Privacy Policy

We collect the following categories of information:

• Account information — your name, email address, role, and reporting/branch assignment within your Company, provided when your account is created.
• Customer Data — the invoice, customer, collections, and target data your Company uploads or enters into the Service, including customer names, contact details, invoice amounts and due dates, and notes logged about collections activity.
• Usage data — log-in activity, pages viewed, and actions taken within the Service, used to operate features like the activity feed and notifications.
• AI assistant content — messages you send to the in-app AI assistant, and, if you use voice input, a temporary audio recording that is sent for transcription and not retained after the transcript is produced.
• Acceptance records — when you accept our Terms of Service and this Policy at signup, we record your email address, the versions you accepted, the date and time, your IP address and your browser user-agent string. This is kept as evidence that agreement was given, as contemplated by Federal Decree-Law No. 46 of 2021 on Electronic Transactions and Trust Services.

We use the information above to:

• operate the Service, including displaying dashboards, follow-up activity, and notifications scoped to your role and branch;
• generate AI assistant responses, drafts, and the daily digest notification about accounts that need attention;
• maintain the security of the Service, including detecting and limiting abusive or automated use; and
• respond to support requests and communicate service-related updates.

We do not sell your information or your Company's Customer Data, and we do not use it for third-party advertising.

We use a small number of third-party providers to operate the Service, each of which processes data on our behalf under its own security and privacy commitments. This list is the same one given in Schedule 1 of our Terms of Service:

Only the content needed for each provider's function is sent to it. The AI provider receives your message and the relevant data returned by the assistant's tools; it does not receive your login credentials. Production AI services are configured under paid or business terms that state prompts and responses are not used to improve or train provider models, although limited safety and abuse-prevention logging may occur. Our payment processor receives billing details; we do not store full payment card numbers.

International transfers. These providers process data on servers located outside the United Arab Emirates. Where personal data is transferred outside the UAE we will ensure an appropriate transfer mechanism is in place as required by Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data and its implementing regulations.

We will give at least 30days' notice before adding or replacing a sub-processor.

We retain account information and Customer Data for as long as your Company's account is active. After termination, Customer Data remains available for export for 30 days and is then deleted within 90 days, except for copies held in routine backups (deleted on their ordinary cycle) and anything we are required by law to retain. Data from an expired free trial is retained for 30 days and then deleted.

Some actions — such as resetting uploaded invoice, target, or collections data from the Uploads page — permanently delete that data immediately; the Service warns you before these actions complete. AI assistant chat history is kept only for the current session and is not persisted server-side beyond what is needed to generate a response and the usage-metrics log described below. Acceptance records (section 1) are retained for as long as necessary to evidence the agreement, and may outlive the account.

We log metadata about each AI assistant request (which model responded, token or audio volume, and which Company/user made the request) to monitor cost and reliability. This log does not store the message content itself.

We use reasonable technical and organizational measures to protect information against unauthorized access, alteration, or loss, including encryption in transit, role-based access control within the Service, and rate limiting on authentication and AI endpoints. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Breach notification.If we become aware of a personal data breach affecting your Company's data, we will notify your Company without undue delay and in any event within 72 hours, with the information reasonably available to us at that time.

The Service uses a session cookie set by our authentication provider (Supabase) to keep you signed in. We do not use third-party advertising or analytics cookies today.

Under Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, and depending on your location, you may have the right to request access to your personal data, to have inaccurate data corrected, to request deletion, to restrict or object to certain processing, to receive your data in a portable format, and to withdraw consent where processing relies on it.

Because most Customer Data in the Service is entered and controlled by your Company — which is the controller of that data, while we act as its processor — requests relating to it should generally go to your Company's administrator first. If you contact us directly about such data, we will forward your request to the relevant Company. You can otherwise reach us using the contact details below and we will respond within a reasonable time. You also have the right to complain to the UAE Data Office.

The Service is intended for business use by adults and is not directed at individuals under 18. We do not knowingly collect personal information from children.

We may update this Privacy Policy from time to time. If we make material changes, we will give at least 30days' notice to affected Companies before the changes take effect, in line with clause 20 of our Terms of Service. The version and effective date above identify the current revision.

Questions about this Privacy Policy, or requests relating to your personal information, can be sent to mudasar@collectflows.com, or by post to Attendify Vision Technology Solutions L.L.C – S.P.C, Abu Dhabi, United Arab Emirates.