Privacy notice (UAE PDPL)

Moathaq is operated by HENRY DIGITAL HUB MARKETING MANAGEMENT, Dubai, UAE, which decides how and why personal data is used. We process personal data under the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021).

Licence no. 1637152, issued by Dubai Department of Economy and Tourism (DET).

Contact for privacy questions and requests: hello@moathaq.com

• Customers: name, phone number, optional email and the message you send when you request a quote.
• Reviewers: your rating and review text, tied to your enquiry.
• Businesses: owner name, phone, email, trade licence, the Emirates ID of the owner or manager, business details, and, if you connect your Google Business Profile, your rating and review count with your consent.
• Job seekers: name, phone, optional email and the note you send with an application; contact details and preferences for job alerts.
• Everyone: technical data such as IP address and browser type, used for security and to limit abuse, and a daily anonymous hash used to count unique profile views.

• Consent: we ask for your consent before we send a review request by WhatsApp or email, and before we send job alerts. You can withdraw it at any time by replying STOP or using the unsubscribe link. We also rely on your consent when you connect your Google Business Profile.
• Performance of a contract: passing your enquiry to the business you chose, running your account and plan, processing a job application you send, and billing.
• Legal obligation: keeping billing and tax records, and responding to lawful requests from authorities.

We use technical data to keep the site secure. We do not sell personal data.

Your enquiry goes to the business you contacted. Your job application goes to the employer. Identity and licence documents are seen only by our verification team and are never shown publicly.

We use service providers to run Moathaq: Supabase (database), Vercel (hosting), Cloudflare (security check on forms), Google (sign-in to connect a Business Profile, and Google Analytics if you accept analytics cookies), Meta (WhatsApp messages), an email delivery provider and, when online payment opens, Stripe (card payments). They process data for us and for no other purpose.

Our database is hosted on Supabase on Amazon Web Services in Mumbai, India (region ap-south-1). Our application servers run on Vercel, also in the Mumbai region. This is outside the UAE.

In plain words: when you use Moathaq, your data is sent to and stored on servers in India. This includes the trade licences and Emirates ID images that businesses upload for verification, which are stored in that database and can be opened only by our verification staff. We transfer data there only to run the service, and our providers' terms require them to protect it and to use it only to provide their service to us.

Automatic document reading: when a business uploads its trade licence, the document is sent to Anthropic (an AI service in the United States) so the details can be read and the form filled in for them. An Emirates ID is sent only if the business owner ticks the box to allow it; from it we keep only the name, the expiry date and the last 4 digits of the ID number. Anthropic uses the documents only to give us the result and does not use them to train its models. Anyone who does not want this can leave the box unticked and our team checks the documents by hand.

Under the UAE Personal Data Protection Law, personal data may be transferred outside the UAE where it is needed to perform the service you asked for, with appropriate safeguards, or with your consent. We rely on those grounds: the transfer is necessary to provide the directory you use, it is covered by contractual protections with our providers, and by using Moathaq after reading this notice you accept it. If you do not accept the transfer, please do not upload identity or licence documents, and contact us.

• Verification documents (trade licence and identity): deleted 90 days after the verification outcome (approved or rejected). Only the record that the check took place remains.
• Enquiries (name, phone, email, message) and job applications: kept for 24 months, then the personal details are blanked automatically. Only the fact that an enquiry or application happened remains, for statistics.
• Applicants' CVs: deleted 180 days after the job post expires.
• Reviews: the rating, text and first name stay on the business's page while the business is listed, or until you ask us to remove them.
• Billing records: kept as long as UAE tax law requires.
• Job alerts: until you unsubscribe; an alert you never confirm is deleted after 7 days.
• Security data (sign-in attempts, one-time codes, rate-limit counters, password-reset links): deleted within 24 to 48 hours.
• Verification documents and CVs are not part of our database backups. Database backups are kept for the latest 8 weekly copies.

Moathaq sets only the cookies it needs to work:

• moathaq_lang: remembers your language choice for one year.
• vuae_session: keeps you signed in to your account for up to 30 days. It is set only when you sign in.
• vuae_2fa: holds a sign-in step for five minutes when two-factor sign-in is on.

Staff and business dashboards also store a menu preference in your browser (local storage). The security check on forms (Cloudflare Turnstile) may use its own technical cookies. We do not use advertising cookies.

Analytics (only with your consent). When you first visit, we ask whether we may use Google Analytics. If you accept, Google Analytics sets _ga and _ga_<ID> cookies (kept up to 2 years) to count visits and see which pages are used. Google receives your device, browser and approximate location, but not your name, phone number or messages, and we have turned off Google signals and ad personalisation. If you decline, Google Analytics is not loaded at all. Your choice is kept in your browser (moathaq_consent). Change it any time with "Cookie settings" at the bottom of every page; withdrawing consent deletes the analytics cookies.

You may ask us to: give you access to your data; correct it; delete it; restrict or object to how we use it; give it to you in a portable form; and withdraw your consent. You may also ask for a person to review a decision that was made only by automated means, such as a ranking or a badge calculation.

Write to hello@moathaq.com.

We will reply within the time the law sets. You can also use the report form. If you are not satisfied you may complain to the UAE Data Office.

If a data breach is likely to harm you, we will tell you and report it to the UAE Data Office as the law requires.

We will update this notice when our practices change. The date at the top shows the last update.