1. Who we are
This Privacy Policy explains how Steinn AI Labs Limited ("Steinn Labs", "we", "us", "our") collects, uses, shares and protects personal data when you visit our website, contact us, or work with us.
Steinn AI Labs Limited is a private company registered in the Dubai International Financial Centre (DIFC) under registration number SR-808691, holding commercial license CL13762. Our registered office is IH-00-01-03-OF-05, Level 3, Innovation One, Dubai International Financial Centre, Dubai, United Arab Emirates.
We provide computer systems and software design, information technology consultancy, and innovation and artificial intelligence research and consultancy services.
For personal data we collect for our own purposes (for example, website visitors, prospects, and business contacts), Steinn Labs is the controller. Where we process personal data on behalf of a client as part of a project, we act as a processor, and the client's own privacy notice governs that data (see Section 5).
This policy applies to our website, our marketing and sales communications, events, and our business relationships. It does not cover third-party websites or services we link to.
2. Laws that apply
As a DIFC-registered company, we process personal data in line with the DIFC Data Protection Law, DIFC Law No. 5 of 2020, and its accompanying Data Protection Regulations (together, the "DIFC DP Law"). Our processing is supervised by the DIFC Commissioner of Data Protection.
Where other data protection laws apply to our processing, such as the EU or UK General Data Protection Regulation for individuals in those regions, or India's Digital Personal Data Protection Act, 2023, we also comply with them to the extent required.
3. Personal data we collect
We collect only the personal data we need for the purposes in Section 4.
Information you give us
- Contact and identity details: name, job title, company, email address, phone number, and country.
- Communications: the content of enquiries, emails, contact forms, meeting requests, and messages you send us.
- Business and contract details: billing contacts, purchase orders, invoicing details, and signatory information.
- Recruitment data: CVs, portfolios, references, and interview notes if you apply to work with us.
- Event and demo details: registrations, preferences, and feedback when you attend our events, webinars, or trade shows, or request a demo.
Information collected automatically
- Device and usage data: IP address, browser type, operating system, referring pages, pages viewed, time on site, and approximate location derived from your IP address.
- Cookie and similar technology data, as described in Section 6.
Information from third parties
- Publicly available professional information, for example from LinkedIn, company websites, and business directories.
- Business contact data from data providers and sales intelligence platforms we use for B2B outreach.
- Referrals from partners, clients, or other contacts.
We do not intentionally collect special category data (such as health, religious, or biometric data) through our website. Please do not send us such data unless we have specifically asked for it.
4. How we use personal data and our lawful bases
We use personal data only where we have a lawful basis under the DIFC DP Law.
| Purpose | Examples | Lawful basis |
|---|---|---|
| Responding to enquiries | Answering contact forms, emails, and demo requests | Legitimate interests; steps before entering a contract |
| Delivering our services | Running projects, workshops, support, and account management | Performance of a contract |
| Billing and administration | Invoicing, payments, record-keeping | Performance of a contract; legal obligation |
| Business development and marketing | B2B outreach, newsletters, event invitations, case studies | Legitimate interests; consent where required |
| Website operation and improvement | Security, troubleshooting, analytics | Legitimate interests; consent for non-essential cookies |
| Recruitment | Assessing applications and contacting candidates | Steps before entering a contract; legitimate interests |
| Legal and compliance | Meeting regulatory requirements, handling disputes, preventing fraud | Legal obligation; legitimate interests |
Where we rely on legitimate interests, we balance our interests against your rights and freedoms. Where we rely on consent, you can withdraw it at any time without affecting processing that took place before withdrawal.
We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.
5. Client data and AI systems
When we build or operate software and AI systems for clients, we may process personal data contained in the client's systems, documents, or datasets. In these cases:
- We act as a processor and handle that data only on the client's documented instructions, under a written agreement that sets out the subject matter, duration, and security measures.
- We do not use client data to train, fine-tune, or improve any general-purpose AI model, ours or a third party's, unless the client has expressly agreed in writing.
- Where a project uses third-party AI model providers or cloud infrastructure, we select providers that offer contractual commitments on confidentiality, security, and data use, and we disclose them to the client as sub-processors.
- Where a client requires it, we deploy solutions within the client's own environment or a self-hosted setup so that data does not leave their control.
- We return or delete client data at the end of the engagement, as agreed in the contract.
If you are an individual whose data is held by one of our clients, please contact that client first. We will support them in responding to your request.
6. Cookies and analytics
Our website uses cookies and similar technologies.
| Type | What it does | Consent needed |
|---|---|---|
| Strictly necessary | Keeps the site secure and working, remembers your cookie choices | No |
| Analytics | Measures traffic and how visitors use the site, so we can improve it | Yes |
| Marketing | Measures the effectiveness of our campaigns and may personalise advertising | Yes |
We set non-essential cookies only after you consent through our cookie banner. You can change your choices at any time through the cookie settings link on our website or your browser settings. Blocking some cookies may affect how the site works.
7. Sharing and international transfers
We do not sell your personal data. We share it only as follows:
- Our team and affiliates: our staff and delivery team, including team members and contractors based in India, who need access to perform their roles.
- Service providers: hosting, cloud, email, CRM, analytics, communication, accounting, and AI model providers who process data on our behalf under contract.
- Professional advisers: lawyers, auditors, accountants, and insurers, under duties of confidentiality.
- Partners: channel or implementation partners, where you have asked to be introduced or where a joint engagement requires it.
- Authorities: regulators, courts, or law enforcement where the law requires us to disclose.
- Business transfers: a buyer or investor as part of a merger, acquisition, financing, or sale of assets, subject to confidentiality.
International transfers. Some recipients are located outside the DIFC, including in India, the United States, and the European Union. Where a destination has not been recognised by the DIFC Commissioner of Data Protection as providing adequate protection, we put appropriate safeguards in place, such as standard contractual clauses or equivalent contractual commitments, as permitted under the DIFC DP Law. You can contact us for more information about these safeguards.
8. Retention and security
We keep personal data only as long as we need it for the purposes it was collected for, or as the law requires.
| Data | Typical retention |
|---|---|
| Enquiries and prospect contacts | Up to 3 years from last meaningful contact |
| Client contract, billing, and accounting records | 6 years after the engagement ends, or longer if the law requires |
| Client project data (as processor) | As set out in the client contract, then returned or deleted |
| Unsuccessful job applications | Up to 12 months, unless you agree to a longer period |
| Website analytics data | Up to 26 months |
We use appropriate technical and organisational measures to protect personal data, including encryption in transit, access controls based on least privilege, multi-factor authentication, logging and monitoring, secure development practices, and confidentiality obligations for staff and contractors. No system is completely secure. If a personal data breach occurs that is likely to put your rights at risk, we will notify the DIFC Commissioner of Data Protection and, where required, you.
9. Your rights
Subject to the conditions in the DIFC DP Law and other applicable laws, you have the right to:
- Access the personal data we hold about you and receive a copy.
- Correct inaccurate or incomplete data.
- Ask us to delete your data.
- Restrict or object to our processing, including processing based on legitimate interests.
- Object at any time to direct marketing.
- Receive your data in a portable format and have it transmitted to another controller.
- Withdraw consent where we rely on it.
- Not be subject to decisions based solely on automated processing that significantly affect you.
To exercise any of these rights, email us at abhishek@steinnlabs.com or jeet@steinnlabs.com. We may need to verify your identity before acting. We will respond within one month, which we may extend where the law allows; we will tell you if we do.
If you are not satisfied with our response, you can complain to the DIFC Commissioner of Data Protection (www.difc.ae). If you are in another jurisdiction, you may also contact your local data protection authority.
10. Other important information
Children. Our website and services are intended for businesses and are not directed at anyone under 18. We do not knowingly collect personal data from children. If you believe a child has given us personal data, please contact us and we will delete it.
Third-party links. Our website may link to other websites, platforms, or social media. We are not responsible for their privacy practices, and we encourage you to read their policies.
Marketing. You can unsubscribe from our marketing emails at any time using the link in each email or by contacting us.
Changes to this policy. We may update this policy from time to time. The "Last updated" date at the top shows when it last changed. Where changes are significant, we will take reasonable steps to let you know.
11. Contact us
If you have questions about this policy or how we handle personal data, contact us:
Steinn AI Labs Limited IH-00-01-03-OF-05, Level 3, Innovation One Dubai International Financial Centre, Dubai, United Arab Emirates Email: abhishek@steinnlabs.com, jeet@steinnlabs.com DIFC Registration No.: SR-808691 · Commercial License No.: CL13762