Privacy Policy — MandateAI

1. Who We Are

MandateAI ("we", "us", "our") operates the compliance intelligence platform at mandateai.ae, providing regulatory monitoring, weekly digests, on-demand intelligence, and compliance gap assessments to fintech companies.

MandateAI is currently operating as a pre-registration entity in the Abu Dhabi Global Market (ADGM), UAE. For privacy-related matters, contact us at hello@mandateai.ae.

2. Data We Collect

Data	How collected	Purpose
Email address	Sign-up form, access gate	Account access, weekly digest delivery, platform communications
Company name	Onboarding	Personalising your compliance intelligence
Company profile (jurisdictions, industries, AI usage, data processing flags)	Onboarding	Filtering regulatory updates to those relevant to your business
Queries and questions	Platform Q&A interface	Generating your response; improving relevance matching
Compliance posture descriptions	Gap assessment tool (optional)	Generating your personalised gap assessment report
Payment information	Stripe checkout	Processing subscription payments — we do not store card details; Stripe handles payment data
Session tokens	Automatic on login	Authenticating your session for 24 hours

We do not collect biometric data, government IDs, or sensitive personal data as defined under applicable law.

3. Legal Basis for Processing

We process your personal data on the following legal bases:

Contract performance — processing necessary to provide the Platform services you have subscribed to
Legitimate interests — improving the Platform, ensuring security, and communicating relevant product updates
Consent — for marketing communications where required by applicable law
Legal obligation — where required to comply with applicable law

4. How We Use Your Data

Providing and personalising the Platform services
Delivering your weekly compliance digest and alerts
Matching regulatory updates to your company profile
Processing payments and managing your subscription
Responding to support requests
Improving the relevance and accuracy of our regulatory intelligence
Complying with our own legal obligations

We do not sell your personal data to third parties. We do not use your data to train AI models for purposes other than providing your service.

5. Data Processors and Third Parties

We use the following trusted third-party processors to operate the Platform:

Processor	Purpose	Location
Supabase	Subscriber data and regulatory database storage	EU (AWS Frankfurt)
Anthropic	AI analysis of regulatory content and Q&A responses	United States
Railway	API hosting and infrastructure	United States
Vercel	Frontend hosting	Global CDN
SendGrid (Twilio)	Email delivery (weekly digest, notifications)	United States
Stripe	Payment processing	United States

Where data is transferred outside the UAE or EU, we rely on appropriate safeguards including standard contractual clauses and adequacy decisions.

Note regarding Anthropic: Queries submitted through the Platform are processed by Anthropic's Claude API. We do not submit personally identifiable information to Anthropic beyond what is necessary to answer your query. Anthropic's data processing is governed by their own privacy policy and API data processing terms.

6. Data Retention

Active subscriber data — retained for the duration of your subscription plus 12 months
Waitlist data — retained for 24 months or until you request deletion
Session tokens — expire automatically after 24 hours
Regulatory update history — retained indefinitely as part of your compliance audit trail
Payment records — retained as required by applicable financial regulations

7. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

Access — request a copy of the personal data we hold about you
Correction — request correction of inaccurate data
Deletion — request deletion of your personal data (subject to legal retention obligations)
Portability — receive your data in a structured, machine-readable format
Objection — object to processing based on legitimate interests
Withdrawal of consent — where processing is based on consent

To exercise any of these rights, email hello@mandateai.ae. We will respond within 30 days.

8. Security

We implement appropriate technical and organisational measures to protect your personal data, including:

Encrypted data transmission (TLS/HTTPS) across all Platform interfaces
Access controls limiting data access to authorised personnel and systems
Session token authentication with 24-hour expiry
Isolated infrastructure separate from public AI systems

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify you and relevant authorities as required by applicable law.

9. Cookies

The Platform uses session storage (not persistent cookies) to maintain your authenticated session. Session storage data is cleared when you close your browser. We do not use tracking cookies, advertising cookies, or third-party analytics that process personal data.

10. Applicable Law

This Privacy Policy is governed by the laws of the Abu Dhabi Global Market (ADGM), UAE. Where subscribers are located in the EU or DIFC, we additionally comply with the EU General Data Protection Regulation (GDPR) and DIFC Data Protection Law No. 5 of 2020 respectively.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified by email at least 14 days before taking effect. The current version is always available at mandateai.ae/privacy.html.

12. Contact

For privacy questions, data subject requests, or complaints, contact us at hello@mandateai.ae.

If you are not satisfied with our response, you may have the right to lodge a complaint with the relevant supervisory authority in your jurisdiction.