Legal

Privacy Policy

Last updated: October 2026

1. Who We Are

DeepSolve Tech Limited ("DeepSolve", "we", "us") is an AI consultancy and product company licensed in the Dubai International Financial Centre (DIFC). This Privacy Notice describes how we collect, use, share, and protect personal data in connection with our services and our website at www.deepsolve.io.

Our registered details:

  • Legal name: DeepSolve Tech Limited
  • DIFC Commercial Licence: CL10387 (issued 30 April 2026)
  • Registered address: Unit IH-00-01-02-OF-01, Level 2, Innovation One, Dubai International Financial Centre, Dubai, UAE
  • Mailing address: PO Box DeepSolve – 506983, Dubai, UAE
  • Privacy contact: info@deepsolve.io

Where you are located in the European Economic Area or the United Kingdom, we also aim to meet the standards of the EU General Data Protection Regulation (GDPR) and UK GDPR in addition to UAE PDPL and DIFC DPL.

2. Scope

This Privacy Notice applies to:

  • Visitors to www.deepsolve.io and other DeepSolve-operated public web pages.
  • Prospective clients, clients, and partners with whom we communicate or do business.
  • Suppliers and service providers who provide services to us.
  • Job applicants and other individuals who interact with DeepSolve.
  • DeepSolve personnel (employees and contractors), in respect of the personal data DeepSolve processes about its own workforce — including managed-device telemetry from company-issued laptops, M365 sign-in and activity logs, MFA registration, and HR records.

3. The Data We Collect

We may collect the following categories of personal data:

  • Identity and contact details: name, professional role, employer, work email address, work phone number, postal address.
  • Communications: emails, messages, meeting recordings (with consent), call notes.
  • Engagement data: information shared by clients during consulting engagements, which may include personal data of the client's employees or end-users where contractually agreed.
  • Website data: technical metadata (IP address, browser type and version, operating system, device type, screen resolution); aggregated traffic data (pages visited, referrer, time spent on page, click interactions, scroll depth); and, only with your consent, anonymised session replays of your interactions with the site (mouse movements, clicks, scrolling). The specific analytics technologies we use are described in Section 10.
  • Enquiry data: when you submit our contact form or request a readiness report, how you found us (campaign tags in the link you followed, the address of the referring website, and the first page you visited), the topic of any link you followed to the form, your optional answers about your area of interest, timeline and organisation size, and, for the readiness assessment, your answers and the resulting scores.
  • Recruitment data: where you apply for a role with us, your CV, work history, references, and right-to-work documentation.
  • Personnel data (for DeepSolve employees and contractors): identity details (Entra ID account, name, role), M365 sign-in and activity logs, managed-device telemetry (Microsoft Intune and Defender for Business), security event logs, MFA registration data, leave and time records, and HR records.

We do not knowingly collect personal data of children under 18.

4. How We Use Personal Data and the Legal Basis

We use personal data only for specified, lawful purposes. Our processing is governed by UAE Federal Decree-Law No. 45 of 2021 on Personal Data Protection ("UAE PDPL") and the DIFC Data Protection Law 2020 ("DIFC DPL"). Under Article 10 of the DIFC DPL (and, where applicable, Article 6 of the EU GDPR / UK GDPR), we rely on the following lawful bases:

  • Performance of a contract — to deliver consulting and product services to our clients, manage our supplier relationships, respond to your contact-form submissions, send the readiness reports you request, and answer your requests.
  • Consent — for marketing communications, optional cookies, PostHog analytics, session replay recordings, and OpenAI ad measurement. You may withdraw consent at any time without affecting the lawfulness of processing before withdrawal.
  • Legitimate interests — to operate, maintain, secure, and improve DeepSolve and its services; to detect and prevent fraud and security incidents; to rate-limit by IP address to prevent abuse; for aggregated, anonymised website analytics (Vercel Web Analytics) and performance monitoring (Vercel Speed Insights); and to manage prospective business relationships, including understanding which channels and content lead to enquiries and prioritising follow-up based on the optional answers you give. This prioritisation is internal and has no legal or similarly significant effect on you.
  • Legal obligation — to meet our obligations under UAE law (including tax, anti-money-laundering, and corporate-compliance), DIFC regulations, applicable customer contracts, and employment law in respect of personnel data.

For DeepSolve personnel and contractors specifically, the predominant lawful bases for processing are performance of the employment or engagement contract, our legitimate interests in operating and securing the business (including security monitoring, audit trails, and incident detection), and legal obligations under UAE employment, tax, and applicable regulations.

5. How We Share Personal Data

We share personal data only as needed to deliver our services and operate our business:

  • Service providers — including Microsoft (Microsoft 365, including Microsoft Bookings for meetings you choose to book with us, and Azure), GitHub, Microsoft Teams, OpenAI, Anthropic, Vercel (website hosting, cookieless analytics, and performance monitoring — vercel.com/legal/privacy-policy), Neon (database hosting for contact-form and readiness-assessment submissions, Frankfurt EU region — neon.com/privacy-policy), PostHog (consent-based analytics and session replays, EU region — posthog.com/privacy), the corporate password-manager vendor, and Emirates Post (mailing). Each provider is bound by a data-processing agreement and processes personal data only on our instructions and only for the purposes we have authorised.
  • Clients — where personal data is part of a deliverable provided to a client, sharing is limited to the named engagement team.
  • Authorities — where required by law, regulation, court order, or competent authority.
  • Advisors — our legal, accounting, and audit advisors, under confidentiality obligations.

We do not sell, trade, or rent personal data. We do not use personal data to train Large Language Models (LLMs) without specific, informed consent from the data subject or contractual permission from the controller.

6. Cross-Border Transfers

DeepSolve has personnel based in the UAE and offshore locations (current locations are recorded in DST-ISMS-AST-001). Where UAE-origin personal data is processed by personnel based outside the UAE, the transfer is treated as a cross-border transfer under UAE PDPL and DIFC DPL. We rely on contractual safeguards (the Information Security & Confidentiality Addendum signed by all DeepSolve personnel) and on the law of the destination country to provide adequate protection.

Some of our service providers (Microsoft, GitHub, OpenAI, Anthropic) host data in jurisdictions outside the UAE / DIFC. We rely on each provider's published data-processing terms, including the EU Standard Contractual Clauses where they apply, and on DPA/processing addenda where available.

We rely on the following transfer mechanisms under the DIFC DPL: (a) Adequacy (Article 26 DIFC DPL) — for transfers to jurisdictions on the DIFC adequacy list, including the European Economic Area where some of our processors are based (Neon in Frankfurt, PostHog in the EU); (b) DIFC Standard Contractual Clauses (Article 27 DIFC DPL) — for transfers to jurisdictions not on the adequacy list (Microsoft 365, Vercel, GitHub, OpenAI, Anthropic), supplemented by a transfer impact assessment where required. Where you are located in the EEA or the UK, equivalent safeguards (EU SCCs, the UK International Data Transfer Agreement, or recognised adequacy decisions) apply to transfers of your data to these providers.

7. Retention

We retain personal data only as long as necessary for the purpose for which it was collected, plus the period required by law or contract:

  • Prospect and marketing contact data — until you ask us to remove it, or 3 years from last contact, whichever is earlier.
  • Client engagement data — for the duration of the engagement plus the period required by the engagement contract (typically 7 years for contracts and supporting records).
  • Supplier records — for the duration of the relationship plus 5 years.
  • Recruitment data — for 12 months for unsuccessful candidates (with consent), and for the duration of employment plus 5 years for successful candidates.
  • Website analytics — typically 14 months.
  • Contact-form and readiness-assessment submissions, with the enquiry data and IP address stored alongside — 12 months from date of submission, after which permanently deleted from the database and cannot be recovered.
  • Session replay recordings (PostHog) — 30 days, after which automatically deleted.
  • Email notifications of contact-form and assessment submissions in our team mailbox — same 12-month retention as the underlying form submission.

Detailed retention is documented in our internal Records Retention Schedule (DST-ISMS-RET-001).

8. Security

We protect personal data using administrative, technical, and physical safeguards proportionate to the sensitivity of the data, including: multi-factor authentication, encryption in transit and at rest, role-based access controls, security awareness training, supplier security review, and an incident response capability. We are pursuing certification to ISO/IEC 27001:2022, the international standard for information security management.

Contact-form and readiness-assessment submissions are stored in a secure, encrypted PostgreSQL database hosted by Neon in the European Union (Frankfurt). Access is restricted to authorised team members under role-based access controls and secure authentication. Each submission is stored alongside the enquiry data described in Section 3 and the submitter's IP address, which is used solely for rate limiting and abuse prevention. A notification email containing your submission (and any optional answers you give afterwards) is sent to our internal team mailbox via Microsoft 365 (Outlook) using Microsoft Graph over HTTPS; this email is accessible only to authorised team members.

9. Your Rights

Subject to UAE PDPL and DIFC DPL (Articles 32–38 of the DIFC DPL), and where applicable the EU GDPR and UK GDPR, you have rights in relation to your personal data, including:

  • Right of access — to know what personal data we hold about you and how we process it.
  • Right of rectification — to have inaccurate or incomplete personal data corrected.
  • Right to erasure — to have your personal data deleted in certain circumstances.
  • Right to restrict or object to processing — including the right to object to direct marketing.
  • Right to data portability — to receive your personal data in a structured, machine-readable format.
  • Right to withdraw consent — where processing is based on consent.
  • Right to lodge a complaint — with the UAE Data Office (under PDPL) or the DIFC Commissioner of Data Protection (commissioner@dp.difc.ae; dp.difc.ae). If you are located in the EEA or the UK, you may also lodge a complaint with the data protection authority in your country of residence.

To exercise any of these rights, please contact us at info@deepsolve.io. We will respond within the timeframes set out in the applicable law (typically 30 days).

10. Cookies and Similar Technologies

Our website uses your browser's localStorage to remember your analytics and ad measurement preferences. It also uses sessionStorage to remember, for the current visit only, how you arrived (campaign tags, referring website, first page, and the topic of any link you followed to the contact form). This is cleared when you close the tab and leaves your browser only if you submit the contact form or request a readiness report. We use the following analytics and measurement tools:

  • Cookieless analytics and performance monitoring (Vercel Web Analytics + Vercel Speed Insights): aggregated traffic patterns and site-performance metrics. These tools do not set cookies, do not use localStorage, and do not store personal identifiers; your IP address and User-Agent are processed transiently to derive an anonymised daily-rotating hash and your approximate country. The IP is not stored, and visitors cannot be tracked across days or across sites. Lawful basis: legitimate interests.
  • Consent-based detailed analytics and session replays (PostHog): we collect anonymised usage data and record session replays only after you click "Accept" on our consent banner. PostHog uses localStorage (not cookies) for persistence. Session replays capture mouse movements, clicks, and scrolling; all text input into form fields is masked by default to exclude personal data. Replays are retained for 30 days. If you click "Decline" no usage data is collected and no sessions are recorded. Lawful basis: consent.
  • Consent-based ad measurement (OpenAI): after you accept, the OpenAI measurement pixel records successful contact enquiries to help us understand which ads lead to contact requests. It receives the event type, a random event identifier, the website origin, and browser and ad-click identifiers. Our event code does not send the content of your message or assign a monetary value to your enquiry. If automatic advanced matching is enabled in Ads Manager, the pixel can also hash supported contact information in your browser to match conversions. OpenAI's first-party attribution cookies can last up to 30 days for an ad-click reference and 365 days for a browser reference, subject to browser restrictions. We send events with the option to opt out of future user-level personalization. Measurement remains off unless you accept it, including if you previously accepted analytics before ad measurement was introduced.
  • You can change your choice at any time using Cookie preferences in the footer. Declining stops optional analytics and future ad measurement and instructs the OpenAI pixel to remove its attribution cookies. The contact form works regardless of your choice.

11. Children

Our services are intended for businesses and professionals. We do not knowingly collect personal data of individuals under 18. If you believe we may have collected such data, please contact us at info@deepsolve.io and we will take steps to delete it.

12. Changes to This Notice

We may update this Privacy Notice from time to time to reflect changes in our processing activities, in technology, or in applicable law. The version date at the top of this Notice indicates when it was last updated. Material changes will be communicated by reasonable means (such as a notice on the website or by direct communication where appropriate).

13. Contact Us

If you have any questions about this Privacy Notice or our handling of personal data, please contact:

  • Email: info@deepsolve.io
  • Postal: DeepSolve Tech Limited, PO Box DeepSolve – 506983, Dubai, UAE
  • Or write to the Founder & ISMS Owner via the contact form on www.deepsolve.io