Privacy Policy

Last updated: January 1, 2026

This Privacy Policy explains how Ayatii (“Ayatii,” “we,” “our,” “us”) collects, uses, shares and protects personal data when you visit ayatii.com (the “Site”), contact us, or use our anti-piracy and brand protection services. Please read it together with any agreement we sign with you.

1. Who We Are (Data Controller)

Ayatii is a Dubai-based anti-piracy and brand protection company. For the personal data described in this Policy, Ayatii is the data controller, except where we process data on a client’s behalf under a services agreement, in which case the agreement will say so.

2. Information We Collect

Contact form and enquiries. If you use our contact form, email or call us, we receive your name, email address, phone number, company name, the service you are interested in, how you heard about us, and the content of your message.

Client account and service data. If you become a client, we hold the business contact details of your team, contract and billing details, and the instructions and information you give us to deliver the service.

Content submitted for protection. Clients may give us titles, catalogues, brand assets, trademarks, rights information, reference files, fingerprints or watermark data, and proof of ownership or authorization so that we can identify and act on infringements.

Payment information. Where services are paid for, we process invoicing and payment details such as billing name, company, address and transaction references. Where card payments are used, they are handled by the payment provider and we do not store full card numbers.

Technical data. Like most websites, our hosting infrastructure processes your IP address, browser and device type, requested pages and timestamps in server logs, which we use to deliver and secure the Site.

Visitor analytics. We run our own first-party visitor analytics to understand how the Site is used and to detect abuse. For each visit we record a random device identifier (stored in your browser’s local storage and in a cookie named ayatii_device_id), your IP address, your approximate location (country, region and city, derived from your IP address by our hosting provider), your browser and device type, screen size, language, the referring page, the pages you view and roughly how long you spend on each. This is not combined with advertising data and is not shared with advertisers.

3. Data We Process in Enforcement Work

To remove infringing content, we process data about infringing or suspicious activity, which can include personal data of the people behind it. This may include:

  • public URLs, listings, usernames, channel and account names, and contact details published on infringing sites, apps, marketplaces and social profiles;
  • domain registration, hosting and abuse-contact information;
  • screenshots, recordings, test purchases and other evidence of infringement;
  • copies of the notices and correspondence we send to platforms, hosts, registrars, search engines and rights holders, and their responses.

We collect this data from public sources and from our own detection and monitoring. We process it to establish, exercise and defend legal claims and to protect the rights of our clients, and we share it only as needed to take action, for example with the platform or host that is being asked to remove the content, with the rights holder we act for, and with courts or authorities where required.

4. How We Use Information and Our Legal Bases

  • Respond to enquiries and prepare proposals — steps taken at your request before a contract, and our legitimate interest in running our business.
  • Provide and support our services, including client communications and billing — performance of a contract.
  • Detect infringement and send takedown notices and related enforcement — our and our clients’ legitimate interests in protecting intellectual property, and the establishment, exercise or defense of legal claims.
  • Keep the Site and our systems secure and prevent abuse, such as spam submissions — legitimate interest.
  • Meet legal, tax, accounting and regulatory obligations — legal obligation.
  • Send you information about our services, where you have agreed or where the law permits — consent or legitimate interest. You can opt out at any time.

Where we rely on consent, you can withdraw it at any time without affecting processing done before you withdrew it. We do not sell personal data.

5. Applicable Law

We handle personal data in line with the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the “UAE PDPL”) and its implementing rules. If you visit the Site from the European Union or European Economic Area, the EU General Data Protection Regulation (GDPR) also applies to our processing of your data, and the rights in section 12 apply to you as described there.

6. Cookies and Analytics

The Site does not use advertising cookies and does not run third-party analytics or advertising tools. It uses one first-party identifier, a random device ID kept in your browser’s local storage and in a cookie named ayatii_device_id (valid for one year), to recognize returning visitors, group page views into visits and enforce blocks against abusive traffic. It is not used for advertising. To show our team a readable IP address, your browser also asks a simple IP-address lookup service (api.ipify.org) for your public IPv4 address; that service receives your IP address as any website does. You can clear the identifier by clearing your browser’s site data and cookies. Our hosting provider may also keep basic server logs and security data as described in section 2. If we add other analytics or non-essential cookies in the future, we will update this Policy and, where required, ask for your consent first.

7. Who We Share Information With

We share personal data only where needed for the purposes in this Policy:

  • Service providers (processors). Vercel Inc. hosts the Site and its infrastructure. Resend delivers the email generated when you submit the contact form, so the content of your form submission passes through Resend to our mailbox. Other providers we use for email, document storage, accounting or payment processing handle data only on our instructions.
  • Platforms, hosts, registrars and search engines that receive our enforcement notices, as described in section 3.
  • Clients and rights holders on whose behalf we act.
  • Professional advisers, courts, regulators and law enforcement where required by law or to protect legal rights.
  • A successor business, if Ayatii is involved in a merger, acquisition or sale of assets, subject to this Policy.

8. International Transfers

Ayatii is based in the UAE, and our providers and the platforms we contact operate in other countries, including the United States and the European Union. Your personal data may therefore be processed outside the UAE and, for visitors in the EU/EEA, outside the EEA. Where we transfer data across borders, we do so as permitted by the UAE PDPL and the GDPR, using safeguards such as adequacy decisions, standard contractual clauses or other lawful transfer mechanisms where they are required. Enforcement notices necessarily go to the platform or host receiving them, wherever it is located.

9. Retention

We keep personal data only as long as needed for the purpose it was collected for:

  • contact form enquiries that do not lead to a contract are kept for as long as needed to respond and for a reasonable follow-up period;
  • client and billing records are kept for the duration of the relationship and for the period required by tax, accounting and commercial law;
  • enforcement records and evidence are kept while a case is active and for the limitation period for related legal claims, or as long as our client’s agreement requires;
  • server logs are kept for a short period for security and troubleshooting.
  • visitor analytics records (device identifier, IP address, approximate location and pages viewed) are deleted automatically after 90 days.

After that, we delete or anonymize the data.

10. Security

We use technical and organizational measures intended to protect personal data against unauthorized access, loss, alteration and misuse. These include encrypted connections (HTTPS) to the Site, access limited to staff and providers who need the data, and the use of reputable infrastructure providers. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If a personal data breach affects you, we will notify you and the relevant authority where the law requires.

11. Third-Party Links

The Site may link to websites and services operated by others, such as social networks or map services. We are not responsible for their privacy practices and encourage you to read their policies.

12. Your Rights and How to Exercise Them

Subject to applicable law (the UAE PDPL and, for EU/EEA individuals, the GDPR), you may have the right to:

  • ask whether we process your personal data and get a copy of it;
  • ask us to correct inaccurate or incomplete data;
  • ask us to delete your data, or restrict or stop its processing, in the cases the law provides;
  • object to processing based on our legitimate interests, and withdraw consent where we rely on it;
  • receive your data in a portable format, where this applies;
  • complain to a data protection authority, such as the UAE Data Office or, for EU/EEA residents, your local supervisory authority.

To exercise a right, email contact@ayatii.com with the subject “Privacy request” and enough detail for us to identify you and your request. We may need to verify your identity, and we will respond within the time required by law. Some rights have exceptions: for example, we may need to keep data needed to establish or defend legal claims or to meet legal obligations. If a person asks us about data we hold as a result of enforcement work, we will assess the request on its merits and tell you if we cannot fully comply and why.

13. Children

The Site and our services are directed at businesses and adults. We do not knowingly collect personal data from children under 18. If you believe a child has given us personal data, contact us and we will delete it.

14. Changes to This Policy

We may update this Policy from time to time, for example when our practices, providers or the law change. We will post the updated version on this page with a new “Last updated” date. For material changes, we will take reasonable steps to let you know.

15. Contact Us

Questions or requests about this Policy can be sent to contact@ayatii.com, by phone on +971 543509790, or by post to Ayatii, HDS Business Centre Tower, Cluster M1, Ayatii Office 32nd Floor, Dubai, UAE.