Privacy Policy
Last updated: 6 October 2026
This policy explains what personal data OakAI FZ-LLC collects through oakai.online (the “Site”) and its AI chat widget (the “Widget”), why we collect it, who receives it, how long we keep it, and what rights you have. We have written it to the standard of the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL) and, as a matter of good practice, the EU GDPR. The rights in section 10 apply to everyone, wherever you are.
1. Who is responsible for your data
| Controller | OakAI FZ-LLC |
| Registration | Ras Al Khaimah Economic Zone (RAKEZ), Ras Al Khaimah, United Arab Emirates |
| Licence No. | 47025318 |
| Address | VUNE1678, Compass Building, Al Hulaila Industrial Zone-FZ, Ras Al Khaimah, UAE |
| Privacy contact | hello@oakai.online |
“We”, “us” and “our” mean OakAI FZ-LLC. We have not appointed a Data Protection Officer because the law does not require one for our activities. All privacy questions go to the address above.
This policy covers the Site and the Widget. Data we handle while building software for a client is governed by our agreement with that client, not by this policy.
2. What we collect
Contact form. The name you enter, a phone number or an email address (whichever you give us), your company name and a description of your task if you choose to fill those in, and a record of your consent (that you ticked the box, and when). We also store technical details sent with the form: IP address, browser and device information, the page you came from, and campaign parameters in the link (UTM tags) if present.
AI chat widget. The messages you type and the assistant’s replies, a random session identifier, timestamps, the page you were on and how you reached it, and basic usage measures such as the number of messages and response time. If you leave contact details in the Widget, they are stored as a lead, together with the conversation. Transcripts of Widget conversations are also copied to a Telegram bot run by us (see section 5), where our team can read them and reply to you.
Email and Telegram. If you write to hello@oakai.online, or message us on Telegram, we process your email address or Telegram account details and the contents of your message.
Server logs. Our servers record the IP address, browser and device information, requested address and time of each request. We use them to run and protect the Site.
Cookies and analytics (only if you accept them). Google Analytics 4 collects pseudonymous identifiers, pages viewed, device and browser type, approximate location derived from the IP address, and how you arrived. The Google Ads tag measures whether an ad click led to a visit or enquiry and may be used to show you our ads elsewhere. Nothing from these services loads until you accept it in the cookie banner. Details are in the Cookie Policy.
We do not ask for special categories of personal data (health, religion, political views, biometric data and similar), and we ask you not to type any in the form or the Widget. We do not knowingly collect data from children. The Site is aimed at businesses.
3. Why we use it, and on what basis
| Purpose | Data | Basis |
|---|---|---|
| Answer your enquiry, arrange and run a consultation, send a proposal | Contact form data, lead data from the Widget, email | Your request (steps towards a contract) and your consent given by the form checkbox |
| Give you answers in the Widget | Chat messages, session identifier | Your request: you start a chat to get an answer. Where GDPR applies, also our legitimate interest in running a working chat service |
| Keep chat logs for a short period to fix errors, check quality and detect abuse | Chat logs | Legitimate interest in a reliable and secure service (GDPR); see note below |
| Secure the Site, prevent spam and abuse | Server logs, IP address, technical form data | Legitimate interest in security (GDPR); see note below |
| Measure how the Site is used and how our ads perform | Analytics and advertising cookie data | Your consent only. You can refuse, and withdraw it at any time |
| Meet legal obligations and handle legal claims | Any of the above, as needed | Legal obligation; establishing or defending legal claims |
The PDPL has no general “legitimate interest” basis. Where PDPL alone applies, we rely on your request or consent and on the exceptions the PDPL provides for security, legal obligations and legal claims.
We use your contact details only to respond to your request and follow up on it. We do not send newsletters or sell or rent personal data. If we ever add marketing mailings, we will ask for separate consent first.
4. Automated decisions and AI
The Widget uses a large language model to generate answers. It does not make decisions about you that have legal or similarly significant effects. Nothing about how we treat you or your enquiry is decided automatically. AI answers can be wrong, so please treat them as general information and not advice. Section 4 of our Terms of Use covers this.
5. Who receives your data
| Recipient | Role | What they receive | Location |
|---|---|---|---|
| nuxt.cloud (hosting provider) | Processor | Everything stored on our server: form submissions, chat logs, leads, server logs | Servers in the European Union (Germany) |
| OpenAI | Processor | The messages you send in the Widget, with the conversation context needed to write a reply | United States |
| Google (Google Ireland Limited, Google LLC) | Provider of analytics and advertising services | Cookie identifiers and usage data, only after you accept analytics or advertising cookies | United States and other countries where Google operates |
| Telegram | Messaging service (not a processor under a contract, see section 6) | A notification to our team chat when a form or lead arrives, containing the details you submitted. A copy of the transcript of each Widget conversation, sent to a Telegram bot run by us, from which our team reads the conversation and can reply to you. Messages you send us on Telegram | Telegram operates servers in several countries |
| Yandex (Yandex 360, email provider for the oakai.online mailbox) | Processor | Emails you send to hello@oakai.online and our replies, including the email address and the content of the messages | Servers of Yandex, a Russian company; the data may be stored and processed in Russia |
Within OakAI, access is limited to the people who need it to answer enquiries and run the Site.
We may also disclose data to authorities when the law requires it, to professional advisers under confidentiality duties, and to a successor if our business is transferred, in which case this policy continues to apply to your data.
6. Transfers outside the UAE
We are based in the UAE. Your data is stored on servers in the European Union (Germany) and may be processed in the United States (OpenAI, Google) and other countries (Telegram, and Russia for email through Yandex). To protect it we:
- use data processing agreements with our hosting provider and OpenAI, and the data processing terms and standard contractual clauses offered by Google, so that these providers may use the data only for our purposes and must protect it to a standard comparable to the PDPL and GDPR;
- accept that Telegram is different: it is a general messaging service, and it does not offer us a data processing agreement. We therefore use it only for internal notifications and for replying to visitors, restrict access to the Telegram chats and the bot to our team, and delete the copies on a short schedule (section 7);
- send OpenAI only what is needed to generate a reply, and use its API under terms that, by default, do not allow your content to be used to train its models;
- load Google services only after you opt in;
- encrypt data in transit and limit who can access it (section 9);
- ask for your explicit consent where the law requires it: the form checkbox covers the transfer of form data to our hosting provider and to Telegram, and the notice above the chat input tells you that conversations go to OpenAI and are copied to Telegram.
You can ask us for a copy of the safeguards relevant to your data using the contact in section 1.
7. How long we keep it
| Data | Retention |
|---|---|
| Contact form submissions and leads (including a conversation attached to a lead) | 90 days after we receive them, then deleted. If you become a client, the engagement is governed by the contract and the retention terms in it |
| Chat logs not attached to a lead | 30 days |
| Server logs | 30 days |
| Copies in Telegram (lead notifications and chat transcripts) | Deleted automatically within 30 days by the chat’s auto-delete setting. |
| Analytics data in Google Analytics | Up to 14 months |
| Cookie consent choice | 6 months, then we ask again |
| Backups | Overwritten in the normal rotation, which is no longer than 35 days |
If you ask us to delete your data earlier, we do so unless we must keep it by law or to handle a legal claim.
8. Demo pages
Some pages on oakai.online are demonstrations of the Widget, written in Russian and not listed in search engines. They have no contact form, do not ask for contact details, and do not load analytics. We do not store anything from them: no conversations, and no copy in Telegram. Messages typed in a demo are sent to OpenAI to produce a reply, after we remove obvious personal identifiers such as phone numbers and email addresses. Please do not enter personal data on those pages. Like every page, they are served by our hosting provider, which records the technical request data described in section 2.
9. Security
We use encrypted connections (HTTPS) between you and the Site, store data on servers in the European Union (Germany) with restricted access for named staff, keep activity logs, and take backups. No internet service is completely secure, so we cannot promise absolute protection. If a breach affects your data, we will notify the competent authority and affected people as the law requires.
10. Your rights
You have the right to:
- access the personal data we hold about you and get a copy;
- correct data that is wrong or incomplete;
- delete your data;
- object to processing that we base on our legitimate interests, and ask us to restrict processing while a dispute is settled;
- withdraw consent at any time. Withdrawal does not affect processing done before. For cookies, use “Cookie settings” in the footer. For form data, email us;
- receive the data you gave us in a common electronic format where the law gives you that right.
To use any of these rights, email hello@oakai.online from the address you used with us, or tell us which form or chat it concerns, so that we can find your records. We may ask you to confirm your identity first. We respond within 30 days. If a request is complex and the law allows more time, we will tell you why. We do not charge for a normal request.
If you believe we have handled your data unlawfully, please contact us first so we can put it right. You can also complain to the competent data protection authority in the UAE or, if you live elsewhere, to the authority in your country.
11. Cookies
By default, the Site uses only strictly necessary cookies and similar storage, such as your cookie choice and the identifier that keeps a chat together. Analytics and advertising cookies (Google Analytics 4 and Google Ads) are set only after you accept them. The full list, with durations, is in the Cookie Policy.
12. Changes to this policy
We may update this policy, for example when we change a provider or a retention period. The date at the top shows the current version. If a change is material, we will say so on the Site. We will ask again for consent where the law requires.
13. Contact
OakAI FZ-LLC
VUNE1678, Compass Building, Al Hulaila Industrial Zone-FZ, Ras Al Khaimah, UAE
hello@oakai.online