How we handle your data.

OpeAre is operated by OpeAre FZ-LLC, a company incorporated in the United Arab Emirates. References to “OpeAre”, “we”, “us” or “our” in this policy mean OpeAre FZ-LLC. You can reach us at contact@opeare.com.

We collect the following categories of personal data:

• Account data — name, work email, role, company name and authentication credentials.
• Operational data — documents, contracts, policies, governance records and any other content you upload to your workspace.
• Usage data — IP address, browser, device and pages accessed, used to operate the service and produce audit logs.
• Billing data — company name, billing address and payment metadata processed by our payment provider.

• To provide the OpeAre platform and the modules you have subscribed to.
• To maintain a complete audit trail of access and actions, in line with the security commitments described below.
• To bill you and prevent fraud.
• To respond to support enquiries.
• To comply with legal obligations under UAE PDPL and other applicable law.

We never sell your data. We never share your data with third parties for marketing purposes. We never use your operational data to train AI models.

OpeAre processes and stores personal data on servers located in the United Kingdom and European Union, operated by Amazon Web Services (AWS) via Supabase.

This transfer of personal data from the United Arab Emirates to the UK and EU is conducted under the safeguards required by the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021), specifically:

• The UK and EU provide substantively equivalent data protection to PDPL through their respective data protection laws (UK GDPR, EU GDPR)
• Standard Contractual Clauses (SCCs) govern data processing between OpeAre and AWS
• Technical safeguards including end-to-end encryption, data isolation, and access controls
• Contractual commitments by OpeAre and AWS not to disclose your data to any third party except as required by law

By using OpeAre, you acknowledge and consent to this international transfer of your personal data. You may withdraw this consent at any time by deleting your account, in which case all your data will be securely deleted within 30 days of confirmation.

If you require UAE-only data residency for regulatory or contractual reasons, please contact us at contact@opeare.com to discuss enterprise hosting options.

We protect your data with:

• TLS 1.3 encryption in transit.
• AES-256 encryption at rest.
• Per-company data isolation enforced at the database level.
• A complete audit log of every access and action against your workspace.
• Regular backup and disaster-recovery testing across the AWS eu-west-2 (London) region.

You can read more about our infrastructure on the trust page.

We retain your personal data for as long as your account is active and for up to 30 days after account deletion, after which it is permanently deleted from our production systems and from backups within the next backup-rotation cycle. Audit log entries required by law may be retained for the statutory minimum period.

Under UAE PDPL, UK GDPR and EU GDPR you have the right to access, rectify, erase, restrict and port your personal data, and to object to its processing. You also have the right to withdraw consent at any time. To exercise any of these rights, email contact@opeare.com.

We use a limited number of sub-processors to operate OpeAre. The current list and their role is published in our Data Processing Agreement.

We will notify you by email of any material change to this policy at least 30 days before it takes effect.

Questions or concerns? Email contact@opeare.com.