Privacy Notice

1. Introduction

This Privacy Notice explains how Beyond Consultancy LLC-FZ (Meydan Free Zone, Dubai, UAE) handles your data when you use AI Mediation. We collect as little as possible, and we never sell personal data and never use your conversations to train AI models.

2. Privacy-first design

The Service is built to minimise data: there are no accounts, messages are encrypted with AES-256-GCM at rest, and every session and its messages are automatically deleted 30 days after the session closes (you'll get an export reminder beforehand, and you can delete sooner at any time). There is no advertising, no profiling, and no sale of your data.

3. What we collect

• your messages (encrypted, and deleted on the schedule above);
• the display name you choose;
• session, role, invite, and recovery identifiers;
• your consent and payment status (a flag plus Paddle's transaction reference);
• minimal security and technical data needed to run the Service (CSRF tokens, rate-limit counters, abuse prevention).

We do not intentionally collect special-category data — please do not share more than you need to.

4. What we do NOT collect or do

We do not collect or store your card details — Paddle holds those. We do not sell your data, and we do not use your conversations to train AI models.

5. AI processing (OpenAI as sub-processor)

To generate responses, your messages are sent to OpenAI under its API terms (API-tier data is not used to train OpenAI's models). This processing may take place outside the UAE.

6. Payments (Paddle as Merchant of Record)

Paddle — not us — collects and processes your card and billing data and calculates, collects, and remits any applicable tax or VAT. We receive only a success confirmation and a transaction reference.

7. Legal bases

We process your data to perform our contract with you, on the basis of your consent, and for our legitimate interests in keeping the Service secure and free from abuse.

8. Retention

Mediation content is deleted 30 days after a session closes. Limited payment records are retained by us and by Paddle as required for legal, tax, and accounting purposes.

9. Sharing

We share data only with OpenAI (AI processing), Paddle (payments and Merchant of Record), and the hosting providers strictly necessary to run the Service. We may also disclose data where required by law or to protect safety. We share nothing else.

10. International transfers

The Service is operated from the UAE, and our providers may process data elsewhere under appropriate safeguards.

11. Your rights

You may access, correct, delete, export, or object to the processing of your data, and withdraw consent. Export and deletion are already available to you in the app; for any other request, email us. We will respond within a reasonable time.

12. Children

The Service is for adults aged 18 and over only.

13. Security

We protect your data with AES-256-GCM encryption at rest, the information barrier in shuttle mediation, CSRF protection, and prompt scheduled deletion.

14. Changes

We may update this Privacy Notice from time to time and will revise the "Last updated" date above.

15. Contact

Controller: Beyond Consultancy LLC-FZ · Meydan Grandstand, 6th Floor, Meydan Road, Nad Al Sheba, Dubai, UAE · info@beyondconsultancy.ae