anonymise it. Closing paid access does not itself establish that every associated record has been deleted.
| Data category | Purpose-based retention rule |
|---|---|
| Anonymised business datasets and non-personal results, included for contractual clarity | During the subscription and for twelve months from the effective end of the final paid subscription period, then deletion; earlier valid deletion requests and lawful holds are addressed in the exit schedule |
| Account and access records | For the period needed to administer authorised access; afterwards, delete or irreversibly anonymise when no longer necessary. Minimal evidence is retained only where justified |
| Enquiries and support correspondence | Until resolution and afterwards only for necessary follow-up or legal claims; delete or irreversibly anonymise when that purpose ends |
| Billing, invoices and contract-acceptance evidence | For the duration required by applicable accounting, tax, evidence or claims requirements; retention is limited to the records needed for those purposes |
| Security and technical logs | Only for necessary operational, troubleshooting and security purposes; longer isolation only for a documented incident or legal need |
| Verification and reset records | For verification or account recovery and any justified security or evidence purpose; delete when no longer necessary. Link expiry is not a statement that the underlying record has been erased |
| Backups | Subject to the applicable deletion instructions and business-content deadline; deleted data is excluded from renewed operational use after restoration. A backup does not authorise indefinite retention |
The business-content period has been selected and starts when the final paid subscription period ends, not when cancellation is requested. It does not extend product access and is not a universal retention period for personal account information, invoices, passwords, support messages or logs. Any legally required hold is limited to the necessary records, purpose and duration, with access restricted.
If personal data is discovered in a dataset described as anonymous, we restrict the affected processing, notify the Customer and arrange secure deletion or other lawful handling. We assess applicable incident obligations rather than treating the “anonymous” label as conclusive.
Browser storage and optional technologies
The reviewed application uses browser storage for a session token and language preference where available, with an in-memory fallback when unavailable. The presentation website serves separate English and French pages; the reviewed website code does not include analytics or advertising scripts.
Browser storage can be cleared using browser controls, which may end a session or reset preferences. Clearing local storage does not itself delete server-side account data. Necessary technology and any optional tracking must be distinguished in the deployed inventory; optional tracking requiring consent must not operate before that consent.
Security and incidents
We use technical and organisational measures appropriate to the nature and risks of the processing, as documented in the completed security schedule. These include only controls actually implemented and maintained; no absolute security, end-to-end encryption, certification or numerical service-level guarantee is claimed by this notice.
If an incident involves your account, contact our privacy address without including passwords. We will investigate, take appropriate containment measures and make notifications required by the applicable regime. Where we act for a Customer, we notify and assist that Customer under the DPA.
The ordinary email-support commitment is a first response within two Business Days, as defined in the approved Terms. This is not a resolution guarantee and does not replace the shorter or otherwise applicable deadlines for incidents or individual rights.
Your rights and complaints
Depending on the applicable law and its conditions, you may have rights to information, access, correction, erasure, restriction, portability, objection, withdrawal of consent and review of certain automated decisions. These rights are not identical in every jurisdiction and may be subject to lawful exceptions.
Send requests to vegalysuae@gmail.com, identifying your relationship with Vegalys and the request. We may seek proportionate verification, but do not request excessive identity information. We respond within the applicable legal time limits and explain any permitted extension, refusal or charge.
You may complain to the competent supervisory authority without first completing our complaints process. Under the GDPR, this may be the authority of your habitual residence, place of work or alleged infringement; the language used by the website does not, by itself, determine the competent authority.
We do not authorise decisions based solely on automated processing that produce legal or similarly significant effects on individuals as part of the initial Service. If that scope changes, it requires an updated assessment, appropriate information and safeguards before activation.
Updates
This notice displays its publication date and version. We will explain material changes through an appropriate channel, and obtain a new legal basis or consent where required; publishing an update does not retroactively authorise a new purpose.