Privacy Policy

1 Scope and controller

This Privacy Policy explains how 204Labs FZE, a company registered in SPC Free Zone, Sharjah, UAE under licence number 4432199, collects and processes personal data when people use our websites, applications, products, communications, and related services.

For the purposes of this policy, 204Labs FZE is the data controller for personal data that we decide how and why to process. Where we process personal data on behalf of a customer, school, institution, employer, or other organisation, we act as a processor or service provider under the relevant contract.

This policy is designed to address UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, applicable UAE laws and regulations, and any other privacy rules that apply to a specific service, customer, or user location.

2 Personal data we collect

The personal data we collect depends on how a person uses the services. It may include:

• Identity and contact data, such as name, email address, phone number, organisation, role, and account identifiers.
• Account and profile data, such as login credentials, preferences, subscription status, and service settings.
• Educational, business, or uploaded content, such as prompts, files, documents, notes, course materials, student work, feedback, generated outputs, support requests, and other information submitted to the services.
• Payment and transaction data, such as billing contact details, invoices, payment status, tax information, and records of purchases. Payment-card information may be handled by payment processors and not stored by us directly.
• Usage and technical data, such as device information, IP address, browser type, operating system, pages viewed, features used, crash logs, authentication logs, cookies, and similar technologies.
• Communications data, such as messages sent to us, survey responses, product feedback, and records of support interactions.
• Marketing data, such as communication preferences, campaign engagement, and consent or opt-out records.

3 Children and student data

Our services may be used in educational settings. Children and students should use the services only where authorised by a parent or guardian, school, teacher, institution, or other organisation with the legal right to provide or approve the relevant data.

We do not knowingly invite children to create unauthorised accounts or submit personal data directly to us. If we learn that a child has provided personal data without appropriate authorisation, we will take reasonable steps to delete or restrict that data unless we are required or permitted to retain it.

Customers and users must not upload student, child, health, biometric, financial, identification, or other sensitive data unless they are legally authorised to do so and the data is necessary for the intended service.

4 How we use personal data

We use personal data for the following purposes:

• To provide, operate, maintain, secure, and improve the services.
• To create and manage accounts, authenticate users, process transactions, and provide customer support.
• To generate, store, display, and manage user-requested outputs and uploaded content.
• To personalise the user experience and remember preferences.
• To communicate service updates, security notices, administrative messages, and support responses.
• To send marketing communications where permitted and to honour opt-out requests.
• To monitor abuse, prevent fraud, enforce our terms, and protect the rights, safety, and security of users, customers, the public, and 204Labs FZE.
• To comply with legal, regulatory, tax, accounting, free zone, court, law enforcement, and other official requirements.
• To analyse performance, debug errors, develop features, and evaluate service quality.

5 Legal grounds and consent

Where applicable law requires consent, we will seek consent before the relevant processing and will provide a way to withdraw consent where legally required. Withdrawal of consent does not affect processing that occurred before withdrawal and may limit the services we can provide.

We may also process personal data without separate consent where applicable UAE law permits or requires it, including where processing is necessary to perform a contract, comply with legal obligations, establish or defend legal claims, protect public interest or vital interests, prevent fraud or misuse, secure the services, or pursue legitimate business purposes in a manner consistent with applicable law.

6 Artificial intelligence and generated content

Some services may use artificial intelligence or automated systems to transform, summarise, classify, compose, analyse, or generate content requested by users. Users are responsible for ensuring they have the right to submit the content they upload and for reviewing any generated output before relying on it.

We may process prompts, uploaded files, user instructions, generated outputs, and related metadata to provide the requested function, maintain safety and security, troubleshoot errors, and improve service quality where permitted by law and by the relevant customer agreement.

7 Sharing personal data

We may share personal data with:

• Service providers and processors that help us host, secure, operate, analyse, bill for, and support the services.
• Payment providers, banks, accountants, tax advisers, auditors, insurers, legal advisers, and other professional advisers.
• Customers, schools, employers, institutions, administrators, or authorised account owners where the services are provided under their account or contract.
• Third-party integrations that a user or customer chooses to connect or enable.
• Government authorities, courts, regulators, free zone authorities, law enforcement bodies, and other parties where disclosure is required or permitted by law.
• Prospective or actual buyers, investors, lenders, or successors in connection with a merger, restructuring, financing, sale, transfer, or similar corporate transaction.

We do not sell personal data in the ordinary meaning of selling personal information for money.

8 International transfers

We may process and store personal data in the UAE and in other countries where we, our affiliates, customers, service providers, or technology vendors operate. Where personal data is transferred across borders, we use appropriate contractual, technical, organisational, consent-based, or other legally recognised safeguards as required by applicable law.

9 Security

We use reasonable technical and organisational measures designed to protect personal data against unauthorised access, disclosure, alteration, loss, misuse, and destruction. These measures may include access controls, encryption, monitoring, logging, backups, vendor due diligence, and internal confidentiality controls.

No online service, storage system, or transmission method is completely secure. Users must protect their login credentials, use strong passwords, keep devices secure, and notify us promptly of suspected unauthorised access.

10 Retention

We retain personal data for as long as reasonably necessary for the purposes described in this policy, including to provide the services, comply with legal obligations, resolve disputes, enforce agreements, maintain security, and keep business records. Retention periods vary depending on the type of data, user settings, customer instructions, contractual requirements, legal requirements, and operational needs.

When personal data is no longer needed, we will delete, anonymise, aggregate, or securely retain it where continued retention is lawful and necessary.

11 Data subject rights

Subject to applicable law and verification of identity, individuals may have rights to request access to personal data, correction of inaccurate data, deletion, restriction or suspension of processing, objection to certain processing, withdrawal of consent, data portability where available, and information about processing and transfers.

Requests may be sent to privacy@204labs.com. We may ask for information needed to verify identity, locate the relevant data, understand the request, and protect the rights and security of others. Some requests may be limited by legal obligations, customer instructions, confidentiality duties, or the rights of other persons.

12 Marketing communications

Users may opt out of marketing emails by using the unsubscribe link in the message or by contacting us. We may still send non-marketing service, security, legal, billing, and administrative messages.

13 Cookies and similar technologies

We use cookies and similar technologies as described in our Cookie Policy. These technologies help operate the services, remember preferences, understand usage, secure accounts, and improve performance.

14 Third-party services

The services may contain links to third-party websites, platforms, integrations, or content. Third parties process personal data under their own terms and policies. We are not responsible for third-party privacy practices unless applicable law provides otherwise.

15 Changes to this Privacy Policy

We may update this Privacy Policy from time to time. The updated version will be effective when posted or otherwise made available, unless a later effective date is stated. If a change materially affects how we process personal data, we will take reasonable steps to notify affected users or customers as required by law.

16 Contact

Privacy questions and requests should be sent to privacy@204labs.com.

Postal address: 204Labs FZE, Business Center, SPC Free Zone, Sharjah, United Arab Emirates.