Privacy Policy

Last updated: 15 March 2026

1. Who We Are

ServeIQ AI is a technology company registered in the United Arab Emirates. We provide an AI-powered reception and booking platform for small and medium-sized businesses.

Company: ServeIQ AI
Location: Dubai, United Arab Emirates
Data Protection Contact: privacy@serveiqai.com

This policy applies to the serveiqai.com website, our AI chat assistant, and all communication channels we operate (WhatsApp, Instagram, Facebook, Telegram, and website chat).

2. Our Role: Controller and Processor

ServeIQ AI operates in two capacities:

Data Controller — when you visit our website, enquire about our services, or interact with our own AI assistant. We decide what data to collect and why.
Data Processor — when you interact with our AI assistant on behalf of one of our client businesses (for example, a salon or clinic). In this case, the business you are communicating with is the Data Controller, and their own privacy policy governs how your data is used. We process data only on their instructions.

If you are interacting with a business that uses ServeIQ AI, please also refer to that business's own privacy policy.

3. Data We Collect

Data you provide

Contact details — name, email address, phone number, WhatsApp number
Conversation content — messages you send via any of our chat channels
Booking information — appointment dates, times, and service preferences
Consent records — your consent choices and when they were given

Data collected automatically

Technical data — browser type, IP address, device type, pages visited
Usage data — how you interact with our chat assistant (e.g. conversation duration)

Sensitive data

We do not intentionally collect sensitive personal data (such as health information, religious beliefs, or biometric data). If you are communicating with a healthcare or wellness provider through our platform and disclose health-related information, that data will be treated with heightened protection in accordance with UAE law.

4. Legal Basis for Processing

Under UAE Federal Decree-Law No. 45 of 2021 (Personal Data Protection Law), we process your personal data on the following legal bases:

Purpose	Legal Basis
Responding to your enquiries	Consent; performance of a contract
Managing bookings and appointments	Performance of a contract
Sending booking confirmations	Performance of a contract
Improving our services	Legitimate interest
Complying with legal obligations	Legal obligation
Processing conversations through AI	Consent
Transferring data to service providers outside the UAE	Consent; contractual safeguards (DPAs and SCCs)

5. AI and Automated Decision-Making

Our chat assistant is powered by artificial intelligence. When you interact with it:

Your messages are processed by an AI language model to generate responses
The AI may identify your needs, suggest services, and facilitate bookings based on your conversation
The AI extracts key information from your messages (such as your name, business type, and preferences) to provide relevant responses
No fully automated decisions with legal or significant effects are made without human oversight

You have the right to request human intervention at any time. Simply ask the chat assistant to speak with a person, and your request will be escalated to a member of our team.

6. Who We Share Data With

We do not sell your personal data. We share your data only with the following categories of recipients:

The business you are communicating with — if you are using our assistant on behalf of a client business (e.g. a salon), that business receives your conversation data, contact details, and booking information
Technology service providers — who help us operate the platform (see Section 7 below)
Authorities — if required by UAE law or court order

7. International Data Transfers

To provide our services, your personal data is transferred to and processed in countries outside the United Arab Emirates. We take steps to ensure your data is protected in accordance with UAE law, including Data Processing Agreements and Standard Contractual Clauses with each provider.

Service Provider	Purpose	Country
OpenAI	AI language processing (conversation responses)	United States
Supabase (hosted on AWS)	Database storage (contact details, conversations, bookings)	India (Mumbai region)
Google (Gmail, Calendar)	Booking confirmations, calendar invites	United States
Meta (WhatsApp, Instagram, Facebook)	Messaging channel delivery	United States / Ireland
Hetzner	Web hosting and application server	Germany

By using our services and providing your consent, you acknowledge that your data will be transferred to these countries. If you do not wish your data to be transferred outside the UAE, please do not use our services and contact us to request deletion of any existing data.

8. Data Retention

We retain your personal data only for as long as necessary for the purpose it was collected. Our retention periods are:

Data Category	Retention Period
Conversation messages	12 months after your last interaction
Booking records	24 months after the appointment date
Contact details	Duration of service relationship plus 12 months
Lead enquiry data (no booking made)	6 months after last contact
Consent records	Duration of relationship plus 36 months
Technical/usage data	6 months

After the retention period expires, your data will be securely deleted or anonymised. You may request earlier deletion at any time (see Section 9).

9. Your Rights

Under UAE Federal Decree-Law No. 45 of 2021, you have the following rights regarding your personal data:

Right of access — obtain confirmation of whether we process your data, and receive a copy
Right to rectification — correct inaccurate or incomplete data
Right to erasure — request deletion of your data
Right to restrict processing — limit how we use your data in certain circumstances
Right to data portability — receive your data in a structured, machine-readable format
Right to object — object to processing based on legitimate interests
Right regarding automated decisions — request human review of any decision made solely by automated processing
Right to withdraw consent — withdraw your consent at any time, without affecting the lawfulness of processing carried out before withdrawal

To exercise any of these rights, contact us at privacy@serveiqai.com. We will respond within one calendar month. If we need more time, we will inform you of the reason and the extended timeframe.

You also have the right to lodge a complaint with the UAE Data Office if you believe your data protection rights have been violated.

10. Children's Data

Our services are not directed at individuals under the age of 18. We do not knowingly collect personal data from children. If you are a parent or guardian and believe your child has provided us with personal data, please contact us at privacy@serveiqai.com and we will delete it promptly.

11. Data Security

We implement appropriate technical and organisational measures to protect your personal data, including:

Encryption of data in transit (TLS/HTTPS) and at rest
Row-level security on our database, restricting access to authorised personnel only
Access controls and authentication for all administrative systems
Regular review of security practices

While we take every reasonable precaution, no method of transmission or storage is completely secure. If we become aware of a data breach that poses a risk to your rights, we will notify the UAE Data Office and, where required, notify you directly.

12. Changes to This Policy

We may update this policy from time to time. If we make significant changes, we will update the "Last updated" date at the top of this page. We encourage you to review this page periodically.

13. Governing Law

This privacy policy is governed by the laws of the United Arab Emirates, including UAE Federal Decree-Law No. 45 of 2021 (Personal Data Protection Law) and its Executive Regulations.

14. Contact Us

For any privacy-related questions, data subject requests, or complaints:

Email: privacy@serveiqai.com
General enquiries: admin@serveiqai.com
Address: Dubai, United Arab Emirates