Privacy Policy

Code Chain Creations – FZCO Version 2.12 · Effective date: 13 November 2026 · Last updated: 13 November 2026

This Privacy Policy explains how Code Chain Creations – FZCO ("CCC", "we", "us"), a free zone company licensed by the International Free Zone Authority (IFZA), licence no. 42369, Dubai Silicon Oasis, Dubai, United Arab Emirates, handles personal data on our website cccreations.ae and in our portal (the "Portal").

If you use a personal account, our Privacy Notice for Personal Accounts applies instead of this Policy.

We process personal data in accordance with UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data ("PDPL") and other laws that apply.

Details on request. The Portal is under active development, and we change functions, AI models and service providers often. The current names of our providers, the countries they work in, the periods we keep data for and our security measures are available free of charge on request through the Contact form. We answer within 3 working days. You can also ask Vizor in the chat. Its answers are for convenience and may contain mistakes; these documents and our answer through the Contact form prevail.

To register a business you need a business name, a phone number with its country code, a log-in name, a password and an e-mail address. A display name is optional. Our agents may ask about you and your business to understand your task. They are set up not to ask you to send identity documents or their numbers, payment card or bank account details, passwords, PINs or one-time codes. You choose which other context to share. We use it to assist you and as described in this Policy.

1. Who is responsible

If your employer or another business uses the Portal and you want to exercise your rights about data it entered, please contact that business first. We will help it respond.

2. What we collect and why

2.1 Website and public chat

• Public chat. Our agents may ask for context to help with your request. Messages you type in the public chat are sent to our AI providers to generate a reply. We keep usage records, such as the time and number of messages, to prevent abuse and control costs.
• Contact form. An e-mail address or another way to reply to you, your message and the page you wrote from. Your name is optional. We use them to answer you and to keep a record of our correspondence.
• Technical data. Our hosting provider processes technical data needed to deliver the website securely, such as IP address, browser type, time and error codes, in server logs.

2.2 Portal account

• Registration. Business name, a phone number with its country code, a log-in name, a password and an e-mail address. A display name is optional. We use the phone number to contact your business about its workspace. We use the e-mail address to confirm your registration, restore your access, confirm requests about your data and send you important notices.
• Profile (optional). Company logo, website or social media links, contact details and an avatar, if you add them.
• Voice dictation (optional). If you press the microphone button, we record your voice and send the recording to a provider to turn it into text. You see the text as a draft and decide whether to send it. We do not keep the audio after it has been turned into text.
• Workspace content. Your conversations with the AI agents, business cards, summaries, sections, uploaded files and private photos. Voice messages are turned into text on our own server.
• Review and analysis. Not every conversation is read. When needed, to provide and support the Portal, solve problems and improve the quality of the work and of the interaction with the agents, your company's management may review your conversations with the AI agents, and authorised, confidentiality-bound staff of Code Chain Creations may access and analyse your conversations and other workspace data, including personal data, also with our internal AI tools. These tools may use our AI providers. What we learn is used for other customers only in anonymised form. You accept this in the Portal Access Agreement when you first enter the Portal, and you can withdraw at any time through the Contact form; the chat with the agents is then no longer available to you, and we stop this review of your conversations. We do not sell this data.
• Access and roles. Which Users belong to a workspace and what rights they have.
• Records of acceptance. When you accept our documents we record the account and workspace, the document versions and their digital fingerprints, the date and time, and technical data that helps prove the acceptance.
• Electronic signing. If you sign a contract with us in the Portal, we keep the signed document, the signing record and the evidence of consent, and we send the signed copy by e-mail.

2.3 Information you choose to send

We and our agents do not ask you to send identity documents or their numbers, payment card or bank account details, passwords, PINs or one-time codes. If a necessary step requires them, you complete it yourself in the relevant service's secure interface, outside the Portal. Our agents may ask for other personal or business context relevant to your task. You choose what to share. If you send any file, image, document or information in a chat or in your workspace, you do so by your own choice. We then store and process it only to answer you and as described in this Policy, including by sending it to our AI providers. If it concerns another person, you confirm that you have the right to share it. You can delete it with the controls in your workspace or ask us to delete it. If we notice Sensitive Information that seems to have been sent by mistake, we may delete it or ask you to delete it. Never send passwords or one-time codes: neither we nor our agents will ever ask for them.

"Sensitive Information" means identity documents and their numbers (such as passport, Emirates ID or visa), payment card and bank account details, passwords, PINs and one-time codes, health, biometric and genetic data, religious or political beliefs, criminal records, and information about children.

2.4 Legal bases

3. How we use AI

• Vizor and the other agents work on different AI models and use different approaches. They may also connect external services, including through API keys, to do the work better. Depending on the function, your message and the workspace content needed for a reply are sent to one or more of them. We may add, replace or remove models and services at our discretion. The models produce suggestions, summaries and drafts. The current list is available on request.
• Automatic checks. Our software automatically checks how agents work, to keep them accurate and safe, and learns from anonymised reports. People do not read your conversations for this.
• Training. We do not train AI models on your data ourselves. Each provider handles data under its own terms. If a function would send your data to a provider that may use it to train its models, we ask for your separate consent first.
• Provider retention. The providers may keep inputs and outputs for safety, abuse monitoring or legal reasons, including longer retention where content is flagged for safety review, as described in their own policies. We cannot guarantee deletion of data held by a provider within any particular period.
• No automated decisions. AI output is a suggestion. The Portal does not make decisions with legal or similarly significant effects on any person; a person decides. If a business uses the Portal for matters about you and you think an automated decision affected you, you may ask that business for review by a person (PDPL, Article 18).
• Accuracy. AI output may contain mistakes. Please do not enter Sensitive Information unless it is necessary.

4. Who receives your data

We share data with service providers in these sectors, in the UAE and abroad:

• providers of AI models, speech recognition and similar AI services;
• hosting, database, authentication and file storage;
• e-mail delivery, notifications and messaging;
• web search and other services connected to your workspace's agent, when it uses them for your task. The agent asks before it passes personal data to a connected service;
• other technical services that a function of the Portal needs.

The current names are available on request.

We may also disclose data to professional advisers under confidentiality, to a buyer or successor of our business, or where required by law or a competent authority. We do not sell personal data.

5. Transfers outside the UAE

Your data may be stored and processed outside the UAE, including in Singapore, the United States, the European Union and other countries where our providers operate. We transfer it on a basis permitted by Articles 22 and 23 of the PDPL: where the transfer is necessary to perform our contract with you, with your consent, or under contracts with the recipient. The current countries and safeguards are available on request.

6. How long we keep data

We keep data only as long as we need it for the purposes in this Policy. In short:

• Account and workspace content: while the account or workspace exists, and for a reasonable period after it is closed.
• Backups and logs: for the period set by our providers.
• Invoices, accounting records, signed contracts and records of acceptance: for as long as the law requires or as we need them to establish or defend legal claims.

Deletion on request. You can ask us to delete your workspace and everything in it. We offer an export first, then delete the data from our systems and confirm this in writing. We keep only the records named above and a record of the deletion. Copies held by AI providers under their own policies are outside our control. Deletion cannot be undone, and we do not carry it out while we know of a dispute, claim or request from an authority concerning this data.

The current periods are available on request.

7. Your rights

Under the PDPL you may, subject to its conditions and exceptions:

• receive information about the processing of your data (Article 13);
• ask for your data to be transferred to you or to another controller (Article 14);
• ask us to correct or erase your data (Article 15);
• ask us to restrict processing (Article 16);
• object to processing and ask us to stop it, including for direct marketing (Article 17);
• object to decisions based on automated processing and ask for review by a person (Article 18);
• withdraw your consent at any time, without affecting earlier processing.

You can use the export and deletion controls available in your workspace. For other requests, including deletion of your account or saved information, contact us as shown in section 10. We may need to verify your identity. We answer within 3 working days, with the information you asked for or with the next steps.

If you are not satisfied with our answer, you may complain to the UAE Data Office.

8. Security

We use technical and organisational measures appropriate to the data and the service, and our staff have access only where needed, including for the review of conversations described in section 2.2. The current measures are available on request. No system is completely secure. If a breach is likely to affect you, we will inform you and the competent authority as required by law. Businesses using the Portal are informed of breaches affecting their workspace under the DPA.

9. Cookies, preferences and optional analytics

We use necessary cookies and similar storage in your browser for sign-in, security and to remember your preferences, such as language and privacy choices. If you have not chosen a language, we pick one from your browser's setting or your approximate location.

Optional analytics is off unless you allow it. You can change your choice in Privacy settings in the website footer or your workspace, and your workspace works the same whichever option you choose. Analytics records do not include your messages, files or company details.

Details are available on request.

10. Contact

For questions or requests about personal data, use the Contact form on our website and choose or write "Privacy" in the subject.

11. Children

Business workspaces are intended for businesses, and personal accounts are covered by a separate notice. Neither is directed at children. Only people aged 18 or over may create a workspace or an account.

12. Changes

We may update this Policy and will publish the new version with its date. For material changes, such as a new purpose of processing, we also tell account holders in the Portal or by e-mail. Adding or replacing a provider, model, service or function is not in itself a material change.

This Policy is published in English, with Russian and Ukrainian translations for convenience. An Arabic translation is available on request. If the versions conflict, the English version prevails, unless the law requires otherwise.

Annex. Electronic signing of contracts

We ask for the data below only when you sign a contract with us, because we must be able to show who signed it.

Code Chain Creations – FZCO (Dubai Silicon Oasis, Dubai, UAE) is responsible for these data.

When you sign a contract in our client portal, we receive:

• your first and last name, job title, phone number and e-mail address;

• your portal login and the time of signing;

• a hashed (coded) form of your IP address, and your browser and device type;

• a record that you logged in with a second factor (without the codes);

• the boxes you ticked and a checksum of the signed document.

Why. To conclude the contract and to prove who signed it, when and how, if a dispute arises.

Where. In a private Supabase storage in Singapore. Supabase is a US company and may access the data from the USA for support. The portal runs on Vercel (USA), which handles the data when you send the form.

Who receives the e-mail. We send the signed document and the signing record through our e-mail provider IONOS to the e-mail address you entered, with a copy to us. There are no other recipients.

How long. For the term of the contract and seven years after it ends, and longer only while needed for a dispute or claim.

Your rights. You can ask for access to these data or their correction through the contact form on this page. We cannot delete them before the end of the retention period, because they prove the contract.