Privacy Policy

Last updated: 1 April 2026

1. Who we are

Eshal Technologies LLC ("Eshal", "we", "us", "our") provides an AI-powered customer communication and workflow automation platform. Our registered office is in Dubai, United Arab Emirates.

This Privacy Policy applies to:

Users of the Eshal platform at eshal.ai
Customers who subscribe to Eshal's services
End-customers who interact with Eshal-powered AI through our customers' channels
Visitors to our website and marketing pages

When Eshal processes personal data on behalf of our business customers (in the context of their end-customer conversations), we act as a data processor. When we process data about our own customers and website visitors for our own purposes, we act as a data controller.

2. Data we collect

2.1 Platform customers (businesses)

Account registration information: name, email address, company name, phone number
Billing information: payment card details (tokenised by our payment processor - we do not store card numbers)
Usage data: platform login activity, feature usage, API call logs
Support communications: emails, chat transcripts with our team

2.2 End-customer conversation data (processed on behalf of our customers)

Customer messages and conversation transcripts
Personal data shared during conversations (names, order numbers, identification details)
Channel identifiers (WhatsApp number, web chat session ID)
Timestamps and conversation metadata

Important: Conversation data belonging to our customers' end-customers is processed strictly on our customers' behalf, under their instructions, as defined in their Data Processing Agreement (DPA) with Eshal. We do not use end-customer conversation data for our own purposes or to train our models without explicit written consent.

2.3 Website visitors

IP address and approximate location
Browser and device information
Pages visited, time on site, referral source (via analytics cookies with consent)
Contact form submissions

3. How we use your data

Purpose	Data used	Legal basis
Provide and maintain the Eshal platform	Account data, usage data	Contract performance
Process payments	Billing information (tokenised)	Contract performance
Customer support	Account data, support communications	Contract performance / Legitimate interest
Platform security and fraud prevention	Usage data, login activity	Legitimate interest
Product improvements (aggregated, anonymised)	Anonymised usage analytics	Legitimate interest
Marketing communications (with consent)	Email address, name	Consent
Legal and regulatory compliance	All relevant data	Legal obligation

4. Legal basis for processing

Under the UAE PDPL and GDPR (where applicable), we process personal data on the following legal bases:

Contract performance: Processing necessary to deliver the services you have contracted with us
Legitimate interests: Processing for security, fraud prevention, and platform improvement, where our interests are not overridden by your rights
Consent: Marketing communications and analytics cookies - you may withdraw consent at any time
Legal obligation: Compliance with UAE law, including PDPL requirements and sector-specific regulations

We do not sell personal data. We share data only in the following circumstances:

Service providers: Sub-processors who provide infrastructure, payment processing, and support tools - all bound by data processing agreements and prohibited from using data for their own purposes
Business customers: We share conversation data with the business customer on whose behalf we process it, as required to deliver the service
Legal requirements: Where required by UAE law, court order, or regulatory authority
Business transfers: In the event of a merger, acquisition, or asset sale, with notice provided to affected parties

Our key sub-processors are listed in our Data Processing Agreement, available upon request from privacy@eshal.ai.

6. Data storage and residency

All UAE customer data - including conversation transcripts, account data, and audit logs - is stored and processed exclusively on OVHcloud Dubai infrastructure located within the UAE. No personal data relating to UAE customers is transferred to servers outside the UAE without explicit contractual safeguards.

For customers in other regions, data is stored in the nearest compliant region as specified in their service agreement. All storage locations are listed in the applicable Data Processing Agreement.

UAE PDPL compliance: Cross-border data transfers are only made to countries with UAE-level adequacy, or under standard contractual clauses approved for use under the PDPL. The default for UAE customers is UAE-only processing - no cross-border transfer occurs unless explicitly configured.

7. Data retention

We retain data only as long as necessary for its purpose:

Account data: For the duration of the contract plus 7 years (to satisfy UAE commercial record-keeping requirements)
Conversation data: As specified in the customer's service agreement, typically 12–36 months unless longer retention is required by sector regulation (e.g., banking records)
Audit logs: Minimum 5 years (required for ISO 27001 compliance and regulatory audit readiness)
Marketing data: Until consent is withdrawn or 3 years of inactivity, whichever is sooner
Website analytics: 13 months (standard analytics retention)

8. Your rights

Under the UAE PDPL and (where applicable) GDPR, you have the following rights regarding your personal data:

Right of access: Request a copy of the personal data we hold about you
Right to rectification: Request correction of inaccurate data
Right to erasure: Request deletion of your data, subject to legal retention obligations
Right to data portability: Request your data in a structured, machine-readable format
Right to object: Object to processing based on legitimate interests
Right to withdraw consent: For any processing based on consent (e.g., marketing emails)

To exercise any of these rights, email privacy@eshal.ai with the subject "Data Rights Request". We will respond within 30 days.

9. Cookies

Our website uses cookies for functionality, analytics, and (with consent) marketing. A detailed cookie list and consent management tool is available on our Cookie Policy page. You may withdraw analytics and marketing cookie consent at any time through the cookie preferences link in the footer.

10. Children

Our platform and services are not directed at or intended for use by individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware that we have inadvertently collected personal data from a child, we will delete it promptly.

11. Changes to this policy

We may update this Privacy Policy periodically. Material changes will be communicated via email to registered customers and via a prominent notice on this page at least 30 days before the effective date. The current version and its effective date are always shown at the top of this page.

12. Contact us

For privacy questions, data subject rights requests, or to request our Data Processing Agreement:

Email: privacy@eshal.ai
Postal: Eshal Technologies LLC, Dubai, United Arab Emirates
Response time: We respond to all privacy inquiries within 30 days

If you are a UAE resident with unresolved concerns, you may also contact the UAE Data Office at uaedataoffice.ae.