bAIsect Privacy Notice

1. Who is responsible for your information

204Labs FZE operates baisect.com and bAIsect. We are a free zone establishment registered in SPC Free Zone, Sharjah, United Arab Emirates, registration number 443219901. Our registered office is Business Center, SPC Free Zone, Sharjah, United Arab Emirates.

For the website, enquiries, waitlist, engineer applications and our own business records, we are the controller: the organisation deciding why and how personal information is used. Contact us about privacy or your rights at connect@baisect.com, or write to our registered office marked “Privacy”.

This notice covers manual early access. We do not currently provide public user accounts or a public engineer marketplace. If a customer authorises us to handle personal information in its systems, we act on its instructions under a separate data processing agreement. The customer’s privacy information normally explains that processing, and we help the customer respond to relevant requests.

2. Information we collect and where it comes from

We collect information you provide through forms, correspondence and engagements. A business contact may introduce you to us or provide your details for an engagement. We also receive limited information from payment providers and the technology used to operate the website.

Waitlist information includes your name, email address, whether you are a builder or engineer, and any optional role, tools or skills you select.

Builder requests may include contact and business details, project links, tools used, a problem description, urgency, technical evidence and follow-up correspondence. Please use redacted examples rather than identifiable customer records.

Engineer applications may include contact details, professional background, skills, availability, time zone, work samples and professional links you provide. We may review those links to assess your application. Our early-access process does not require identity documents through these forms.

Engagement and payment records may include the agreed scope, communications, invoice and billing details, payment amount, currency, status, transaction reference and limited payment-method information supplied by a provider. Full card numbers and card security codes must be entered only with the payment provider; we do not collect them through our forms or store them in our engagement records.

Technical information may include IP addresses, browser or device information, pages requested, referral information, timestamps and error or security events processed by our hosting and delivery services. Where enabled, Cloudflare Web Analytics supplies website-performance and audience measurements without using analytics cookies. A light or dark theme preference is stored in your browser when you choose it.

Do not send passwords, access tokens, private keys, full payment-card details, health information, identity documents, information about children or unnecessary third-party personal information through our forms. If unnecessary information is received, we will restrict its use and remove or redact it where practicable. Access to customer-system data requires a separate agreed process, not a form submission.

3. Why we use information and our legal grounds

We use only the information reasonably needed for the following purposes.

To answer an enquiry, assess a request, prepare an offer or perform an engagement, we rely on taking steps you request before a contract or performing a contract with you where that legal ground applies. For a business representative who is not personally party to the contract, applicable European and UK law may instead allow our legitimate interests in communicating with the business and delivering the requested service. A legitimate interest is a necessary, proportionate business purpose balanced against your rights.

To review an engineer application and communicate about that application, we use the information you submit for the assessment you request. Under applicable European and UK law, this may be necessary for pre-contractual steps or our legitimate interests in selecting suitable service providers. Keeping you informed about unrelated future opportunities requires your separate choice where consent is required.

To send waitlist, launch or promotional emails, we rely on your affirmative request or consent. You can withdraw that choice at any time. Asking us to solve a technical problem does not automatically subscribe you to marketing.

To administer payments and keep required accounting or tax records, we rely on contractual requirements and applicable legal obligations. To protect the Service, investigate misuse and establish or defend legal claims, we use proportionate information under the legal obligations, legal-claims grounds or other lawful grounds available in the relevant jurisdiction. Where European or UK law applies, necessary security and fraud-prevention processing may rely on legitimate interests.

For website analytics or device storage requiring consent, we seek that consent before activation. Where a lawful exemption applies, we meet its conditions, including any required notice or opt-out. Information that is genuinely anonymous and cannot reasonably identify a person is not used to make individual decisions.

Under the UAE Personal Data Protection Law, we rely on your specific consent unless an applicable statutory exception permits the processing, such as the relevant contractual, legal-obligation or legal-claims exception. We do not treat European or UK “legitimate interests” as a separate general exemption under UAE law. When UAE consent is needed for a request or application, the form identifies the requested use and your affirmative submission records that choice.

You may decline optional information or withdraw consent without affecting the lawfulness of earlier processing. Without information necessary to respond or perform an engagement, we may be unable to provide that part of the Service. Where another lawful ground requires limited continued retention, we will explain it.

4. Marketing, AI and automated decisions

You can leave the waitlist or stop marketing by using the unsubscribe facility in an email or contacting connect@baisect.com. We distinguish marketing from communications needed to answer your request, manage an engagement or meet a legal obligation.

Early-access requests and engineer applications are assessed manually. We do not make decisions producing legal or similarly significant effects solely through automated processing. We do not use your submissions or customer-system data to train general-purpose AI models. Any engagement-specific use of an external AI service involving confidential or personal information must first be agreed with the customer and supported by appropriate data protection arrangements.

We do not sell personal information, share it for cross-context behavioural advertising, or use advertising trackers on the early-access website.

5. Who receives information

We limit disclosures to what the recipient needs for its role.

Formspree receives, stores and delivers website form submissions. It is a US-based service. Cloudflare Web Analytics provides cookieless website measurements where enabled. Hosting, email and secure collaboration providers support delivery, correspondence and engagement administration; their access is limited by their role and the arrangements applicable to that service.

Authorised personnel and engineers may receive relevant information for assessment or delivery. Engineers who process customer information on our behalf must be covered by appropriate confidentiality and data processing obligations. Where customer-system data is involved, authorised subprocessors and processing locations are addressed in the relevant data processing agreement.

PayPal processes payments currently offered through it. Stripe processes card payments when that option is offered. Payment providers may act as independent controllers for their fraud-prevention, payment-network and legal obligations, and as processors for other activities. Their own privacy notices explain those activities. We receive only the information needed to administer our side of the transaction.

We may disclose necessary information to professional advisers, authorities or courts where lawfully required, or to establish or defend rights. Relevant information may be transferred during a genuine business sale or reorganisation, subject to confidentiality, appropriate safeguards and applicable notice requirements. A business transfer does not authorise an incompatible new use of information.

6. International processing

We operate in the UAE. Service providers may process information in the United States and other countries where they or their authorised providers operate. A foreign provider or remote engineer can involve an international transfer even when the customer’s database stays in its original country.

Before making a transfer restricted by applicable law, we require a valid transfer mechanism and appropriate safeguards. Depending on the transfer, these may include an applicable adequacy decision, eligible European Commission standard contractual clauses, the UK International Data Transfer Agreement or UK Addendum, or another legally permitted mechanism. Where required, we assess the receiving country’s protections and apply additional contractual, technical or organisational measures. UAE transfer requirements must also be satisfied; European or UK clauses are not automatically a substitute for them.

We do not treat acceptance of our Terms or this notice as blanket consent to routine international transfers. Contact connect@baisect.com for information about relevant destinations and safeguards, or a copy of applicable safeguards with confidential information redacted where necessary.

7. How long we keep information

Our retention rules distinguish prospective enquiries from paid work and legally required records.

Waitlist information is kept for up to 12 months after your latest affirmative interaction or confirmation, unless you unsubscribe sooner. Sending you an email does not itself restart that period. An enquiry that does not become an engagement is normally deleted within six months after the last substantive contact.

Engineer application information is normally kept for up to 12 months after the latest application or substantive interaction. A rejected application is normally deleted within six months unless you separately agree to remain in an opportunities pool. An active engineer’s contract and payment records follow the relevant business-record requirements.

We normally keep the minimum contract, invoice, payment and related compliance records for seven years after the end of the relevant accounting period, with longer retention only where law or a specific legal claim requires it. We do not keep an entire customer database merely because an invoice must be retained.

Temporary working copies of customer code or data are returned or deleted under the engagement and data processing agreement, normally within 30 days after completion. Security logs under our control are normally retained for no more than 90 days unless needed to investigate a specific incident. Provider-operated logs and backups follow the applicable provider arrangements and verified deletion cycles; information awaiting backup expiry is restricted from ordinary use.

We may keep a minimal record of an unsubscribe request to avoid contacting you again, and limited records of privacy requests, consent and legal claims for as long as reasonably needed to demonstrate compliance or protect legal rights. A legal hold is limited to relevant records and lifted when no longer necessary.

8. Cookies and information stored on your device

Our website’s own code does not set cookies. If you choose a light or dark theme, we store that preference in your browser so the website remembers your choice. You can change it on the site or clear the website’s stored data through your browser.

Cloudflare Web Analytics, where enabled, does not use analytics cookies. “Cookieless” does not by itself determine whether consent or another privacy requirement applies. We keep non-essential technology requiring consent disabled unless you agree. Where an exemption is used, we provide the notice and simple opt-out that it requires. Where consent controls are displayed, you can reject optional technology and change your choice without affecting the essential Service.

A payment provider may use its own cookies or similar technology on its payment page. Its notice and controls apply there. We do not activate advertising trackers merely because you visit or submit a form.

9. Your rights

Depending on the law applicable to your information, you may have rights to obtain information and access a copy, correct inaccuracies, request deletion, restrict processing, receive or transfer information in a portable format, object to processing, withdraw consent, and complain to a regulator. You may object to direct marketing at any time. These rights are subject to lawful exceptions, including obligations to retain particular records and protection of other people’s information.

Where California privacy law applies, relevant rights may also include information about collection and disclosure, correction, deletion, applicable opt-out and sensitive-information rights, and freedom from unlawful discrimination for exercising a right. We do not sell information or share it for cross-context behavioural advertising. Where a jurisdiction provides a right to appeal our response, you may ask us to reconsider it through the same contact point.

Send requests to connect@baisect.com. We will verify identity only as reasonably necessary and will not routinely demand an identity document. An authorised representative may make a request where the law permits it. We normally respond without charge, subject to lawful exceptions for abusive, manifestly unfounded or excessive requests.

Where the EU or UK GDPR applies, we normally respond within one month, with a permitted extension of up to two further months for complex or numerous requests and notice within the first month. Where California law applies, we follow its applicable acknowledgement and response periods, normally 45 days for substantive access, correction and deletion requests, with a permitted extension where notified. Other applicable deadlines take priority where shorter.

If a request concerns information we process for a customer, we will direct it to that customer or assist it as appropriate. You may complain to the competent UAE federal personal-data protection authority, your relevant European supervisory authority, the UK Information Commissioner, the California Privacy Protection Agency or another competent regulator, as applicable. Contacting us first is not a condition of exercising that right.

10. Security and incidents

We use safeguards proportionate to the information and work, including restricted access, appropriate confidentiality obligations, secure communications and controlled access to customer systems. No system or transmission method is completely secure. Do not send credentials or sensitive records through ordinary intake forms.

If a personal-data breach occurs, we assess it, take appropriate containment and remediation steps, and notify affected customers, individuals and authorities where required by the applicable agreement or law. Where we act as a processor, we notify the relevant customer without undue delay after becoming aware of a breach affecting its personal data.

11. Children

The Service is intended for people aged 18 and over. We do not knowingly solicit personal information from children through our forms. If you believe a child has provided information, contact connect@baisect.com so we can investigate and delete or otherwise handle it as the law requires. This adult-service restriction does not authorise uploading children’s information from a customer’s systems.

12. Changes to this notice

We may update this notice as the Service develops or our practices change. The date above identifies the current version. We will give appropriate notice of material changes, including direct notice where required, before using information for a materially different purpose. Where a new use requires consent, we will obtain it rather than treating continued website use as agreement.