Privacy Policy

Last updated: November 3, 2026

This Privacy Policy explains how Ayatii (“Ayatii”, “we”, “our”, “us”) handles personal data. It covers data we collect, use, share and protect when you visit ayatii.com (the “Site”), contact us, or use our anti-piracy and brand protection services. Please read it together with any agreement we sign with you.

1. Who We Are (Data Controller)

Ayatii is a Dubai-based anti-piracy and brand protection company. For the personal data in this Policy, Ayatii is the data controller. The exception is data we process on a client’s behalf under a services agreement. In that case, the agreement will say so.

• Email: contact@ayatii.com
• Phone: +971 543509790
• Address: HDS Business Centre Tower, Cluster M1, Ayatii Office 32nd Floor, Dubai, United Arab Emirates

2. Information We Collect

Contact form and enquiries. If you use our contact form, email or call us, we receive your name, email address, phone number, company name, the service you are interested in, how you heard about us, and the content of your message.

Client account and service data. If you become a client, we hold your team’s business contact details and your contract and billing details. We also hold the instructions and information you give us so that we can deliver the service.

Content submitted for protection. Clients may give us titles, catalogues, brand assets, trademarks, rights information, reference files, fingerprints or watermark data, and proof of ownership or authorisation so that we can identify and act on infringements.

Payment information. Where services are paid for, we process invoicing and payment details. These include billing name, company, address and transaction references. Card payments are handled by the payment provider, and we do not store full card numbers.

Technical data. Like most websites, our hosting infrastructure records your IP address, browser and device type, requested pages and timestamps in server logs. We use these logs to deliver and secure the Site.

Visitor analytics and identifiers. We run our own first-party visitor analytics to understand how the Site is used and to detect abuse. Each time you load a page we record:

• a random device identifier that we generate in your browser and keep in your browser’s local storage and in a cookie, both named ayatii_device_id. The cookie lasts one year (it is first-party, SameSite=Lax, and marked Secure on HTTPS); the local-storage copy stays until you clear your browser data;
• a flag named ayatii_visited in local storage, which tells us whether the device has visited before, and a short-lived timestamp named ayatii_bc in session storage (cleared when you close the tab) that limits how often we run a block check;
• your IP address, as seen by our servers, and your public IPv4 address, which your browser fetches from the lookup service api.ipify.org so that our team sees a readable IPv4 address even if you connect over IPv6. ipify receives your IP address and standard browser request data when this happens;
• your approximate location (country, region, city and time zone) and your network provider, derived from your IP address by our hosting provider;
• your browser and device type (from your browser’s user-agent string), screen size, connection type, preferred language and the referring page;
• the pages you view and roughly how long you spend on each, and clicks on our social-media icons and main call-to-action buttons.

We use this to understand how the Site is used, to recognise returning visitors, to group page views into visits and to block abusive traffic. We do not use it for advertising. We do not combine it with advertising data or share it with advertisers. We keep these records for 90 days (see section 8). The Site does not use advertising cookies or third-party analytics or advertising tools. You can remove the identifier at any time by clearing your browser’s cookies and site data; a new random identifier is created on your next visit.

Administrator session cookie. If you are a member of our staff and sign in to the Site’s administration area, we set a session cookie named ayatii_admin (HttpOnly, SameSite=Lax, valid for seven days). It is not set for ordinary visitors.

3. Data We Process in Enforcement Work

To remove infringing content, we process data about infringing or suspicious activity, which can include personal data of the people behind it. This may include:

• public URLs, listings, usernames, channel and account names, and contact details published on infringing sites, apps, marketplaces and social profiles;
• domain registration, hosting and abuse-contact information;
• screenshots, recordings, test purchases and other evidence of infringement;
• copies of the notices and correspondence we send to platforms, hosts, registrars, search engines and rights holders, and their responses.

We collect this data from public sources and from our own detection and monitoring. We process it to establish, exercise and defend legal claims and to protect our clients’ rights. We share it only as needed to take action. For example, we may share it with the platform or host that is asked to remove the content, with the rights holder we act for, and with courts or authorities where required.

4. How We Use Information and Our Legal Bases

• Respond to enquiries and prepare proposals — steps taken at your request before a contract, and our legitimate interest in running our business.
• Provide and support our services, including client communications and billing — performance of a contract.
• Detect infringement and send takedown notices and related enforcement — our and our clients’ legitimate interests in protecting intellectual property, and the establishment, exercise or defence of legal claims.
• Keep the Site and our systems secure and prevent abuse, such as spam submissions and blocked traffic — legitimate interest.
• Understand how the Site is used through our first-party visitor analytics — legitimate interest in improving the Site and protecting our services. You can object at any time (see section 11).
• Meet legal, tax, accounting and regulatory obligations — legal obligation.
• Send you information about our services, where you have agreed or where the law permits — consent or legitimate interest. You can opt out at any time.

Where we rely on consent, you can withdraw it at any time without affecting processing done before you withdrew it. We do not sell personal data.

5. Applicable Law

We handle personal data in line with the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the “UAE PDPL”) and its implementing rules. If you visit the Site from the European Union or European Economic Area, the EU General Data Protection Regulation (GDPR) also applies to our processing of your data, and the rights in section 11 apply to you as described there.

6. Who We Share Information With

We share personal data only where needed for the purposes in this Policy:

• Service providers (processors). We use the following providers, each only on our instructions and for the purpose stated:
  • Vercel Inc. (United States): hosts and delivers the Site and runs the servers that handle requests, including the visitor-analytics, contact-form and administration functions. It also supplies the approximate location derived from your IP address and keeps basic server logs.
  • Neon, Inc. (database hosting): stores our database, which holds contact-form submissions, visitor-analytics records and administrator accounts.
  • Cloudflare, Inc.: provides DNS (domain name resolution) for ayatii.com.
  • Resend (email delivery): sends us the email generated when you submit the contact form, so the content of your form submission passes through Resend to our mailbox.
  • ipify (api.ipify.org): returns your public IPv4 address to your browser, as described in section 2.
  • Our email hosting provider: hosts the mailboxes for ayatii.com, so emails you send us are stored there.
  Other providers we may use for document storage, accounting or payment processing handle data only on our instructions.
• Platforms, hosts, registrars and search engines that receive our enforcement notices, as described in section 3.
• Clients and rights holders on whose behalf we act.
• Professional advisers, courts, regulators and law enforcement where required by law or to protect legal rights.
• A successor business, if Ayatii is involved in a merger, acquisition or sale of assets, subject to this Policy.

7. International Transfers

Ayatii is based in the UAE. Our providers and the platforms we contact operate in other countries, including the United States and the European Union. Your personal data may therefore be processed outside the UAE and, for visitors in the EU/EEA, outside the EEA. We transfer data across borders only as the UAE PDPL and the GDPR permit. Where required, we use safeguards such as adequacy decisions, standard contractual clauses or other lawful transfer mechanisms. Enforcement notices necessarily go to the platform or host receiving them, wherever it is located.

8. Retention

We keep personal data only as long as needed for the purpose it was collected for:

• contact form enquiries that do not lead to a contract are kept for as long as needed to respond and for a reasonable follow-up period;
• client and billing records are kept for the duration of the relationship and for the period required by tax, accounting and commercial law;
• enforcement records and evidence are kept while a case is active and for the limitation period for related legal claims, or as long as our client’s agreement requires;
• server logs are kept for a short period for security and troubleshooting.
• visitor analytics records (device identifier, IP address, approximate location and pages viewed) are deleted automatically after 90 days.

After that, we delete or anonymise the data.

9. Security

We use technical and organisational measures to protect personal data against unauthorised access, loss, alteration and misuse. These include encrypted connections (HTTPS) to the Site, access limited to staff and providers who need the data, and reputable infrastructure providers. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If a personal data breach affects you, we will notify you and the relevant authority where the law requires.

10. Third-Party Links

The Site may link to websites and services operated by others, such as social networks or map services. We are not responsible for their privacy practices and encourage you to read their policies.

11. Your Rights and How to Exercise Them

Subject to applicable law (the UAE PDPL, Articles 13 to 19, and, for EU/EEA individuals, the GDPR, Articles 15 to 22), you have the right to:

• access: ask whether we process your personal data and receive a copy of it and information about how we use it;
• rectification: ask us to correct inaccurate or incomplete data;
• erasure: ask us to delete your data in the cases the law provides;
• restriction: ask us to restrict the processing of your data, for example while we check a correction or an objection;
• portability: receive the data you gave us in a structured, commonly used and machine-readable format, and have it sent to another controller where this applies;
• objection: object to processing based on our legitimate interests, including our visitor analytics, and to direct marketing;
• withdrawal of consent: withdraw consent at any time where we rely on it, without affecting processing done before you withdrew it;
• automated decisions: not to be subject to a decision based solely on automated processing that significantly affects you. We do not make such decisions about visitors;
• complaint: complain to a data protection authority, such as the UAE Data Office or, for EU/EEA residents, your local supervisory authority.

To exercise a right, email contact@ayatii.com with the subject “Privacy request”. Give enough detail for us to identify you and your request. We may need to verify your identity, and we will respond within the time required by law. Some rights have exceptions. For example, we may need to keep data to establish or defend legal claims or to meet legal obligations. If someone asks about data we hold as a result of enforcement work, we will assess the request on its merits. If we cannot fully comply, we will tell you why.

12. Children

The Site and our services are directed at businesses and adults. We do not knowingly collect personal data from children under 18. If you believe a child has given us personal data, contact us and we will delete it.

13. Changes to This Policy

We may update this Policy from time to time, for example when our practices, providers or the law change. We will post the updated version on this page with a new “Last updated” date. For material changes, we will take reasonable steps to let you know.

14. Contact Us

Questions or requests about this Policy can be sent to contact@ayatii.com, by phone on +971 543509790, or by post to Ayatii, HDS Business Centre Tower, Cluster M1, Ayatii Office 32nd Floor, Dubai, UAE.