LEGAL · DRAFT
Privacy Policy
Effective date: [EFFECTIVE DATE] · Contact: [email protected]
This policy explains how [LEGAL ENTITY NAME], [REGISTERED ADDRESS], United Arab Emirates ("PerpBrain", "we") handles personal data. We aim to meet the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL). [If the entity is registered in DIFC or ADGM, replace with the DIFC Data Protection Law No. 5 of 2020 or the ADGM Data Protection Regulations 2021 — see LEGAL-README.]
1. What we collect
Waitlist: your email address; when you gave and confirmed consent; the page or link you signed up from; a one-way salted hash of your IP address for abuse prevention (we do not store the IP itself).
Paid Services (when available): name or team name, billing email, the wallet address and transaction reference used to pay, plan and invoice records, API-key usage logs (time, endpoint, volume), and sanctions-screening results.
Support: what you send us at [email protected].
Self-hosted software: PerpBrain software you run yourself sends us nothing by default. Your strategies, keys and data stay on your systems.
We do not knowingly collect data from anyone under 18, and we do not ask for sensitive personal data.
2. Why we use it, and on what basis
| Purpose | Basis |
|---|---|
| Confirming your sign-up and telling you about access and product updates | Your consent (double opt-in), which you can withdraw at any time |
| Providing paid Services, billing, receipts and API keys | Performing our contract with you |
| Tax records and VAT invoices; sanctions and anti-money-laundering checks | Legal obligation |
| Preventing spam, abuse and fraud; keeping the Services secure | Our legitimate interest / exceptions permitted under PDPL Article 4 |
We do not sell personal data, use it for advertising, or make decisions about you based solely on automated processing that have legal effect, other than automated sanctions screening, which a person reviews before any refusal is final.
3. Who processes it
Our sub-processors are listed in the Sub-processors list. They include Cloudflare (hosting), Supabase (database), Resend (email) and, for payments, MoonPay Commerce or NOWPayments. Public blockchains record payment transactions permanently; we cannot delete on-chain data.
4. International transfers
Some sub-processors handle data outside the UAE, including in the United States and the European Union. We transfer data only where PDPL Articles 22 and 23 allow it, for example under contractual safeguards with each provider, or where necessary to perform our contract with you.
5. How long we keep it
- Unconfirmed waitlist sign-ups: 30 days.
- Confirmed waitlist: until you unsubscribe or ask for deletion, or 24 months after our last email, whichever is first.
- Billing, invoice and VAT records: the period UAE tax law requires (currently at least 5 years).
- API usage logs: 12 months.
- Sanctions-screening records: as long as the law requires.
6. Your rights
Under the PDPL you may ask for information about, and a copy of, your data; correction or erasure; restriction; to stop processing; to object, including to automated decisions; and to receive your data in a portable format. You may withdraw consent at any time; every email has a one-click unsubscribe. Write to [email protected]. We respond without undue delay and aim to do so within 30 days. Requests are free. You may complain to the UAE Data Office.
7. Security and breaches
We use encryption in transit, access controls, least-privilege keys and IP hashing. No system is perfectly secure. If a breach risks your privacy, we will notify the UAE Data Office and, where required, you.
8. Cookies
See the Cookie Notice. We use no advertising or third-party analytics cookies.
9. Changes
We will post updates here with a new date, and email confirmed subscribers about material changes.