Privacy Notice

1. Introduction

This Privacy Notice explains how Beyond Consultancy LLC-FZ (Meydan Free Zone, Dubai, UAE) handles your data when you use AI Mediation. We collect as little as possible, and we never sell personal data and never use your conversations to train AI models.

2. Privacy-first design

The Service is built to minimise data: there are no accounts, messages are encrypted with AES-256-GCM at rest, and every session and its messages are automatically deleted 30 days after the session closes (you'll get an export reminder beforehand, and you can delete sooner at any time). There is no advertising and no sale of your data. The only automated profiling is the short communication-style note described in section 5, used solely to tailor replies within your own session.

3. What we collect

• your messages (encrypted, and deleted on the schedule above);
• the display name you choose;
• session, role, invite, and recovery identifiers;
• your consent and payment status (a flag plus Paddle's transaction reference);
• minimal security and technical data needed to run the Service (CSRF tokens, rate-limit counters, abuse prevention).

We do not intentionally collect special-category data — please do not share more than you need to.

4. What we do NOT collect or do

We do not collect or store your card details — Paddle holds those. We do not sell your data, and we do not use your conversations to train AI models.

5. AI processing and sub-processors

To generate responses, your messages and the relevant conversation context are sent to third-party AI providers acting as our sub-processors:

• Anthropic (Claude models), our primary AI provider, reached through a third-party AI routing service that passes requests between us and Anthropic; and
• OpenAI, used only as a fallback when the primary provider is unavailable.

These providers process your messages only to return a response to us, under their own commercial API terms, and may keep request data for a limited period under those terms (for example for abuse monitoring or legal compliance). Their retention is outside our control and is not covered by our 30-day deletion schedule. We send the minimum needed to produce each response. Processing may take place outside the UAE, including in the United States.

To keep replies relevant, the Service also keeps a short, AI-generated note about how each participant communicates (for example tone and what helps them feel heard). It stays within your session, is never shown to the other person, is never used for any other purpose, and is deleted with the session. The AI also checks messages for signs of crisis so it can point you to emergency resources; this is automated, not human monitoring.

6. Payments (Paddle as Merchant of Record)

Paddle — not us — collects and processes your card and billing data and calculates, collects, and remits any applicable tax or VAT. We receive only a success confirmation and a transaction reference.

7. Legal bases

We process your data to perform our contract with you, on the basis of your consent, and for our legitimate interests in keeping the Service secure and free from abuse.

8. Retention

Mediation content is deleted 30 days after a session closes. Limited payment records are retained by us and by Paddle as required for legal, tax, and accounting purposes.

9. Sharing

We share data only with our AI sub-processors listed in section 5 (Anthropic, the AI routing service, and OpenAI as fallback), Paddle (payments and Merchant of Record), and the hosting providers strictly necessary to run the Service. We may also disclose data where required by law, to respond to valid legal process, or where we believe in good faith that disclosure is needed to protect someone's life or safety. We may change sub-processors; when we do, we will update this notice.

10. International transfers

The Service is operated from the UAE. Our AI, payment, and hosting providers may process data in other countries, including the United States, where data-protection laws may differ from yours. By using the Service you acknowledge these transfers, which we make under the providers' contractual terms and safeguards.

11. Your rights

You may access, correct, delete, export, or object to the processing of your data, and withdraw consent. Export and deletion are already available to you in the app; for any other request, email us. We will respond within a reasonable time.

12. Children

The Service is for adults aged 18 and over only.

13. Security

We protect your data with AES-256-GCM encryption at rest, the information barrier in shuttle mediation, CSRF protection, and prompt scheduled deletion. No system is completely secure, and data must be decrypted to be processed by the AI providers in section 5; we cannot guarantee absolute security. In a joint mediation, everything you write is visible to the other participant, who may copy or share it — we cannot control what another participant does with it.

14. Changes

We may update this Privacy Notice from time to time and will revise the "Last updated" date above.

15. Contact

Controller: Beyond Consultancy LLC-FZ · Meydan Grandstand, 6th Floor, Meydan Road, Nad Al Sheba, Dubai, UAE · [email protected]