Privacy Policy — United Arab Emirates

1. Who is the Data Controller?

The Data Controller responsible for your personal data is:

Although Creator Business OS Ltd is incorporated in the United Kingdom, we serve customers in the UAE and are committed to complying with UAE Federal Decree-Law No. 45 of 2021 on Personal Data Protection (PDPL) and its Executive Regulation for all UAE-based customers and data subjects.

2. Personal Data We Collect

Account and Identity Data

• Full name, email address, password (stored as a secure hash)
• Profile photo (optional)
• Two-factor authentication (TOTP) credentials

Company and Business Data

• Company name, address, phone, email
• UAE Tax Registration Number (TRN) and Trade Licence Number
• Bank account details used for payment processing
• Company logo and branding assets

Employee and Payroll Data

• Employee names, Emirates ID (UID), UAE Labour Card number, Emirate of residence
• Salary information, GPSSA contributions (for UAE nationals and GCC nationals)
• End of Service Gratuity (EOSG) calculations
• WPS (Wage Protection System) file data submitted to MOHRE

Financial and Transaction Data

• Invoices, quotations, purchase orders, expense claims
• VAT return data submitted to FTA EmaraTax
• Payment records, bank reconciliation data

Usage and Technical Data

• IP address, browser type, device information
• Session activity, audit log entries
• Error and performance logs

3. Purposes and Legal Basis for Processing

Under Article 4 of the UAE PDPL, we process personal data on the following legal bases:

Contractual Necessity

Processing your data is necessary to provide the Filssi platform services you have subscribed to, including account management, payroll processing, invoicing, accounting, and CRM functionality.

Legal Obligation

We process data to comply with UAE legal requirements, including:

• Ministry of Human Resources & Emiratisation (MOHRE) WPS wage protection reporting
• General Pension & Social Security Authority (GPSSA) contribution reporting
• Federal Tax Authority (FTA) VAT return filing
• UAE Labour Law (Federal Decree-Law No. 33 of 2021) compliance

Legitimate Interests

We process data for fraud prevention, platform security, service improvement, and aggregated analytics to maintain and enhance the Filssi platform.

Consent

Where we send marketing communications, we rely on your explicit consent (provided during signup) and provide an easy mechanism to withdraw consent at any time via the unsubscribe link in every marketing email.

4. When We Share Your Data

We do not sell your personal data. We share data only in the following circumstances:

Service Providers (Data Processors)

• Neon (PostgreSQL database hosting) — your data is stored on Neon's secure cloud infrastructure
• Resend / email delivery — for transactional and account-related emails
• Stripe — for subscription billing and payment processing
• OpenAI — for AI specialist chat features (data is not used to train OpenAI models)
• Replit (hosting infrastructure) — platform hosting and object storage
• OCR.space — for AP email capture document processing

Regulatory Authorities

We may share data with UAE regulatory bodies (FTA, MOHRE, GPSSA) as required by law, and only the data legally required for those filings.

Legal Requirements

We may disclose personal data if required by UAE law, court order, or to protect the legal rights of Creator Business OS Ltd or its customers.

5. How Long We Keep Your Data

We retain personal data for as long as your account is active and for a further period as required by applicable law:

• Account data: For the duration of your subscription plus 12 months after cancellation
• Financial records (invoices, payroll, VAT returns): 5 years from the end of the relevant financial year, in accordance with UAE Federal Law No. 2 of 2015 (Commercial Companies Law)
• Payroll and EOSG records: 5 years, or for the duration of the employment relationship plus 2 years
• Audit logs: 2 years
• Marketing consent records: Until consent is withdrawn plus 3 years

6. Cross-Border Data Transfers

Your data is primarily processed on infrastructure located in the United States and European Union (via our sub-processors listed above). Under Article 22 of the UAE PDPL, we ensure any cross-border transfer of personal data is conducted with appropriate safeguards, including:

• Contractual data processing agreements with all sub-processors
• Transfers only to countries or processors providing an adequate level of protection
• Standard contractual clauses where required

Creator Business OS Ltd is incorporated in the United Kingdom, which applies UK GDPR standards to its own operations. Data processed on behalf of UAE customers is handled with equivalent diligence under the UAE PDPL framework.

7. Your Rights under UAE PDPL

Under Federal Decree-Law No. 45 of 2021, UAE data subjects have the following rights:

To exercise any of these rights, contact us at privacy@creatorbusinessos.com. We will respond within 30 days.

8. Security Measures

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction, including:

• TLS/HTTPS encryption for all data in transit
• Encrypted passwords using scrypt with secure salting
• Two-factor authentication (TOTP) available for all accounts
• Role-based access control (RBAC) with granular permissions
• Session idle timeouts and secure session fixation prevention
• Comprehensive audit logging of all data access and modifications
• HTTP security headers: HSTS, CSP, X-Frame-Options, and others
• Rate limiting and account lockout on all authentication endpoints

In the event of a personal data breach affecting your data, we will notify you within 72 hours of becoming aware, in accordance with Article 16 of the UAE PDPL.

9. Cookies and Tracking

Filssi uses only essential session cookies required for the operation of the platform. We do not use advertising cookies, behavioural tracking pixels, or third-party marketing cookies. Essential cookies are necessary for you to use the service and cannot be disabled without breaking core functionality.

For full details, see our Cookie Policy.

10. Children's Privacy

Filssi is a business platform intended for use by adults aged 18 and over. We do not knowingly collect personal data from individuals under the age of 18. If you believe a minor has provided us with personal data, please contact us immediately at privacy@creatorbusinessos.com.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or in applicable law. We will notify you of material changes by email or by displaying a prominent notice in the Filssi platform at least 14 days before the changes take effect. Your continued use of Filssi after the effective date constitutes acceptance of the updated policy.

The most current version of this policy is always available at filssi.com/privacy-uae.

12. Contact & Complaints

For any privacy-related questions, requests to exercise your rights, or to report a concern:

If you are unsatisfied with our response, you have the right to lodge a complaint with the UAE Data Office:
Website: www.dataoffice.gov.ae
The UAE Data Office is the national supervisory authority responsible for enforcing the UAE PDPL.