Privacy Policy
UTICOS LLC · Last updated: [DATE OF PUBLICATION]
DRAFT: for review by the operator and a UAE-qualified lawyer before publication.
This policy explains:
- what personal data UTICOS LLC ("UTICOS", "we", "us") collects;
- why we collect it, how we use and share it, and how long we keep it; and
- the rights you have over it.
It applies to the uticos.com website, the UTICOS application and our related services.
UTICOS LLC is licensed in the Sharjah Media City (Shams) free zone, United Arab Emirates. For the personal data described here, we are the data controller. The exception is personal data inside content our customers upload: there, we process it on their behalf, as a processor (see section 7). We follow the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the "PDPL"). Where the EU or UK GDPR applies to you, we follow it too.
1. Who this policy covers
- Customers and their team members: people who create or use a UTICOS account.
- Visitors: people who browse our website or contact us.
- People connected to public business accounts we analyse: see section 4.
UTICOS is for businesses and for people aged 18 or over. We do not knowingly collect data from children. If you believe a child has given us personal data, write to technical@uticos.com and we will delete it.
2. What we collect
Account data. Your name, email address and password. We store the password only as a one-way cryptographic hash, never in readable form. We also keep your role in the account, your team invitations, and your account and plan status.
Business data you provide. This includes:
- business name, website address, industry, country and city;
- products and services, with their descriptions and photos;
- photos of your places;
- logos, brand colour and typeface;
- the target customer profile (for example age range and gender);
- facts about your business that you confirm; and
- your choices, briefs, edits and instructions.
Most of this is business information. It may include personal data, for example a founder's name, or people who appear in photos you upload.
Website scan data. If you give us your website address, we read its public pages to suggest business details, products and facts. Nothing found there is used for your content until you confirm it.
Generated content. The campaigns, captions, reels, images, carousels, music and voice-overs created for you, with their history and versions.
Your public social posts. If you give us your business's public Instagram handle, we read your public posts to learn what already works for you. We do not ask for your social media password, and we do not post on your behalf.
Usage and billing data. We record:
- your COS balance, holds, charges and refunds;
- the assets you created; and
- the plan and payment status our payment provider reports to us.
The payment provider processes your card details. We never receive or store full card numbers.
Technical data. We collect:
- IP address and request logs, which we use for security, for example to limit repeated failed sign-ins;
- device and browser type;
- error reports; and
- session cookies (see section 9).
Messages. What you send through our contact form or by email, including your name, email, subject and message.
3. Why we use it, and on what basis
| Purpose | Legal basis |
|---|---|
| Creating and running your account, providing the Service, and producing your plans and assets | Performance of our contract with you |
| Charging COS, billing, invoicing and preventing abuse of trials and credits | Performance of contract; legal obligations; legitimate interests in preventing fraud |
| Security, rate limiting, debugging and keeping the Service reliable | Legitimate interests; legal obligations |
| Answering your messages and providing support | Performance of contract; legitimate interests |
| Sending service emails (receipts, notices, changes to terms) | Performance of contract; legal obligations |
| Industry analysis of public business accounts (section 4) | Legitimate interests in providing market intelligence based on publicly available information |
| Marketing emails about UTICOS | Your consent, which you can withdraw at any time |
We do not sell personal data. We do not use your content or your customers' data to train our own AI models.
4. Public accounts we analyse
To show which types of posts perform well in an industry, we analyse publicly available posts and engagement counts from selected business and brand accounts on social platforms. These posts are collected through a third-party data service.
- What we use. We use them to produce aggregated statistics and patterns ("plays"). We do not show those posts, their images or their captions to our customers, and we do not build profiles of private individuals.
- What we keep. We keep the account handle, post metadata and the analysis we derive from each post.
- Other people in posts. Posts may show people, or include comments from members of the public. We do not use them to identify or profile those individuals.
- Removal. If you manage one of these accounts, or appear in such content, and want it excluded from our analysis, write to technical@uticos.com. We will review the request promptly and, where appropriate, remove the data.
5. AI providers and other processors
We use carefully selected service providers ("sub-processors") to run UTICOS. Each receives only the data it needs for its task and is bound by contract, or by its published data protection terms, to protect it.
| Provider | What it does for UTICOS | Data it may receive |
|---|---|---|
| Anthropic | AI text and image analysis (plans, captions, briefs, photo reading) | Business data, product and place photos, instructions |
| BytePlus | AI video and image generation | Prompts, product and place photos |
| ElevenLabs | Music and voice-over | Scripts and the reel's video for music |
| Apify | Collecting public website and public social media content | Website addresses and public account handles |
| Neon | Database hosting | Account, business, billing and content data |
| Cloudflare (R2) | File and media storage | Photos and generated media |
| Fly.io | Application servers | All Service data in transit and during processing |
| Upstash | Temporary data for queues and rate limits | Technical data, short-lived job data |
| Sentry | Error monitoring | Technical data in error reports |
| Resend | Sending emails | Email addresses and message content |
| Stripe | Payments (when enabled) | Billing details and payment status |
| Vercel | Website hosting | Technical data such as IP addresses and requests |
We review this list when it changes and update this policy.
6. International transfers
Our providers operate in several countries, including the United States and the European Union, so your data may be processed outside the UAE. When we transfer personal data internationally, we rely on:
- the conditions the PDPL allows; and
- contractual safeguards, such as the providers' data processing terms and standard contractual clauses where they apply.
Our application servers (Fly.io) and our database (Neon, AWS eu-central-1) are in Frankfurt, Germany. [CONFIRM: the region of the Cloudflare R2 storage bucket.]
7. Data our customers upload
Customers may upload content that contains personal data about other people, for example people in product or place photos. For that data:
- we act as a processor on the customer's behalf;
- the customer is responsible for having the right and the consent to use it; and
- we use it only to provide the Service to that customer.
Requests about such data should go to the customer first. We will help them respond.
8. How long we keep data
| Data | How long |
|---|---|
| Account, business and generated content | While your account is open. After closure, deleted within 30 days, unless the law requires longer |
| Backups | Overwritten on the backup provider's rolling cycle [CONFIRM: retention period, e.g. up to 30 days] |
| Billing and transaction records | As long as UAE tax and commercial law requires [CONFIRM: typically at least 5 years] |
| Security logs and rate-limit data | Short periods, usually days to weeks |
| Contact messages | Up to 2 years after the conversation ends, unless they relate to an open matter |
| Industry analysis data | While it is relevant to our analysis, and reviewed at least yearly |
9. Cookies
We use only what the Service needs to work:
- a session cookie to keep you signed in; and
- small preferences for the interface.
We do not use advertising or cross-site tracking cookies. If we ever add optional analytics or marketing cookies, we will ask for your consent first.
10. Your rights
Subject to the conditions the law sets, you have the right to:
- Access: receive a copy of your personal data and information about how we use it.
- Correction: have inaccurate data corrected. Much of it you can edit yourself in Settings.
- Deletion: have your data erased.
- Restriction: limit or stop processing, and object to processing based on legitimate interests or used for direct marketing.
- Portability: receive your data in a structured, common format.
- Withdraw consent: at any time, where processing is based on consent.
- Automated decisions: not be subject to decisions based solely on automated processing that significantly affect you. UTICOS does not make such decisions about individuals; its automated recommendations are about marketing content.
- Complaint: complain to the UAE Data Office or your local data protection authority.
To use any of these rights, write to technical@uticos.com from your account email. We will reply within 30 days. We may need to verify your identity first.
11. Security
We protect personal data with technical and organisational measures that suit the risk. They include:
- encryption in transit;
- hashed passwords;
- access controls by account;
- limits on sign-in attempts;
- the least access necessary for staff and systems; and
- monitoring.
No system is completely secure. If a breach affects your personal data and is likely to put your rights at risk, we will notify you and the competent authority as the law requires. See our Security page for more.
12. Changes
We may update this policy. If we make significant changes, we will tell you by email or in the app before they take effect. The "Last updated" date shows the current version.
13. Contact
UTICOS LLC, Sharjah Media City (Shams) free zone, Sharjah, United Arab Emirates.
- Privacy and data protection: technical@uticos.com