Effective date: 4 September 2026
Last updated: 4 September 2026
This Privacy and Data Protection Policy describes how INOVUI AI DEVELOPING SERVICES (“Inovui,” “we,” “us,” or “our”), a business established in Dubai, United Arab Emirates, collects, uses, stores, discloses, transfers, and protects Personal Data.
Trade licence number: 1570224
Registered office: Umm Ramool, Dubai, United Arab Emirates
Website: https://www.inovui.net
Privacy contact: privacy@inovui.net
Inovui provides artificial-intelligence, workflow-automation, business-communication, customer-support, booking, ordering, follow-up, sales, payment, analytics, and systems-integration services.
This Policy applies to:
visitors to our website;
prospective and current clients;
authorised users of our platforms and integrations;
persons who communicate with Inovui or with a business using Inovui services;
end customers whose information is processed through a client-configured workflow;
users interacting with connected third-party platforms, including WhatsApp, Instagram, Meta services, payment services, booking systems and other business platforms.
This Policy should be read together with our Terms of Service, applicable client agreement, Data Processing Agreement and any service-specific notice.
Inovui processes Personal Data in accordance with applicable United Arab Emirates laws, including Federal Decree-Law No. 45 of 2021 Concerning the Protection of Personal Data, together with applicable implementing decisions, sector-specific requirements and other mandatory privacy, communications and cybersecurity laws.
Where another jurisdiction’s mandatory privacy law applies to a particular person or processing activity, Inovui will also comply with that law to the extent required.
Nothing in this Policy limits rights that cannot lawfully be excluded or restricted.
Inovui may process Personal Data in different legal capacities.
Inovui acts as Controller when it determines why and how Personal Data is processed, including in relation to:
operation of the Inovui website;
business enquiries and sales;
client onboarding;
contracts, accounts and billing;
Inovui’s own Instagram, WhatsApp and other business accounts;
security, fraud prevention and legal compliance;
administration of our client relationships.
When a client uses Inovui to process information relating to that client’s customers, employees, users or contacts, the client will normally act as Controller and Inovui will act as Processor or service provider on the client’s documented instructions.
In those circumstances, the client is responsible for:
establishing a lawful basis for processing;
giving required privacy notices;
obtaining valid consent where required;
responding to Data Subject requests;
ensuring that information submitted to Inovui was collected lawfully.
Inovui may refuse instructions that we reasonably believe are unlawful, insecure or inconsistent with applicable platform rules.
If your data was submitted through a business using Inovui, you should normally direct your privacy request to that business. You may also contact us, and we will assist the relevant client where legally required.
Depending on the service and context, we may process the following categories.
IP address;
browser, device and operating-system information;
approximate location derived from IP address;
date, time and duration of access;
referring pages and pages viewed;
cookie identifiers and consent preferences;
security, diagnostic and server logs.
name;
business name and position;
business email address and telephone number;
country and preferred language;
enquiry, correspondence and meeting information;
proposals, agreements and support requests.
authorised-user details;
business locations, working hours and contact channels;
services, products, menus or catalogues;
workflow instructions and business rules;
integration settings;
access roles;
subscription, invoice and transaction records.
Depending on how a client configures a workflow, information may include:
name, telephone number, username or platform identifier;
messages, enquiries and support conversations;
booking, appointment or order information;
delivery or service location;
product or service preferences;
follow-up status and customer-service history;
payment status, transaction reference and related operational information.
We do not ordinarily receive or store complete payment-card numbers. Card information is entered directly into the environment of the relevant payment provider, such as Stripe, and is processed under that provider’s terms and privacy policy.
Where a client or authorised user connects a third-party platform, we may process identifiers, content, events, metadata, authentication information and operational records made available through that platform’s authorised API.
We only request permissions reasonably necessary to provide the enabled integration.
Our services are not designed for the routine collection of health, biometric, genetic, religious, political, criminal-record or other Sensitive Personal Data.
Clients and users must not submit Sensitive Personal Data unless it is strictly necessary, lawful, covered by appropriate notice or consent, and expressly supported by the applicable service agreement.
Where Sensitive Personal Data is submitted through a client-controlled workflow, Inovui processes it only as necessary to provide the service, on the client’s documented instructions and subject to applicable law.
We may receive Personal Data:
directly from you;
from a business using Inovui;
from authorised users and administrators;
through connected APIs, webhooks and integrations;
from Meta, Instagram, WhatsApp or other connected platforms;
from payment, booking, CRM or communication providers;
automatically from devices, servers and security systems;
from publicly available sources where use is lawful and compatible with the original purpose.
We do not use unlawful scraping or attempt to bypass access controls, platform permissions or privacy settings.
We process Personal Data only for specific and lawful purposes, including:
responding to enquiries;
preparing proposals and entering into contracts;
configuring and delivering automation services;
processing bookings, orders, enquiries and support workflows;
assisting clients with follow-ups and customer communication;
generating, reviewing or sending context-relevant responses;
integrating authorised third-party systems;
creating payment links or sessions and recording payment status;
providing technical support;
authenticating users and managing permissions;
preventing fraud, abuse and unauthorised access;
monitoring reliability and diagnosing technical failures;
maintaining processing, security and audit records;
complying with legal and regulatory obligations;
establishing, exercising or defending legal claims;
improving service reliability using aggregated or anonymised information.
We do not sell Personal Data or Meta Platform Data.
We do not use Personal Data obtained through a client integration for unrelated advertising, data-broker activity or independent profiling.
Where consent is required, we will obtain clear and specific consent before processing and will provide a means to withdraw it.
Where permitted under applicable UAE law, Personal Data may also be processed without consent when processing is necessary:
to take steps requested before entering into a contract;
to perform or manage a contract;
to comply with a legal obligation;
to protect the interests of the Data Subject;
to establish, exercise or defend legal claims;
in relation to Personal Data deliberately made public by the Data Subject;
for another exception expressly permitted by applicable law.
Where another applicable law recognises additional lawful grounds, we may rely on those grounds only when their requirements are satisfied.
Withdrawal of consent does not affect processing lawfully performed before withdrawal.
Some Inovui services use artificial-intelligence models to:
understand the context of a message or request;
extract structured information;
analyse permitted image or text content;
classify an enquiry;
prepare a suggested response;
validate a response against business instructions;
support workflow routing and quality control.
AI-generated outputs may be inaccurate or incomplete. Depending on the client’s configuration, an output may be reviewed by a human or processed automatically under predefined validation and safety rules.
Inovui does not use Client Data, End-Customer Data or Meta Platform Data to train Inovui-owned or third-party general-purpose AI models. For workflows containing such data, we configure supported AI routes to prohibit model training and to use zero-data-retention endpoints where available.
AI providers receive only the data reasonably necessary to perform the requested task. We do not authorise AI providers to use that data for their independent advertising, profiling or model-training purposes.
We do not use solely automated processing to make decisions that produce legal effects or similarly significant effects concerning an individual unless:
the processing is authorised by applicable law;
appropriate notice has been provided;
a lawful basis exists; and
required safeguards, including human review or the right to object, are available.
Users should not submit confidential or Sensitive Personal Data to an AI-enabled workflow unless expressly required and authorised.
This section applies when an Instagram or Meta account is connected to Inovui.
As of the Effective Date, the Inovui Instagram integration requests the following permissions:
instagram_business_basic;
instagram_business_manage_comments.
We may process:
Instagram business-account ID and username;
media ID, type, caption, permalink and timestamp;
permitted media or thumbnail content required for contextual analysis;
comment ID, comment text, parent-comment information and timestamp;
commenter’s platform-scoped identifier and username;
webhook and event metadata;
access tokens and authorisation status;
generated reply, validation result and related operational records.
We process this information only to:
connect and verify an authorised Instagram business account;
receive permitted comment events;
retrieve context for the relevant post;
understand the comment and post context;
prepare and validate an appropriate reply;
publish a reply where the account owner has enabled publication;
prevent duplicate, unsafe or unauthorised responses;
maintain security and operational audit records;
comply with Meta’s applicable terms and developer policies.
We do not use Meta Platform Data to:
build advertising profiles;
sell or license data;
identify individuals outside the permitted integration;
enrich unrelated databases;
perform facial recognition;
infer Sensitive Personal Data;
train general-purpose artificial-intelligence models;
contact a person outside the context authorised by the connected account;
access direct messages, insights, advertising data or other information not covered by granted permissions.
Temporary media files used for contextual analysis are not retained longer than necessary to complete that analysis and are subject to the retention periods below.
Account owners may disconnect the integration at any time. Disconnection stops new collection and initiates revocation or deletion of stored access credentials and associated Platform Data, subject to legal exceptions.
Where WhatsApp or another communication platform is connected, Inovui may process permitted contact identifiers, message content, timestamps, delivery information and workflow context necessary to provide the configured service.
The business controlling the connected channel is responsible for ensuring that communications, templates, marketing messages and customer contacts comply with consent, anti-spam, platform and consumer-protection requirements.
Inovui does not use communication data for unrelated marketing or independent contact with the client’s customers.
Payment transactions may be processed through third-party payment providers such as Stripe.
Inovui may create a payment link or checkout session and receive limited information such as:
payment status;
amount and currency;
transaction or session reference;
payment date;
limited customer or billing details;
refund or failure status.
Complete card details are processed by the payment provider and are not ordinarily stored by Inovui.
We may disclose Personal Data only when reasonably necessary to:
provide the requested service;
follow a client’s lawful instructions;
maintain security and reliability;
comply with law;
protect legal rights;
complete a business restructuring subject to appropriate safeguards.
Relevant recipients may include:
cloud and infrastructure providers, including Elestio and Supabase;
AI routing and model providers, including OpenRouter and an approved model provider;
Meta Platforms and connected Meta services;
payment providers such as Stripe;
email, communication, booking and CRM providers;
professional advisers, auditors and insurers;
governmental, judicial or regulatory authorities where legally required;
a purchaser or successor in connection with a lawful merger, acquisition or restructuring.
Service providers are permitted to process data only for the relevant service and subject to their applicable contractual, security and privacy obligations.
A current list of material subprocessors may be requested from privacy@inovui.net. Where required by a client agreement or applicable law, we will provide notice of material subprocessor changes.
Inovui is established in the UAE, but some service providers and connected platforms may process data in the UAE, European Economic Area, United States or other countries in which they or their infrastructure operate.
Before making a cross-border transfer, we consider:
the nature and sensitivity of the data;
the destination and applicable protections;
the purpose and necessity of the transfer;
the provider’s contractual and security commitments;
available data-residency and zero-retention controls.
Where required, transfers are made using a legally permitted mechanism, such as:
transfer to a jurisdiction recognised as providing adequate protection;
contractual safeguards;
binding organisational safeguards;
explicit consent meeting applicable requirements;
necessity for contract performance or another exception permitted by law.
We will provide additional information about a material transfer and its safeguards where required by law.
We retain Personal Data only for the period necessary for the stated purpose, contractual requirements, security, dispute resolution and legal obligations.
Unless a shorter period is required by law, contract, platform requirement or deletion request, the following periods apply:
raw webhook payloads and temporary integration data: up to 30 days;
temporary media files used for AI analysis: deleted after processing where technically practicable and no later than 30 days;
technical, diagnostic and security logs: up to 90 days;
operational records, generated replies, validation records and workflow audit data: up to 12 months;
structured post or integration context: while required for the active integration, subject to a maximum operational retention of 12 months unless refreshed or required by contract;
access tokens and credentials: while the integration remains authorised; revoked or deleted promptly after disconnection and no later than 30 days;
backup copies: isolated from ordinary use and overwritten or deleted within the backup lifecycle, ordinarily within 90 days;
contracts, invoices and transaction records: for the period required by applicable tax, accounting, commercial or legal obligations;
unresolved complaints, disputes or security investigations: until properly resolved and any applicable legal period expires.
When an account or integration is disconnected, associated Platform Data will be deleted from active systems within 30 days unless retention is legally required. Data in protected backups will be removed through the normal backup cycle within 90 days and will not be restored to active use except when necessary for disaster recovery.
Data may be retained in anonymised form where it can no longer reasonably identify an individual.
Inovui applies technical and organisational measures appropriate to the nature of the information and the relevant risks. These measures may include:
encrypted network transmission;
access controls and least-privilege permissions;
separation of client environments or records where appropriate;
secure credential and token management;
authentication and role management;
system logging and monitoring;
backup and recovery controls;
software updates and vulnerability management;
restrictions on staff and service-provider access;
incident-response and credential-revocation procedures;
periodic review of access and data-retention practices.
No internet transmission or storage system can be guaranteed to be completely secure. Users and clients must protect their credentials, use appropriate access controls and notify us promptly of suspected unauthorised access.
We do not claim that a service or environment is ISO 27001, SOC 2 or otherwise certified unless that certification applies to the identified service and can be independently verified.
If Inovui becomes aware of a Personal Data Breach, we will investigate, contain and remediate it without undue delay.
Where legally required, we will notify the relevant Controller, competent UAE authority and affected Data Subjects, considering the nature of the breach and the likely risk to privacy, confidentiality and security.
Clients must notify Inovui promptly of any suspected compromise involving an Inovui integration, credential or workflow.
Subject to applicable law and lawful exceptions, you may have the right to:
obtain information about the Personal Data we process;
access and receive a copy of your Personal Data;
request transfer of eligible data in a structured and machine-readable format;
correct inaccurate or incomplete information;
request deletion of Personal Data;
restrict or suspend particular processing;
object to or stop processing for direct marketing;
withdraw consent;
object to certain automated decisions;
request human review of a qualifying automated decision;
complain to a competent supervisory authority.
A request may be refused or limited where permitted by law, including when disclosure would adversely affect another person’s privacy, reveal protected information, interfere with legal proceedings, compromise security or conflict with a legal retention obligation.
We may request information reasonably necessary to verify identity, authority and the scope of the request.
We will respond within the period required by applicable law and aim to complete verified ordinary requests within 30 days.
To request deletion, email:
Use the subject:
Data Deletion Request
Include, where applicable:
your name;
the relevant business or client;
your Instagram, WhatsApp or other platform username;
the connected account or service;
the approximate date of interaction;
the data you want deleted.
Do not send passwords, access tokens or full payment-card information.
We may ask for additional information to verify that the request relates to you or that you are authorised to act for the relevant account.
After verification, we will:
identify the relevant data;
disconnect or revoke applicable integration access where requested;
delete eligible data from active systems within 30 days;
ensure remaining backup copies expire within the normal backup cycle, ordinarily within 90 days;
confirm completion or explain any lawful exception.
Deletion may be limited where retention is necessary to comply with law, resolve a dispute, investigate fraud or security, enforce an agreement, or establish or defend legal claims.
Instagram and Meta users may also remove the relevant app through their Meta or Instagram account settings. Removing access prevents future authorised collection but does not replace a deletion request for data already lawfully stored.
We send electronic marketing only where permitted by applicable law.
You may unsubscribe using the link in the communication or by contacting privacy@inovui.net. Operational, contractual, security and service communications are not marketing and may continue where necessary.
We do not use Meta Platform Data or client end-customer data to market Inovui services directly to those end customers unless separate valid authorisation and a lawful basis exist.
We may use cookies or similar technologies necessary for:
website operation;
security;
session management;
remembering consent choices;
performance and analytics, where enabled.
Strictly necessary cookies may operate without optional consent where legally permitted. Non-essential analytics, advertising or tracking cookies will not be activated until required consent has been obtained.
Users may manage non-essential cookies through the website’s consent controls or browser settings. Disabling necessary cookies may affect website functionality.
Any materially different advertising or cross-site tracking activity will be disclosed through an updated cookie notice before it is enabled.
Inovui services are intended for businesses and authorised adult users and are not directed to children under 18.
We do not knowingly collect children’s Personal Data for our own purposes. Where information relating to a minor is submitted through a client-controlled service, the client is responsible for ensuring that the processing is lawful and that any required parent or guardian authorisation has been obtained.
If you believe that a child’s data has been processed improperly, contact privacy@inovui.net.
Our website and services may contain links to or integrate with third-party services. Those services operate under their own terms and privacy policies.
Inovui is not the Controller of information independently collected by a third party outside Inovui’s instructions or systems. Users should review the third party’s privacy policy before providing information to it.
This does not limit Inovui’s responsibility for selecting and managing processors where applicable law makes Inovui responsible.
We may update this Policy to reflect changes in law, services, processing activities, integrations or security practices.
The updated version will be posted on our website with a revised “Last updated” date. Where a change materially affects an existing processing activity, we will provide additional notice or obtain renewed consent where required.
Historical versions may be requested from privacy@inovui.net.
Questions, requests and complaints may be sent to:
INOVUI AI DEVELOPING SERVICES
Dubai, United Arab Emirates
Email: privacy@inovui.net
Website: https://www.inovui.net
We will investigate privacy complaints in good faith.
If you believe your rights have not been properly addressed, you may submit a complaint to the UAE Data Office or another competent UAE supervisory or regulatory authority, subject to the applicable complaint procedures.
This Policy is interpreted in accordance with mandatory laws applicable to the relevant processing, with UAE federal law serving as Inovui’s primary legal framework.
Any contractual dispute, governing-law provision or jurisdiction clause applicable to a client relationship will be addressed in the relevant Terms of Service or client agreement and will not limit non-waivable privacy rights.
© Copyright Powered by wakeupstudio.ae
