Privacy Policy

AUTOWORK AI - FZCO
Trade Licence No. 61130 · Dubai Silicon Oasis, Dubai, United Arab Emirates

Last updated: 13 August 2026
Effective date: 13 August 2026

1. Who we are

AUTOWORK AI - FZCO ("AutoWork AI", "we", "us", "our") is a company licensed in Dubai Silicon Oasis under the Dubai Integrated Economic Zones Authority (DIEZA), United Arab Emirates.

We build AI automation software for the hospitality, logistics and retail sectors. This includes our website at autowork.ae and our product Kio, an AI customer-chat agent that businesses connect to their WhatsApp and Instagram accounts.

This policy explains what personal data we collect, why we collect it, who we share it with, and what rights you have.

Contact for privacy matters: privacy@autowork.ae
Postal address: DTEC, Dubai Silicon Oasis, Dubai, United Arab Emirates

2. Who this policy applies to

This policy covers three groups of people:

Group	Who you are
Website visitors	Anyone browsing autowork.ae, filling in a contact or demo form, or subscribing to updates.
Customers (merchants)	Businesses that sign up for Kio or engage us for automation services, and the individual users at those businesses.
End customers	People who message a business that uses Kio on WhatsApp or Instagram.

Important distinction. For website visitors and our own customers, AutoWork AI is the controller — we decide why and how data is used. For end customers messaging a business through Kio, that business is the controller and AutoWork AI acts as a processor on its instructions. If you messaged a business and want your data removed, please contact that business directly; we will support them in handling your request.

3. What data we collect

3.1 Data you give us directly

• Contact and enquiry data — name, email address, phone number, company name, job title, and anything you write in a contact form, demo request or email.
• Account data — name, email address, login credentials and login history, managed through our authentication provider.
• Billing data — billing name, address, VAT/TRN where applicable, subscription plan and payment history. We do not collect or store full card numbers; card details are handled directly by our payment processor.
• Knowledge base content — the FAQs, menus, catalogues, price lists, policies and documents you upload so the AI agent can answer questions about your business. If you include personal data in these files, we process it as part of the service.
• Integration credentials — access tokens and API keys you authorise so Kio can connect to your WhatsApp Business account, Instagram account or business tools.

3.2 Data we receive through the service

• Conversation data — messages exchanged between an end customer and the AI agent, including message content, sender display name, platform user ID, phone number where the channel provides it, timestamps and message status.
• Action data — records of what the agent did in response to a request (for example a booking reference, an order lookup, or an escalation to a human agent).

3.3 Data collected automatically

• Technical data — IP address, browser type and version, device type, operating system, language and time zone.
• Usage data — pages viewed, features used, message volumes, session duration, error and diagnostic logs.
• Cookies and similar technologies — see Section 9.

3.4 Data we do not want

Please do not send us or upload special categories of data — health information, biometric data, religious or political beliefs, or government identifiers such as Emirates ID or passport numbers — unless we have agreed in writing that this is necessary for your service. We do not knowingly collect data from children under 18.

4. Why we use your data, and on what legal basis

Purpose	Data used	Legal basis
Responding to enquiries and demo requests	Contact and enquiry data	Steps taken at your request before entering a contract
Creating and managing accounts	Account data	Performance of a contract
Delivering the Kio service — generating replies, retrieving answers from your knowledge base, executing actions	Knowledge base, conversation, integration data	Performance of a contract; processing on the customer's instructions
Billing, invoicing and collections	Billing data	Performance of a contract; legal obligation
Support, troubleshooting and incident investigation	Account, usage, conversation data	Legitimate interests; performance of a contract
Security, fraud prevention and abuse detection	Technical, usage data	Legitimate interests; legal obligation
Improving reliability and quality of our software	Aggregated and de-identified usage data	Legitimate interests
Marketing emails and product updates	Contact data	Consent, or legitimate interests for existing customers
Meeting accounting, tax, audit and licensing obligations in the UAE	Billing and corporate records	Legal obligation

Where we rely on consent, you can withdraw it at any time. Withdrawing consent does not affect processing that already took place.

5. How AI processing works

Kio uses large language models to understand messages and generate replies. You should know:

• What is sent to the model. When an end customer sends a message, we send the message text, relevant extracts from the business's knowledge base, and recent conversation context to our AI model provider in order to generate a reply.
• Training. We do not use your knowledge base content or your customers' conversations to train our own models, and we use model providers under terms that exclude your data from training their general-purpose models.
• Automated decisions. The AI agent generates responses and can carry out routine actions such as answering a question, checking an order or creating a booking. It does not make decisions that produce legal effects or similarly significant effects on individuals. End customers can ask to be transferred to a human at any point.
• Accuracy. AI-generated responses can be wrong or incomplete. Businesses using Kio are responsible for the content they give the agent and for supervising its use.

6. Who we share data with

We do not sell personal data. We share it only with the following categories of recipients:

6.1 Service providers (sub-processors)

Provider	Role	Data involved
Clerk	Authentication and user management	Account data
Stripe	Payment processing and subscription billing	Billing data
Supabase	Database and file storage	Account, knowledge base, conversation data
Google (Gemini API)	AI model inference	Message content, knowledge base extracts
n8n	Workflow execution	Conversation and integration data
Meta Platforms	Message delivery channels	Conversation data, platform identifiers
Cloudflare	Application hosting & edge routing	Technical and usage data
Postmark	Transactional email	Contact, usage data

An up-to-date list of sub-processors is available on request. We put written data processing terms in place with each provider.

6.2 Others

• Our customers. If you message a business using Kio, the conversation is visible to that business.
• Professional advisers. Auditors, accountants and lawyers under confidentiality obligations.
• Authorities. Where required by UAE law, a court order, or a valid regulatory request.
• Business transfers. If we are involved in a merger, acquisition or sale of assets, data may transfer to the acquiring party under the same protections.

7. International transfers

We are based in the UAE, and some of our service providers store or process data outside the UAE, including in the United States and the European Union.

Where we transfer personal data outside the UAE, we do so on one of the following bases: the destination country provides an adequate level of protection; the transfer is covered by contractual clauses imposing equivalent safeguards; the transfer is necessary to perform a contract with you; or you have consented.

8. How long we keep data

Data	Retention period
Enquiry and demo request data	24 months from last contact
Account data	For the life of the account, then 30 days after closure
Conversation data	12 months, or the period set by the customer in their account settings
Knowledge base content	Until deleted by the customer, or 30 days after account closure
Billing, invoicing and accounting records	5 years, in line with UAE tax and commercial record-keeping requirements
Security and access logs	12 months

Customers can request earlier deletion of their workspace data at any time. Backups are overwritten on a rolling cycle and purged within 30 days.

9. Cookies

Our website uses cookies and similar technologies to keep the site working, remember your preferences, and understand how the site is used.

• Strictly necessary — required for login, security and load balancing. These cannot be switched off.
• Analytics — help us see which pages are used and where people get stuck.

You can control non-essential cookies through our cookie banner or your browser settings.

10. Security

We apply technical and organisational measures appropriate to the risk, including:

• Encryption of data in transit (TLS) and at rest;
• Role-based access control and least-privilege access for staff;
• Logical separation of each customer's workspace data;
• Secure storage of integration tokens and API keys;
• Access logging and monitoring;
• Vetting of service providers and written processing agreements.

No system is completely secure. If a personal data breach occurs that presents a risk to individuals, we will notify the UAE Data Office and affected parties as required by law, and we will inform affected customers without undue delay.

11. Your rights

Subject to UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the "PDPL") and, where it applies to you, the EU/UK GDPR, you have the right to:

• Access the personal data we hold about you;
• Correct data that is inaccurate or incomplete;
• Delete your data where there is no continuing legal or contractual reason to keep it;
• Restrict or object to certain processing;
• Receive a copy of data you gave us in a portable format;
• Withdraw consent where processing is based on consent;
• Object to automated processing that produces legal or similarly significant effects;
• Complain to the UAE Data Office or your local supervisory authority.

To exercise any of these, email privacy@autowork.ae. We will respond within 30 days. We may ask you to verify your identity first. There is no charge unless a request is manifestly unfounded or excessive.

If you are an end customer who messaged a business through Kio, please direct your request to that business.

12. Third-party platforms

Kio operates through WhatsApp and Instagram, which are provided by Meta Platforms. Your use of those apps is governed by Meta's own terms and privacy policies, which we do not control. The same applies to any third-party website we link to.

13. Changes to this policy

We may update this policy as our services or the law change. We will post the revised version here with a new "Last updated" date. If the changes are significant, we will notify customers by email or in-product notice before they take effect.

14. Contact us

AUTOWORK AI - FZCO
DTEC, Dubai Silicon Oasis, Dubai, United Arab Emirates
Email: info@autowork.ae
Website: https://autowork.ae

If you are not satisfied with our response, you may lodge a complaint with the UAE Data Office.