Thinkbay AI

Privacy Policy

1. Scope

This Privacy Policy applies to all personal data collected through our website, services, and applications (the “Services”) by Thinkbay Marketing FZCO, operating in IFZA Freezone UAE, under the UAE’s Federal Decree-Law No. 45 of 2021 (PDPL)

2. Data We Collect

We collect and process the following categories of information when you use our Services:

  • Personal information: This includes information you voluntarily provide such as name, email, phone number, job title, and any other contact details submitted through our website, portal, app, or other communication channel.
  • Business-related data: Information relating to your company or organization, such as company name, industry, products or services, registered address, and contact details of internal teams or representatives. If you provide us with contact details of third parties (such as your employees, contractors, or customers), you confirm that you have obtained all necessary rights, permissions, and consents to share such data with us.
  • Account and Platform Connection Data: If you connect third-party advertising or analytics accounts (such as Meta, Google Ads, or similar platforms) to our Services, we will access and store certain account information and performance metrics necessary to provide the Services. The usage of this data is mentioned in clause 4.
  • Usage Data: Information about your interactions with our website, platform, and tools, including IP address, browser type, device identifiers, operating system, referral URLs, pages visited, time spent on pages, clicks, and other system activity logs.
  • Cookies and Tracking Technology: We may use cookies, pixels, and other similar technologies to enhance your experience, track usage pattern, and gather information on user activity to improve our services. You can control cookies setting through your browser or device preferences, however, disabling cookies may limit functionality.
  • Payment and Transaction Data: Where applicable, details related to payments you make for our Services, including transaction records, billing address, and payment method information. We do not store full credit card numbers; payments are processed through secure third-party payment providers.
  • Communications Data: Records of communications with you, including emails, chat messages, support tickets, and meeting notes, which may be stored for service delivery, quality assurance, and legal compliance purposes.

3. Purpose & Legal Basis

We process personal and business data for the following purposes:

  • Service Delivery: To provide, manage, and improve our Services. Basis: Contractual necessity.
  • Account & Platform Integration: To connect third-party advertising/analytics accounts. Basis: Contractual necessity or consent.
  • Billing & Payments: To process fees, invoices, and subscriptions. Basis: Contractual necessity and legal obligation.
  • Communications: To respond to inquiries and send service updates. Basis: Contractual necessity or legitimate interests.
  • Marketing: To send promotions or offers. Basis: Explicit consent.
  • Compliance & Legal: To comply with laws, enforce terms, and protect our rights. Basis: Legal obligation or legitimate interests.

4. Sharing, Transfer, and Disclosure of Data

We do not sell your personal data or data collected through Google, Meta, TikTok, Zoho, Salesforce etc OAuth authorisations. We do not share, transfer, or disclose your data, including Google user data obtained through Google APIs (such as the Google Ads API) or Meta user data obtained through Meta APIs (Meta Ads API), to any third party except as described below, and only to the extent necessary to provide the features you have requested:

  1. Third Party AI LLM (large language model) providers (sub-processors). To produce the analysis, recommendations, and reports you request, we transmit relevant advertising-account data, which may include user data obtained through connected ad accounts such as Google, Meta APIs or connected CRM accounts such as Zoho, Salesforce APIs, to third-party AI providers that process it on our behalf solely to return the requested output. These providers are currently Anthropic (Claude API), OpenAI (OpenAI API), and Google (Gemini). They process the data under their API terms, do not use it to train or improve their generalized models, and act as our sub-processors.
  2. Cloud hosting and infrastructure providers who host our platform and store data on our behalf. Currently our website and app is hosted on AWS and Microsoft Azure.
  3. Communication channels such as WhatsApp, Telegram, Slack or Teams - only if you explicitly connect the AI agents in Thinkbay platform to these channels. Data in these channels are protected with their own Privacy Policies and security measures.
  4. Connected advertising and analytics platforms (such as Meta, Google Ads, TikTok, Zoho, Salesforce, etc), accessed via their official APIs solely to read and act on the accounts you connect, as you direct.
  5. Payment processors who handle billing information; we do not store full card numbers.
  6. Professional advisors and service providers (such as auditors, legal counsel, and IT support) bound by confidentiality obligations.
  7. Business transfers, in connection with a merger, acquisition, financing, reorganization, or sale of assets, subject to confidentiality safeguards and notice to affected users.

We do not transfer or disclose your information, including user data derived from connected Ad or CRM accounts, to third parties for any purpose other than those described in this Privacy Policy.
We do not use your data to train or fine-tune any AI model. Data is sent to AI providers solely for real-time inference.
Thinkbay AI’s access to, use, and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
You can revoke Thinkbay AI’s access to any platform via platform’s settings.

5. Consent

By using our Services, you provide clear and explicit consent for us to process your personal and business data for purposes that require consent, including marketing communications and connecting third-party advertising platforms.
You may withdraw your consent at any time by contacting us at admin@thinkbay.ai. Withdrawal of consent will not affect the lawfulness of processing based on consent before its withdrawal or the provision of services required under a contract.

6. Data Minimization & Retention

We collect only necessary data and retain it only as long as needed for purposes such as service delivery, legal compliance, or with anonymization thereafter.
You may disconnect any connected Google, Meta or other account at any time through that platform's settings or by contacting us. We retain user data obtained through connected accounts only while the connection is active and as needed to provide the Services. Following disconnection or a valid deletion request to admin@thinkbay.ai, we will delete the associated data from our active systems within 30 days, except where retention is required by law.

7. Subject Rights

Individuals have rights under PDPL to access, correct, delete, restrict or stop processing of their data, object to automated decision-making, and request data portability.

8. Data Security

We implement technical and organizational measures appropriate to the risk level—such as pseudonymization, encryption, access controls, and secure storage—to protect data from unauthorized access.
While we strive to protect data, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9. Cross-Border Transfers

Data transferred outside the UAE will only go to jurisdictions with adequate protections or through contractual safeguards, or with explicit consent, as required under PDPL.

10. Data Breach Notification

In the event of a data breach affecting confidentiality, integrity, or availability of personal data, we will notify the UAE Data Office and affected individuals as required by PDPL.

11. Appointing a DPO

If required under PDPL (e.g., for high-volume or sensitive processing), we may appoint a Data Protection Officer to oversee compliance and serve as a point of contact.

12. Updates to Policy

We may update this Privacy Policy. The revised version will be posted on our website with the effective date noted.

13. Contact Us

To exercise your rights or for inquiries, please contact:
Email: admin@thinkbay.ai
Address: DSO-IFZA, IFZA Properties, Dubai Silicon Oasis