Privacy Policy

01Who we are and what this policy covers

DubaiBox.ai ("DubaiBox", "we", "us") builds and manages AI receptionists, appointment setters, outbound calling agents and WhatsApp automation for businesses in the UAE. Our office is at Office 1607, Empire Heights A, Business Bay, Dubai.

This policy explains how we handle personal data in two situations: when you interact with us directly, for example by visiting dubaibox.ai, messaging us or booking a demo, and when we process conversations on behalf of the businesses that use our services. We follow the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL) and other applicable UAE laws.

02Information we collect

Information you give us

• Contact details such as your name, phone or WhatsApp number, email address and company name.
• What you tell us about your business and the help you need, including messages, voice notes and files you send.
• Billing details for clients, such as invoicing contacts and trade licence information.

Information collected automatically

• Technical data such as IP address, browser type, device and pages visited on our website.
• Cookie and similar data, described in the cookies section below.

Information from conversations we handle for clients

• Call audio, recordings and transcripts, where the client has enabled them.
• WhatsApp and chat messages exchanged with the client's AI agent.
• Details captured during a conversation, such as booking times, enquiry details and preferences.

03How we use personal data

• To reply to enquiries, arrange demos and prepare quotes.
• To deliver, monitor and support the services our clients have ordered.
• To improve the accuracy of a client's own agent, using that client's conversations only for that client.
• To keep our systems secure, prevent misuse and investigate problems.
• To meet legal, tax and regulatory obligations, including telemarketing record-keeping where it applies.
• To send you service updates and, where you have agreed, occasional marketing messages.

We do not sell personal data, and we do not use one client's conversation data to train AI models for other clients.

04Our role when we work for a client

When we run an AI agent for a business, that business decides why and how its customers' data is processed. In that relationship the business is the controller and DubaiBox acts as its processor. We follow the client's documented instructions and our agreement with them.

Clients are responsible for giving their own customers the notices and obtaining the consents the law requires, for example telling callers that calls may be recorded, collecting opt-in before sending WhatsApp marketing and respecting the Do Not Call Registry. If you are a customer of one of our clients and have a question about your data, please contact that business first. We will help them respond.

05Legal grounds for processing

Depending on the situation, we rely on one or more of the following grounds recognised under UAE law:

• Consent, for example when you opt in to marketing or accept non-essential cookies. You can withdraw consent at any time.
• Performing a contract with you or taking steps you request before entering one, such as preparing a quote.
• Legal obligations, such as keeping financial records.
• Legitimate business interests, such as securing our services, where these are not overridden by your rights.

06Who we share data with

We share personal data only where needed to run our business and services, and only with parties bound by confidentiality and data protection terms:

• Hosting, storage and security providers.
• Licensed telecom carriers that connect calls and messaging.
• Meta Platforms, for messages sent through the WhatsApp Business Platform.
• Speech recognition, voice and language model providers that power the AI agents.
• CRM, calendar and booking tools that a client has asked us to connect.
• Professional advisers, such as accountants and lawyers.
• Courts, regulators or authorities, where UAE law requires it.

07International transfers and UAE hosting

Some of our technology providers store or process data outside the UAE. When that happens we use providers with appropriate safeguards and contractual protections, as the PDPL requires for cross-border transfers.

Clients in sectors with stricter rules, such as healthcare, can request UAE-hosted options so that recordings and transcripts remain in the country. Health information is handled in line with UAE health data rules, which generally require it to be stored and processed inside the UAE. You can read more in our article on data residency in the UAE.

08How long we keep data

• Enquiries and demo requests: up to 24 months after our last contact, unless you become a client.
• Client account and billing records: for as long as UAE law requires for commercial and tax records.
• Conversation data handled for clients: for the period set in the client agreement, then deleted or returned at the client's request.
• Telemarketing call records: for at least the period set by the competent UAE authority, where those rules apply to a campaign.

09How we protect data

We use encryption in transit, access controls based on role, audit logs, regular reviews of who can access what, and separate environments for each client's agent. No system is perfectly secure, but we work to reduce risk and will notify affected clients and the relevant authority of a personal data breach as UAE law requires.

10Your rights

Under the PDPL and subject to its conditions, you can ask us to:

• Tell you what personal data we hold about you and give you a copy.
• Correct inaccurate or incomplete data.
• Delete data we no longer need or have no lawful reason to keep.
• Restrict or stop certain processing, including direct marketing.
• Provide your data in a format you can move to another provider.
• Review a decision made only by automated processing that significantly affects you.

Email hi@dubaibox.ai with your request. We may need to verify your identity first and will reply within the time the law allows. If you are not satisfied, you may complain to the relevant UAE authority.

11Cookies

Our website uses essential cookies that make it work, such as security and load-balancing cookies. With your permission we may also use analytics cookies to understand which pages are useful. You can block or delete cookies in your browser settings; essential features may stop working if you block all of them.

12Marketing messages

We send marketing messages only to people who have agreed to receive them. You can opt out at any time by replying STOP on WhatsApp, using the unsubscribe link in an email or contacting us directly. Opting out of marketing does not affect service messages about an active project.

13Children

Our website and services are intended for businesses and are not directed at anyone under 18. We do not knowingly collect personal data from children through our website.

14Changes to this policy

We may update this policy when our services or the law change. The date at the top shows the latest version. If a change significantly affects how we use your data, we will tell clients directly.

15Contact us

Questions about privacy can go to hi@dubaibox.ai, by phone on +971 58 258 5138 or by post to Office 1607, Empire Heights A, Business Bay, Dubai, UAE.