Contents
This policy explains how PocketPal Technologies Limited collects and uses personal data through the website at pocketpalapp.ae. It covers the waitlist, the contact form and your visits to the site.
It does not cover the future PocketPal app. The app is not yet available, and it will have its own privacy policy before anyone can use it.
1. Who we are
PocketPal Technologies Limited ("PocketPal", "we", "us"), a company incorporated in the Dubai International Financial Centre (DIFC), is the controller of the personal data described in this policy.
- Address: Unit GA-00-SZ-L1-RT-208, Level 1, Gate Avenue, South Zone, Dubai International Financial Centre, Dubai, United Arab Emirates
- Privacy contact: privacy@pocketpalapp.ae
- General enquiries: ask@pocketpalapp.ae
We have not appointed a Data Protection Officer. Privacy questions and requests go to the privacy contact above.
Our processing of personal data is governed by the DIFC Data Protection Law No. 5 of 2020.
2. Adults only, and children's information
Browsing the website is open to everyone. The waitlist and the contact form are for adults aged 18 or over, such as parents, carers, schools, partners and investors.
To join the waitlist, you agree to our Terms of Use. By agreeing, you confirm that you are 18 or over. We rely on that confirmation and do not check ages.
We do not knowingly collect personal data from anyone under 18. If you are under 18, please ask a parent or carer to join instead. If we learn that someone under 18 has given us their details, we will remove them from the waitlist, stop emailing them and delete their details, unless we need to keep some of them because the law requires it or to handle a complaint or legal claim.
Please do not include details about your children, such as their names, ages or schools, in a message to us. If you do, we will use them only to reply to you and then delete them.
3. What we collect
When you join the waitlist
- First name, last name, email address and who you are joining as (parent, school, partner, investor or other). These are required.
- Emirate or location, if you choose to tell us.
- A message, if you choose to write one.
- Your agreement to our Terms of Use, which includes confirming that you are 18 or over.
- Your email choices: whether you want product news and whether you want research and pilot invitations, together with the wording you agreed to and the date and time.
- How you found us: the website or campaign link that brought you to us, the first page you visited and your browser's language setting.
When you use the contact form
- Your first name, last name, email address, the topic you choose and your message.
When you receive our emails
- Whether you open our emails and which links you click. Our email provider, Brevo, records this for each email we send you, together with the date and time.
When you visit the website
- Technical data that our hosting provider records automatically, such as your IP address, browser type, the pages requested and the time of the request. We use this to run the site and keep it secure.
- Bot-protection data. Our forms use Cloudflare Turnstile to check that a real person is submitting them. Turnstile processes your IP address and basic information about your browser and device for this check.
- Analytics data, only if you accept analytics cookies. Our analytics provider, PostHog, records how you use the site: the pages you visit, where you click, how far you scroll, how long you stay, the website that sent you, your browser, device type and approximate location (country and city, worked out from your IP address). If you also tick the recordings box, it makes a recording of your visit that shows how you moved through the pages. Anything you type into our forms is hidden in these recordings, and we do not link analytics data to your name or email address.
- Visit counts, if you decline or have not chosen yet. If you decline analytics cookies, or until you choose, PostHog still counts your visit and the pages you view, without cookies and without a recording. To tell visits apart, PostHog's servers create a one-way code from your IP address and browser details, which changes every day. We use it only to count visits, never to identify you, but because it is made from your IP address it still counts as personal data. If your browser sends a Global Privacy Control signal, we do not count your visit at all unless you accept. You can also object to this counting at any time by emailing privacy@pocketpalapp.ae.
We do not ask for your date of birth, and we do not collect payment details, identity documents or financial account information through this website.
4. How we use your data
| Purpose | Data used |
|---|---|
| Add you to the waitlist and manage your place on it | Name, email, role, emirate, message, agreement to the Terms of Use |
| Send the emails you need: welcoming you and telling you when early access or launch opens for you | Name, email |
| Send product news and updates, if you opt in | Name, email, role, emirate |
| Invite you to research, testing and pilot opportunities, if you opt in | Name, email, role, emirate |
| Reply to your enquiry | Name, email, topic, message |
| Check that our product news and research emails reach you and find out which ones are useful, so we can improve them | Email, email opens and link clicks |
| Understand which channels bring people to PocketPal | How you found us |
| Keep the website and forms secure and prevent spam | Technical and bot-protection data |
| Understand how visitors use the website, so we can improve it | Analytics data, if you accept analytics cookies |
| Count visits and page views | Visit counts, if you decline analytics cookies or have not chosen yet |
| Keep a record of your choices and honour unsubscribe requests | Email, records of your email choices, unsubscribe records |
Under the DIFC Data Protection Law, we send product news and research invitations only with your consent, and we use analytics cookies and visit recordings only with your consent. The waitlist, the emails you need and replies to your enquiries are steps you asked us to take. Everything else in this table relies on our legitimate interests in understanding how people find us and use the website (including counting visits) and in keeping the website secure, and we use only the data we need.
Product news and research invitations are separate choices. You can say yes to one, both or neither. Neither is needed to join the waitlist. If you do not give the required details, we cannot add you to the waitlist or reply to your enquiry.
5. Emails and your choices
The emails we send
- Welcome email. When you join the waitlist, we add you straight away and send one welcome email.
- Access-opening notice. We will tell you when early access or launch opens for you.
- Product news. Only if you ticked the product news box.
- Research and pilot invitations. Only if you ticked the research box.
Every email includes an unsubscribe link. Unsubscribing stops all further emails from us and removes you from the waitlist. We keep only your email address on our unsubscribe list, so that we never email you again.
Our product news and research emails contain a small, invisible image and links that let our email provider, Brevo, record whether you open each email and which links you click. For the welcome email, the access-opening notice and replies to your enquiries, Brevo only counts opens and clicks in total and does not link them to you. We use this to check that our emails are delivered and to improve them. You can stop the open tracking by turning off images in your email app, and unsubscribing stops all emails.
Your right to object to marketing
You can object to marketing at any time. You can tell us to stop sending you product news, research invitations or any other marketing whenever you like, free of charge. Use the unsubscribe link in any email, or email privacy@pocketpalapp.ae. Stopping is as easy as signing up, and we will always respect your choice.
6. Who we share it with
We do not sell your personal data. We share it only with service providers who help us run the website and our email, under contracts that require them to protect it and use it only on our instructions.
| Provider | What they do for us | Where they process data |
|---|---|---|
| Vercel Inc. | Hosts the website and runs its server functions | Server functions run in Frankfurt, Germany. Pages are delivered from Vercel's global network. Vercel is a US company. |
| Supabase (Supabase Pte. Ltd) | Stores the waitlist, our email records and our copies of visit recordings | Frankfurt, Germany. Our contract is with Supabase Pte. Ltd in Singapore, part of Supabase Inc., a US company. |
| Brevo | Sends our emails and holds our mailing lists | France |
| Hostinger (Hostinger International Ltd) | Hosts our company email accounts, which receive contact form enquiries and internal notifications | Hostinger International Ltd is based in Cyprus (EU). Hostinger does not publish a fixed country for mailbox storage. See section 7. |
| Cloudflare, Inc. | Provides the Turnstile bot check on our forms | See section 7 |
| PostHog Inc. | Provides website analytics and visit recordings | Frankfurt, Germany (PostHog's EU data centre). PostHog is a US company. |
We may also disclose personal data if the law requires it, or to protect our rights or the safety of others. If PocketPal's business is ever transferred to a buyer or successor, your data may pass to them, and we would tell you if that happens.
7. International transfers
PocketPal is based in the DIFC. Some of our providers process personal data outside the DIFC.
- The EU. Our main processing (server functions, the waitlist database, our email sending and website analytics) takes place in Germany and France. Countries in the EU and the European Economic Area, including Germany and France, are on the DIFC Commissioner of Data Protection's list of jurisdictions with adequate protection.
- Other countries. Some providers, including Vercel, Supabase, Cloudflare and PostHog, are based in the United States, and our contract with Supabase is with its company in Singapore, which is on the DIFC adequacy list. Their staff or systems may access data from there, and Cloudflare may process it there. Hostinger's mailbox data may also be stored outside the DIFC and the EU. The United States is not on the DIFC adequacy list as a whole. Where data goes to a country the DIFC Commissioner has not recognised as adequate, such as the United States, we rely on safeguards in our data processing agreements, such as the European Commission's standard contractual clauses or recognised certifications, or another safeguard that DIFC law allows.
You can ask for a copy of the safeguards we rely on by emailing privacy@pocketpalapp.ae.
8. How long we keep it
| Data | How long |
|---|---|
| Waitlist record | Up to 24 months after you join, then deleted. Deleted sooner if you unsubscribe from all emails or ask us to delete it. |
| Records of your email choices | For as long as we keep your waitlist record |
| Email sending records (who we emailed, when, and whether delivery succeeded) | 24 months |
| Email open and click records | Up to 24 months, and deleted sooner if you unsubscribe or ask us to delete your data |
| Messages you send us (through the contact form or by email) | Up to 24 months in our email system, then deleted |
| Unsubscribe list | Kept indefinitely so we never email you again after you unsubscribe. It holds only your email address, the reason and the date. |
| Visit recordings | Up to 30 days with PostHog. We keep our own copy in our private storage with Supabase (Frankfurt, Germany) for up to 90 days, then delete it. If you change your choice to Decline or untick recordings, we stop recording straight away. |
| Other analytics data and visit counts | Up to 24 months, then deleted |
| Records of your cookie choices | 25 months, then deleted |
| Hosting, security and bot-protection data | Kept by our providers for the short periods set in their services |
We may keep data for longer where the law requires it, or where we need it to handle a complaint or legal claim.
9. Cookies and browser storage
When you first visit, a banner asks whether you accept analytics cookies. We do not use analytics cookies unless you accept, we record your visit only if you also tick the recordings box, and we never use advertising cookies. Until you choose, we only count your visit without cookies, in the same way as if you had declined.
- If you accept, PostHog sets a cookie and stores an ID in your browser's local storage (both named starting with
ph_). They let PostHog recognise your browser across pages and visits, for up to one year, so it can show us how the site is used and, if you ticked the recordings box, record your visit. - If you decline, no cookies are set. We only count your visit as described in section 3.
- Either way, your choice (including the recordings box) is saved in your browser's local storage so that we do not ask again on every page. We also keep a record of each choice on our own server, with no name, email or IP address attached: only a random code kept in your browser, the date and what you chose. This lets us show how consent was given or withdrawn. We ask you again once your choice is 12 months old. You can change your mind at any time with Cookie settings at the bottom of every page.
The site also uses your browser's session storage, which is cleared when you close the tab. It remembers how you arrived at the site so this can be saved with your waitlist sign-up, shows your email address (partly hidden) on the page you see after joining, and keeps your place on a page when you go back. These are needed for the site to work and do not need your consent. Cloudflare Turnstile may also use its own technical storage in your browser to carry out the bot check.
You can also block or delete cookies and stored data in your browser settings.
10. How we protect it
We use reasonable technical and organisational measures to protect personal data. These include encrypted connections, access to our systems limited to the people who need it, and a database that only our own server can read or change.
No method of storing or sending data is completely secure. If a breach affects your personal data, we will act quickly to contain it, and we will notify the DIFC Commissioner of Data Protection and you where the law requires.
11. Your rights and how to use them
Under DIFC law, and subject to the conditions it sets, you have the right to:
- access the personal data we hold about you and receive a copy;
- correct data that is inaccurate or incomplete;
- delete your data;
- restrict how we use your data;
- object to our use of your data based on legitimate interests;
- object to direct marketing at any time (see section 5);
- receive your data in a portable format and have it sent to another organisation;
- withdraw your consent at any time. This does not affect anything we did before you withdrew it.
We do not make decisions about you based solely on automated processing.
How to make a request:
- email privacy@pocketpalapp.ae; or
- use the contact form on our website. You do not need an account.
Making a request is free. If a request is manifestly unfounded or excessive, we may refuse it or charge a reasonable fee, and we will explain why. We may ask you to confirm your identity, usually by replying from the email address you used with us. We will respond within one month. If a request is complex, we may extend this by up to two further months, and we will tell you why within the first month.
If you ask us to delete your data, we will keep your email address on our unsubscribe list only, so that we do not contact you again.
12. Complaints
If you have a concern, please contact us first at privacy@pocketpalapp.ae so we can try to resolve it.
You also have the right to complain to the DIFC Commissioner of Data Protection:
13. Changes to this policy
We will update this policy when our website or our use of personal data changes. The effective date at the top shows when it was last changed. If a change affects how we use data you have already given us, we will tell you before it takes effect and ask for your consent where the law requires.