Data and privacy map (draft)
What the site and the check actually touch, processor by processor. The jurisdiction pages state your rights per market; this page states the plumbing.
What is collected
- Contact form: the text fields you type, and your email so a person can answer.
- Guided intake: your answers, sent to the routing engine and stored to run the routing.
- The static forms and the Decision Lens: nothing — they run in your browser.
What is never collected
- No cookies, no analytics, no trackers, no advertising identifiers.
- No documents: the form takes no attachments by design.
Retention and deletion
Case-routing answers are kept while your case is open. [DRAFT — fixed retention period pending final policy.] Deletion on request works today through the privacy route on the contact page, honored within 30 days at most.
Cross-border transfer
The processors above operate outside the Middle East; your data crosses borders to be processed. The jurisdiction pages state the legal basis per market.
Processors, roles, and residency
| Processor | Role | Residency note |
|---|---|---|
| Cloudflare | Site delivery, forms, and the routing bridge | Global network; Middle-East-only residency is not part of the current setup for form or routing traffic. |
| Resend | Delivers contact-form email to our inbox | United States processing. |
| Render | Hosts the routing engine behind the guided intake | United States / European regions; no Middle-East residency. |
| OpenAI | AI-assisted reading and drafting inside the pipeline | A UAE data-residency offering exists, but our current pipeline does not yet run under it — so no residency claim is made. |
No processor receives your data for advertising, profiling, or resale. This table is the real current stack; if it changes, this page changes and the change is logged.
Pending items are marked [DRAFT] in place. Nothing on this page overrides the plain-language pledges made across the site; where the final legal text differs, the stricter protection for you applies.