Privacy policy

Last updated:

How Elcara collects, uses and protects personal data when you use elcara.ai and when we deliver Freya and our AI services to client businesses.

1. Who we are

Elcara L.L.C-FZ (“Elcara”, “we”, “us”) is an applied AI lab. We work inside client businesses, connect their systems and build AI that runs business functions. Our main product is Freya, an AI chief of staff.

Our registered address is Meydan Grandstand, 6th floor, Meydan Road, Nad Al Sheba, Dubai, UAE. We are licensed by the Meydan Free Zone, Dubai, under trade licence number 2422258.01.

This policy explains how we handle personal data when you visit our website, elcara.ai, or contact us. Section 7 covers data we handle when we deliver services to clients.

For the data described in sections 2 to 6, we are the controller. That means we decide why and how the data is used.

2. What we collect

The website has no forms and no accounts. We collect personal data in these ways only.

When you contact us. If you email [email protected] or call +971 54 747 8989, we receive what you send: your name, email address or phone number, your company, and what you write or say.

When you book a call. The booking calendar on our contact page is run by Cal.com. Your browser loads it from Cal.com when you reach the booking window on that page; every “Book a call” button on the site leads there. From then on, Cal.com receives your IP address and device data. When you book, Cal.com collects your name, email address, the time you pick and any notes you add, and passes them to us so we can hold the call. Calls take place on Google Meet, so Google receives the meeting details and processes the call.

When you browse the site. Our hosting provider, Cloudflare, processes your IP address and request data (such as the page asked for, the time, your browser and the referring site) to deliver pages and to protect the site from attacks. Cloudflare also hides our email address from spam robots with a small script.

Site statistics. We use Cloudflare Web Analytics. It counts page views and records the page, the referring site, browser type, device type and country. It does not use cookies or other storage on your device, and it does not build a profile of you or follow you across other sites.

On your device only. If you press “Pause motion” or “Play motion” on the site, your browser saves that choice in its local storage under the name elcara-still. It stays on your device. We never receive it. You can delete it by clearing your browser’s site data.

Our fonts load from our own site, not from Google Fonts or another font service. The “Map” links open Google Maps only when you click them; Google’s own policy then applies.

We do not ask for sensitive data through the website. Please do not send it to us.

You do not have to give us personal data. If you do not, we cannot reply to you or hold a call.

3. Why we use it

We use personal data to:

  • reply to your messages and calls
  • arrange and hold calls you book
  • talk with you about working together, if you asked us to
  • understand how the site is used, in total, so we can improve it
  • keep the site secure and working
  • meet legal duties and handle legal claims

We do not use your data for automated decisions that have legal or similarly significant effects on you.

The legal basis we rely on depends on where you are and what you are doing.

In the UAE. The UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021, the PDPL) lets us process personal data without consent in the cases its Article 4 lists. We rely on:

  • steps you ask for before a contract (Article 4 of the PDPL), when you email us, call us, ask about our services or book a call
  • keeping data secure as the law requires, for the request logs that protect the site from attacks
  • legal duties, for records we must keep by law

Our site statistics are aggregate counts that are not linked to a person.

In the EU and UK. If you are in the EU or UK, we apply the standard of the GDPR and UK GDPR to your data. Under Article 6 of the GDPR, we rely on:

  • steps before a contract (Article 6(1)(b)), when you ask about our services or book a call
  • legitimate interests (Article 6(1)(f)), to reply to general messages, to count visits in total and to keep the site secure; these uses have little impact on you, and you can object to them
  • legal obligation (Article 6(1)(c)), for records we must keep by law

5. Cookies and similar technology

Our website sets no cookies. Our statistics are cookieless. The only item the site stores on your device is the elcara-still choice described in section 2, which stays on your device.

Our contact page includes the Cal.com booking calendar. Every “Book a call” button opens this calendar, which loads Cal.com and may set a Cal.com security cookie. To avoid it, email or call us. Cal.com’s cookie and privacy policies cover that cookie.

Because of this, we do not show a cookie banner.

6. Who we share it with

We do not sell personal data. We do not share it for advertising.

We share data only with service providers who help us run the site and our business, and only as far as they need it:

  • Cloudflare, Inc. hosts the site, protects it from attacks and provides our cookieless statistics (Cloudflare Pages and Cloudflare Web Analytics)
  • Cal.com, Inc. runs the booking calendar on our contact page
  • Google hosts our calls on Google Meet
  • Zoho Corporation runs our email at elcara.ai
  • our telephone operator carries calls and messages to our phone number

We may also share data with advisers, auditors or authorities when the law requires it, or with a buyer if our business is sold or merged.

7. Data we handle when serving clients

Our clients are businesses. When a client hires us, Freya and the systems we build work inside that client’s tools. These can include Slack or Microsoft Teams, email, calendars, documents and other business systems.

In that work, Freya may process personal data held in the client’s workspace. This can include messages, emails, files and contact details of the client’s staff, customers and partners. Freya uses this data to remember context, research, write reports and handle email. Freya asks a person at the client to approve emails, payments, sign-ups, posts and deletions before they happen.

For this data:

  • the client is the controller and decides what Freya can access and why
  • we act as a processor and follow the client’s instructions
  • a separate client agreement and data processing agreement (DPA) sets the rules

If your data is in a client’s workspace and you want to use your rights, please contact that client first. We will help them respond.

Sub-processors

To deliver our services we use sub-processors. These include providers of AI models, cloud hosting and storage. We list them in our client DPA and tell clients before we add new ones.

8. International transfers

We are based in the UAE. Our providers process data outside the UAE. Cloudflare, Cal.com and Google are based in the United States, and Cloudflare serves the site from data centres around the world. Our email is hosted in Zoho’s United States data centre.

When data leaves the UAE, we transfer it only as the PDPL allows: to countries with adequate data protection, or with the safeguards the law accepts, such as contract terms that protect the data. When data from the EU or UK leaves those areas, we rely on an adequacy decision (including the EU-US Data Privacy Framework, for providers certified under it) or on standard contractual clauses. Email [email protected] for a copy of these safeguards.

9. How long we keep it

We keep personal data only as long as we need it.

  • Messages and enquiries: up to 24 months after our last contact, unless we start working together
  • Booking records: up to 24 months after the call
  • Statistics: stored in total form, not linked to you
  • Records we must keep by law: for the period the law sets

Client data processed under section 7 is kept and deleted as the client agreement sets out.

10. How we protect it

We use reasonable technical and organisational measures to protect personal data. These include encryption in transit, access controls, least-privilege access for our team and for Freya, and approval steps before Freya acts outside a client’s systems.

No system is perfectly secure. If a breach puts your data at risk, we will tell the UAE Data Office and, where the law requires it, you. For data covered by the GDPR or UK GDPR, we will tell the relevant supervisory authority within 72 hours where those laws require it, and tell you without undue delay if the risk to you is high.

11. Your rights

The rights you have depend on the law that applies to you.

In the UAE. The PDPL applies to us. It does not apply in free zones that have their own data protection law, such as the Dubai International Financial Centre (DIFC) and Abu Dhabi Global Market (ADGM). We are licensed in the Meydan Free Zone, which has no such law of its own. Under the PDPL, you have the right to:

  • get information about how we process your data
  • ask us to correct inaccurate data
  • ask us to delete your data, in the cases the law sets
  • ask us to restrict or stop processing it
  • receive your data and move it to another controller, in the cases the law sets
  • object to decisions made only by automated processing
  • complain to the UAE Data Office

In the EU and UK. If you are in the EU or UK, you have the right to:

  • access your data
  • correct it
  • delete it
  • restrict how we use it
  • object to how we use it, including for direct marketing
  • receive it in a portable format
  • withdraw consent at any time
  • complain to the data protection supervisory authority where you live or work, or where you think the law was broken

How to use your rights. Email [email protected]. We may ask you to confirm who you are. We will reply within the time the law requires. We will not charge you unless the law allows it, for example for clearly excessive requests.

12. Children

Our website and services are for businesses. They are not meant for children. We do not knowingly collect data from anyone under 18. If you think a child has sent us personal data, contact us and we will delete it.

13. Changes to this policy

We may update this policy as our services or the law change. We will post the new version here and change the date at the top. If a change is significant, we will tell people we have a relationship with, for example by email.

14. Contact us

If you have questions about this policy or your data, contact us:

  • Email: [email protected]
  • Phone: +971 54 747 8989
  • Post: Elcara L.L.C-FZ, Meydan Grandstand, 6th floor, Meydan Road, Nad Al Sheba, Dubai, UAE