Privacy Policy

Applicable data protection laws distinguish between the entity that determines the purposes and means of processing personal data (the Data Controller) and the entity that processes personal data on behalf of the controller (the Data Processor).

• GattAI as Data Controller: With respect to visitors to our website, individuals who register for our enterprise waitlist, request architecture specifications, or communicate with our sales and technical support teams, GattAI acts as the Data Controller.
• GattAI as Data Processor: With respect to employee profiles, national identification documents, candidate resumes, compensation records, performance evaluations, and statutory payroll filings uploaded to or processed through the GattAI SaaS platform, our customer organization is the Data Controller, and GattAI operates strictly as a Data Processor bound by a comprehensive Data Processing Agreement (DPA).

We adhere strictly to the principle of data minimization, collecting only information necessary to fulfill clearly stated legitimate business and operational purposes:

A. Website & Waitlist Submissions: When you voluntarily submit forms on our website, we collect:

• Full name, corporate email address, and professional job title.
• Company or organization name, industry sector, and estimated workforce size.
• Jurisdictions of operational interest (e.g., United Arab Emirates, Dubai mainland or free zones, Saudi Arabia, Egypt, wider GCC).
• Specific functional modules selected (e.g., Payroll Intelligence, AI Recruiter, Performance Management).
• Evaluation timeline and qualitative notes regarding your HR automation roadmap.

B. Technical Telemetry & Perimeter Logs: Server and edge telemetry captured for cybersecurity, DDoS mitigation, and system performance:

• Internet Protocol (IP) address and approximate geographic location.
• Browser user agent, operating system, and preferred interface language.
• Uniform Resource Identifiers (URIs) accessed, request headers, and timestamps.
• Edge security evaluation telemetry processed via Cloudflare WAF and bot scoring.

C. Zero Invasive Tracking & Cookie Policy: This marketing site does not set third-party advertising cookies, does not load tracking pixels, and does not deploy behavioral session-recording scripts. You can inspect all network transactions transparently via your browser developer console.

Under the UAE PDPL (Federal Decree-Law No. 45/2021), DIFC Law No. 5/2020, KSA PDPL, and GDPR, we process your personal data under the following lawful bases:

• Performance of a Contract / Pre-Contractual Steps: Evaluating your enterprise waitlist submission, scheduling technical demonstrations, and provisioning early access sandbox environments upon request.
• Legitimate Interests: Protecting the security and integrity of our infrastructure, preventing fraudulent inquiries, mitigating DDoS threats via Cloudflare edge filters, and optimizing platform performance.
• Compliance with Legal & Statutory Obligations: Fulfilling statutory labor, corporate governance, and regulatory reporting requirements mandated under UAE Labour Law, MOHRE directives, Central Bank WPS guidelines, and corporate tax regulations.

GattAI’s core mission is to automate enterprise HR workflows with unwavering data privacy. We enforce rigorous safeguards around artificial intelligence operations:

• Strict Training Prohibition: Neither waitlist submissions nor customer tenant workforce data is ever used to train, retrain, or fine-tune public or multi-tenant foundation models (including models developed by Anthropic, OpenAI, or other providers).
• Deterministic Pseudonymization: Prior to transmitting any prompt to an external model API, all direct and indirect personal identifiers are replaced with synthetic cryptographic tokens. The identity mapping table is encrypted and never leaves the tenant’s isolated database partition.
• Zero Data Retention (ZDR): Model inferences are executed under contractual Zero Data Retention terms with model providers, ensuring that prompt payloads and completions exist only transiently in provider RAM and are purged immediately upon transmission.

To deliver high-availability, highly resilient cloud services, we partner with verified, enterprise-tier infrastructure providers operating under binding DPAs:

• Cloudflare, Inc. (Edge Security & Network Perimeter): Anycast DNS, Layer 3/4/7 DDoS mitigation, Web Application Firewall (WAF), SSL/TLS 1.3 termination, and Zero Trust access gateways. Ingress traffic is inspected at Cloudflare edge data centers, including UAE points of presence in Dubai (DXB) and Abu Dhabi (AUH).
• Cloud Hosting & UAE Sovereign Data Storage: Enterprise PostgreSQL database clusters and private object storage partitions hosted via AWS / Microsoft Azure, with dedicated sovereign regional cloud data centers in the United Arab Emirates (Dubai / Abu Dhabi) and the Kingdom of Saudi Arabia.
• Transactional Communications: Resend (used solely for delivering waitlist confirmations, login verification codes, and critical security notices; never utilized for marketing tracking).
• AI Model Inference Providers: Enterprise API tiers of Anthropic and OpenAI operating under contractual Zero Data Retention agreements.

We retain personal data only for as long as necessary to achieve the specific purposes for which it was collected:

• Waitlist Submissions: Retained until your organization is onboarded into the platform or until you submit a deletion request.
• Platform Customer Data: Governed by the Master Services Agreement (MSA) and local statutory requirements (e.g., UAE Labour Law requiring statutory retention of payroll and employment records for inspection by MOHRE). Upon contract termination, tenant data is exported securely to the customer and irreversibly purged from all active database volumes following a 30-day grace period.

Regardless of your jurisdiction, you maintain robust rights over your personal data under the UAE PDPL, DIFC Data Protection Law, KSA PDPL, and GDPR:

• Right of Access: You have the right to request a complete copy of the personal data we hold about you.
• Right to Rectification: You may request immediate correction of any inaccurate, incomplete, or outdated personal information.
• Right to Erasure (“Right to be Forgotten”): You may request the deletion of your personal records where no statutory retention obligation (such as mandatory payroll or tax recordkeeping) applies.
• Right to Restriction & Objection: You may object to or request the restriction of specific processing activities.
• Right to Non-Automated Decision Making: Under Article 22 of the GDPR and corresponding UAE PDPL and DIFC standards, you have the right not to be subject to a decision based solely on automated processing. GattAI enforces this right natively through our mandatory, unskippable human approval gates.

To exercise any of these rights, email info@gattai.ai. We verify requests via the originating corporate email address and respond within thirty (30) days without fee.

For questions regarding this Privacy Policy, our data processing practices, or to request our standard Data Processing Agreement (DPA), please contact us:

Email: info@gattai.ai
Phone: +971 56 713 3615
Trust & Security Center: https://gattai.ai/trust/security