1. Who we are and which law applies
Dembri is a UAE compliance SaaS that helps businesses track trade license renewals, compliance deadlines, and government document expiries. The service is operated by Dembri Technologies Ltd, a company incorporated in the Dubai International Financial Centre (DIFC), registered number 13580, commercial licence CL13580.
Our own processing. Dembri Technologies Ltd is the controller for the personal data it uses to run its own business: user accounts, billing, product analytics, outreach emails and support. The DIFC Data Protection Law No. 5 of 2020 and the DIFC Data Protection Regulations govern this processing.
Data our business customers put into Dembri. When a business customer adds documents or records to Dembri, for example its own company documents or its clients' records, the customer is the controller and Dembri acts as its processor. The customer's own data protection law governs the customer's role. For a customer on the UAE mainland, that law is the federal Personal Data Protection Law (Federal Decree-Law No. 45 of 2021, the PDPL). Dembri supports the customer's obligations as its processor under the data processing agreement described in Section 16.
We publish this policy to give you the information described in Articles 29 and 31 of the DIFC Data Protection Law: what we collect, why, who we share it with, where it goes, and what rights you have.
For any data related questions, email: privacy@dembri.com
2. What data we collect
We only collect data that is necessary to run the service.
| Data | Why we collect it |
|---|---|
| Full name | To identify you as a user and personalise your account |
| Email address | To send account notifications, renewal alerts, and login links. Also used as your login identifier. |
| Company name | To associate your compliance records with your business entity |
| WhatsApp number | To send renewal reminders and compliance alerts via WhatsApp |
| Trade license numbers | To track license renewal dates and send timely reminders |
| Document expiry dates | Core function of the service. We store the expiry dates you enter or extract from uploaded documents. |
| Uploaded document files | You may upload company documents such as trade licences, Corporate Tax and VAT certificates, establishment cards and some permits. Dembri does not accept Emirates ID, passport, residence visa, labour card or employment contract today. An automated AI check reads each uploaded file once to classify it. A refused file is not stored. |
| Usage data | Pages you view and buttons you click, recorded by our analytics provider PostHog only if you allow analytics in the cookie notice. It sets no cookies and we do not link it to your name or email. Your browser sends it to PostHog directly, so PostHog receives your IP address. |
3. How we collect your data
- You give it to us directly: when you sign up, fill in your profile, upload documents, or enter compliance data
- We read it from documents you upload: an AI service (Anthropic) reads expiry dates and other details from uploaded documents so you don't have to type them manually
- Service usage data: basic information about how you interact with the dashboard to improve the product
4. How long we keep your data
| Data type | Retention period |
|---|---|
| Account information (name, email, company, WhatsApp number) | Until you delete your account |
| Compliance data (licence numbers, document numbers, expiry dates) | Until you delete your account |
| Uploaded documents | Until you delete them or delete your account |
| AI chat history | 180 days |
| Activity and audit records | 24 months |
| Records of reminders sent | 12 months |
| Enquiries and free audit requests (email, company, language, the IP address of the request, the details we read from your file, a short summary, and the file size and type; never the file itself) | 90 days, unless you become a customer |
| WhatsApp messages from people who are not customers, and our replies | Deleted at the next weekly clean up after 90 days without a message from you. If you have never messaged us, we count from our latest message. This does not apply once the number belongs to a customer. |
| Feedback on compliance rules | 24 months |
| Payment records | 5 years. Stripe stores them, not us. |
| Usage analytics | 12 months, then anonymised |
When you delete your account, all your personal data and uploaded documents are permanently deleted within 30 days. Backup copies are purged within a further 30 days.
4b. WhatsApp communications: opt in and opt out
We send WhatsApp renewal reminders through Twilio's WhatsApp Business API. Inbound enquiries to our WhatsApp number receive an automated first reply from an assistant that answers within a bounded scope and hands over to a person by email. WhatsApp messaging requires explicit, per recipient consent under WhatsApp's platform policy and applicable data protection law.
How we capture your consent. You opt in to WhatsApp messages from Dembri in one of two ways:
- Toggling "Receive WhatsApp reminders from Dembri" on in your vault settings
- Sending us a WhatsApp message from a phone number linked to your Dembri account. That message is recorded as opt in for that number. A message from a number not linked to an account receives one automated greeting, then a person replies; it does not enrol the number for reminders.
How we record your consent. For each opt in, we store the phone number (in E.164 format), the timestamp, and the method (settings toggle or first inbound message). This record is retained for the lifetime of your account, plus 3 years after account deletion, as evidence of consent under Articles 10 and 12 of the DIFC Data Protection Law and WhatsApp's platform policy.
How to opt out. Two equivalent options:
- Toggle "Receive WhatsApp reminders from Dembri" off in your vault settings
- Reply STOP, UNSUBSCRIBE, CANCEL, END, QUIT, or OPT OUT to any WhatsApp message we send
Opt out is immediate. We send a one line confirmation and never message that number again from Dembri's WhatsApp Business Account until you opt back in via the settings toggle.
If you change your WhatsApp number. Opt in is bound to a specific number. If you update the number in your settings, your previous opt in record stays bound to the old number; you'll need to opt in again for the new one. This is intentional. It makes sure consent matches the number we send to.
For Group tier customers using two way chat. Messages you send to us and our AI agent's replies are stored in your chat history and used to improve your service experience. They are not used to train any AI model.
No marketing or promotional content is sent via WhatsApp. Messages are strictly transactional: renewal reminders, account alerts, and (for Group tier) your own compliance questions.
5. Where your data is stored
Your data is stored on Supabase, hosted in Frankfurt, Germany (EU region).
Data residency: your data resides in Frankfurt, Germany. It does not leave the EU economic area except when processed by the providers listed in Section 6, which may process data in other regions. Section 14 explains the safeguards for those transfers.
6. Providers that process data for us
We use the following services to run Dembri. Each one processes data on our instructions under its own data processing terms. Our trust page shows the status of our data processing agreement with each provider.
| Service | What it does | Where |
|---|---|---|
| Supabase | Stores your data: database, file storage and sign in | Frankfurt, Germany |
| Vercel | Hosts the Dembri application | United States |
| Hetzner | Runs our automation server: it reads new enquiries, receives the WhatsApp messages and attachments sent to us, and sends follow up emails and WhatsApp messages | Germany |
| Cloudflare | Answers domain name lookups for dembri.com; it does not host the site | Global network |
| Anthropic (Claude) | Reads uploaded documents to find dates and details, and answers questions in chat (see Section 6a) | United States |
| Perplexity | Live research when you click the "Research this live" button in chat (see Section 6b), and scheduled checks of public regulatory text | United States |
| ElevenLabs | Voice calls. Paused since 20 October 2026 until its data processing agreement is confirmed. Its voice agents are set to zero retention mode. | United States |
| Resend | Sends email: account emails, renewal reminders and outreach emails | United States / EU |
| Twilio | Sends and receives WhatsApp messages (reminders, and replies to enquiries you send us) | United States |
| Zoho | Hosts Dembri's own email | United Arab Emirates |
| Stripe (Stripe Payments Europe, Limited) | Processes payments; Dembri never holds card data | Ireland, United States and India (per Stripe's policy) |
| PostHog | Product analytics: pages viewed and clicks, without cookies (see Section 2) | European Union |
Connectors you authorise to your own accounting system (Zoho Books, Xero, Odoo) act for you, not for us, and are not listed here.
6a. AI agent: what leaves Dembri
When you chat with Dembri's AI agent about your own documents, compliance status, or UAE regulatory questions, the conversation is processed by Anthropic (USA) under Anthropic's commercial API terms.
What is sent. Your question and the earlier messages of the same conversation, yours and the agent's. Before your messages are sent, our system removes common personal identifiers from them, such as Emirates ID, UAE and international phone numbers, email addresses, passport numbers, visa file numbers and payment card numbers. This removal works on known number and text formats, so an unusual format may not be caught. So that the agent can answer about your own business, we also send, as context: a list of your documents with their name, type, issuing authority, status, expiry date and document number; selected details read from your documents when you uploaded them, for example the licence holder, activities and dates, within fixed limits on how many documents and details are included; your business profile, which is your company name, emirate, licence type and your answers to the setup questions, such as VAT and Corporate Tax registration and turnover band; and your compliance obligations and their due dates. Identifiers are removed from your own messages only, not from the agent's replies or this context. We do not send the uploaded files or scanned images themselves when you chat, and we do not send the payment details held by our payment provider.
When you upload a document. The file itself is sent to Anthropic so that its details, such as names, numbers and dates, can be read and shown to you to check. See the processor table in Section 6.
Where it goes. Anthropic (USA), our AI sub-processor (see Sections 6 and 14). Under Anthropic's commercial API terms your data is not used to train any model. Anthropic may retain API inputs and outputs for a limited period for safety and abuse monitoring under its standard retention policy; we have not yet obtained a zero-retention commitment and will update this section if we do.
How to opt out. Don't use the chat feature. Not using chat stops chat context from being sent. Reading uploaded documents still uses AI (see "When you upload a document" above).
6c. Files received through a request link
Sending a request. When this feature is available, a Dembri user can send another person a link to upload one file without an account. The user sends the link; Dembri does not contact the uploader or collect their name, email address or phone number as separate contact details. The file itself may contain personal information.
Checking and reviewing the file. An automated AI check reads the file once to screen for Emirates IDs, passports, visas, labour cards and employment contracts. It can make mistakes. Files it refuses are not stored. An accepted file is stored in the user's account for review. Until the user reviews it, the file changes no date or status, is not used by the AI agent and cannot be used as proof.
Responsibility and retention. The user decides whether to request and keep the file and is responsible for having a reason to do so. Dembri processes it on the user's behalf. An accepted file remains until the user deletes it or closes the account.
For uploaders. The upload page explains this process before upload. For privacy questions or requests about a file, contact privacy@dembri.com. Dembri may need to work with the account holder to address a request.
6b. Live government policy research: what leaves Dembri
When you ask the AI agent a question about UAE government policy (for example, “What does MOHRE require for X?” or “Cabinet Decision 106/2025: does this still apply?”), the agent may offer a “Research this live” button. Clicking this button is the only way that any part of your question is sent to a research provider outside Dembri.
What is sent. Only the text of the specific question. Before it is sent, automated filters remove common personal identifiers (Emirates ID, passport and visa numbers, phone numbers, email addresses); an unusual format may not be caught. We do not send your account information, document contents, license records, reminder schedules, or chat history.
Where it goes. Perplexity (USA), our research sub-processor, through its Sonar API. Perplexity processes the question under its API terms, which include its data processing agreement. We have not negotiated separate terms; we will update this section if that changes. Common personal identifiers are filtered out before it is sent; some may remain.
How to opt out. Don't click the “Research this live” button. The default answer path never sends anything to Perplexity. Live search runs only when you click, one question at a time, within a monthly limit.
This is the only outbound transfer of your question content to a third party research provider beyond the processors listed in Section 6. If we add another such provider in future, we will update this section and email account holders before activation.
7. Your rights under the DIFC Data Protection Law
Articles 32 to 40 of the DIFC Data Protection Law give you the following rights over the personal data we control:
Right to withdraw consent
Where we rely on your consent, you can withdraw it at any time. Withdrawing is as easy as giving consent (Article 32).
Right of access
Ask us what data we hold about you at any time. We'll send a full copy within 5 business days. You can also log into your dashboard to see your data directly.
Right to correct
Edit most of your data directly in the dashboard. For anything stuck, email us and we'll fix it within 2 business days.
Right to erasure
Delete your account from dashboard settings. This removes your account data, subject to the retention periods and legal exceptions described in this policy, including backups that are purged on their own schedule.
Right to restrict processing
If you believe your data is incorrect or being processed unlawfully, ask us to pause processing while we investigate.
Right to data portability
Request a copy of your data in CSV or JSON format within 5 business days.
Right to object
Object to processing based on our legitimate interests, and to direct marketing, at any time.
Rights about automated decisions
You have rights about decisions made only by automated means that affect you. You can also complain to challenge the outcome of processing by an AI system (DIFC Data Protection Regulations, Regulation 10.3.5).
No penalty for using your rights
We will not treat you less favourably because you exercised any of these rights.
To exercise any right: privacy@dembri.com. We respond within 5 business days and may ask you to verify your identity.
If a business customer put your data into Dembri, that business is the controller. We pass your request to it and help it respond. Its own data protection law, for example the PDPL on the UAE mainland, sets its duties to you.
8. How we protect your data
| Measure | What it means |
|---|---|
| Encryption in transit | Data sent between your browser and our servers is encrypted with TLS 1.2 or 1.3 |
| Encryption at rest | Your data is encrypted on Supabase's servers (AES-256, set by Supabase) |
| Access controls | Only you and authorised team members can access your data, with role based permissions |
| Regular backups | Your data is backed up daily. Backups are encrypted and stored separately. |
| No advertising trackers | We don't use analytics or advertising scripts from Google, Facebook, or other ad networks. Our product analytics (PostHog) sets no cookies. |
9. Cookies and browser storage
We use only cookies that the site needs to work:
- Sign in cookies: keep you logged in while you use the dashboard
- Language cookie: remembers the language you chose
- Short lived security cookies: set only while you connect another account, such as Xero, Zoho Books or UAE Pass
We also keep some settings in your browser's local storage, for example your cookie notice choice and your recent chat on the chat page. We do not use tracking cookies, advertising cookies, or third party analytics cookies. Our analytics tool (PostHog) keeps nothing on your device, and it starts only if you allow analytics. Blocking all cookies will prevent you from logging in.
Your analytics choice in this browser: not chosen yet (analytics is off).
10. Changes to this policy
If we change this privacy policy, we will:
- Update the “Last updated” date at the top
- Email you at the address on your account
- Show a notice in the dashboard the next time you log in
Significant changes (new data collection, new third party processors) will require your explicit consent. Minor changes take effect immediately.
11. Complaints
- First step: email privacy@dembri.com. We investigate within 5 business days.
- Second step: if you're not satisfied, you have the right to complain to the DIFC Commissioner of Data Protection.
If a business on the UAE mainland put your data into Dembri, you can also complain to the regulator for that business under the PDPL, the UAE Data Office.
12. Legal basis for processing (DIFC Data Protection Law, Article 10)
This table covers the processing we control. For data a business customer puts into Dembri, the customer decides the legal basis.
| Processing activity | Legal basis |
|---|---|
| Account creation and management | Performance of a contract (we need your account to provide the service you signed up for) |
| Renewal reminders | Contractual necessity (this is the core service you signed up for) |
| AI document analysis | Performance of a contract (reading the documents you choose to upload is part of the service) |
| Payment processing | Contractual necessity (we can't provide the service without payment) |
| Legal compliance (tax records) | Legal obligation (UAE tax law requires us to retain certain records) |
13. Children's privacy
Dembri is a business to business service. We do not knowingly collect data from anyone under 18. If you believe a minor has provided us with personal data, email privacy@dembri.com and we'll delete it immediately.
14. International data transfers
Your data is stored in Frankfurt, Germany (Supabase EU region). PostHog processes analytics in the EU. Some providers process data in the United States: Vercel, Anthropic, Perplexity, Resend and Twilio, and ElevenLabs when voice is on (paused since 20 October 2026). Stripe processes data in Ireland, the United States and India. Zoho hosts our email in the UAE, outside the DIFC.
Under the DIFC Data Protection Law, these transfers are made on the following grounds:
- Adequacy (Article 26): for transfers to the EU, including Germany. EU and EEA states are on the list of adequate jurisdictions in Appendix 3 of the DIFC Data Protection Regulations.
- Appropriate safeguards (Article 27): transfers to places not on that list, such as the United States, India and the UAE outside the DIFC, need appropriate safeguards. The status of our agreement with each provider is on our trust page. Whether each provider's safeguards meet Article 27 is under review, and we will update this section when the review is complete.
We do not rely on your consent as the routine basis for these transfers. A click on the “Research this live” button (Section 6b) only sends a question when you ask for it.
15. Data protection contact
For questions about your personal data, requests or concerns, contact our director.
Email: privacy@dembri.com
Response time: Within 5 business days for general queries; within 72 hours for suspected data breaches.
Language: English or Arabic
Personal data breaches. If a personal data breach affects data we control, we report it to the DIFC Commissioner of Data Protection as Article 41 requires, and we tell the people affected when Article 42 requires it. If you believe your personal data has been mishandled or breached, contact us at the email above.
We're also happy to explain anything in this policy in simpler terms. Just ask.
16. PRO firms: controller and processor split
Pending formal legal review. This section sets out a baseline controller and processor framework. Regulated Firms (banks, healthcare, government suppliers) and Firms whose own customers contractually require a counter signed DPA should request the standalone DPA below before onboarding. Click through acceptance of this Privacy Policy is the default contract for SME engagements only.
When a PRO firm or business setup consultant (each, a "Firm") uses Dembri to manage compliance for their own end clients (each, a "Managed Client"), the roles are:
- The Firm is the data controller for any personal data of its Managed Clients that the Firm uploads or imports into Dembri. The data protection law that applies to the Firm governs this role: the PDPL for a Firm on the UAE mainland, or the DIFC Data Protection Law for a Firm in the DIFC.
- Dembri is the data processor, processing that data only on the Firm's documented instructions. Documented instructions are: (a) actions the Firm takes through the platform's UI (uploading, editing, sharing, deleting Managed Client data), and (b) any explicit written instructions the Firm sends to us at privacy@dembri.com.
Firm responsibilities (controller obligations):
- Have a lawful basis, under the data protection law that applies to the Firm, to share each Managed Client's personal data with Dembri (typically: explicit consent from the Managed Client, contract with the Managed Client, or a legitimate interest assessment the Firm has documented).
- Inform Managed Clients that their data is processed by Dembri as a sub-processor and provide them with this Privacy Policy on request.
- Handle Managed Client data subject requests directly. Dembri will assist the Firm to fulfil such requests within 30 days.
- Notify Dembri of any change in lawful basis or any withdrawal of consent that affects data already in Dembri.
Dembri responsibilities (processor obligations):
- Process Managed Client data only to provide the contracted service to the Firm: no secondary use, no profiling, no monetisation.
- Apply the same security controls described in Section 8 (AES-256 encryption at rest by our hosting provider, TLS 1.2 or 1.3 in transit, role based access, audit logs) to Managed Client data.
- Use only the sub-processors listed in Section 6. Any change in sub-processors will be notified to the Firm with at least 30 days' advance notice and the right to object; if the objection cannot be resolved, the Firm may terminate without penalty.
- Return or delete all Managed Client data on the Firm's instruction, or within 30 days of contract termination, whichever is sooner.
- Notify the Firm without undue delay (and within 72 hours) of any personal data breach affecting Managed Client data.
Data processing agreement. The Firm's acceptance of this Privacy Policy at signup, together with the order documentation for the Firm's subscription tier, describes our intended processing arrangement between the Firm (controller) and Dembri (processor) under the data protection law that applies to the Firm, pending legal review of our data processing agreement. A standalone DPA can be requested.
Request standalone DPA