Privacy Policy

Version: 1.1 · Effective date: 29 September 2026 · First published: 11 May 2026 (version 1.0)

1. Data controller

The data controller is HIBR e trade (trading as Hibr AI), licensed in Sharjah, United Arab Emirates. For any privacy matter or data-subject request, contact info@hibr.ai.

2. What we collect

Account & identity data

• Name, work email, phone number, company name, trade license number, TRN
• Emirate, free-zone status, business type (sole / LLC / branch), employee count
• Billing address and payment method tokens (we do not store full card numbers — handled by Stripe)

Operational data (when you use HIBR ERP)

• Customer/vendor/employee records you create in the system
• Transactions: invoices, receipts, payments, payroll entries, inventory movements
• Documents you upload (receipts, trade licenses, contracts)
• VAT 201 and Corporate Tax return figures prepared in HIBR ERP (you file them yourself on EmaraTax; HIBR transmits nothing to the FTA)

Usage & technical data

• IP address, browser type, device identifiers, pages visited, feature usage
• Audit logs of who did what, when (immutable, retained per UAE record-keeping rules)

Demo & lead-magnet inputs

• Questions and inputs to the AI demos (Tax Co-pilot, Audit Pack, ROI Calculator, etc.) and your business inputs for personalization

3. How we use it

• Provide and operate the HIBR ERP service
• Prepare and validate VAT 201 and Corporate Tax returns for you to file on EmaraTax
• Authenticate accounts and prevent fraud
• Send service-related notifications, invoices, and security alerts
• Improve the product through aggregated, de-identified analytics
• With your separate consent, send marketing communications (you may opt out anytime via the email footer)

4. Legal basis (PDPL Article 5)

We process personal data on the following lawful bases:

• Contract performance — to deliver the service you signed up for
• Legal obligation — to comply with UAE tax, AML, and record-keeping law
• Legitimate interest — to operate, secure, and improve the service
• Consent — for marketing communications and optional features

5. Sharing & processors

We do not sell personal data. We share data only with the sub-processors listed at hibr.ai/subprocessors. Those relevant to HIBR ERP are:

• Hostinger — application hosting, database and outbound email (SMTP)
• Netlify — serves the public hibr.ai website, including the HIBR ERP pages
• Stripe — payment processing (PCI DSS Level 1)
• Anthropic — AI model inference (contractually prohibited from training its models on customer data)
• Frappe Cloud — hosts the HIBR ERP development build

HIBR transmits nothing to the FTA: you submit your own returns through the FTA's EmaraTax portal.

All sub-processors are bound by data processing agreements that include PDPL/GDPR-equivalent obligations.

6. Data residency & cross-border transfers

Waitlist, contact-form and enquiry data is stored today on HIBR's backend host, Hostinger, in the United Kingdom, outside the UAE. HIBR ERP's development build runs on Frappe Cloud; the production hosting region for HIBR ERP customer business data is not yet confirmed and will be published here before any customer business data is stored. Some sub-processors (Stripe, Anthropic) also process data outside the UAE. We rely on Standard Contractual Clauses or adequacy decisions for any transfer. The current list is at hibr.ai/subprocessors.

7. Retention

• Financial records (invoices, returns, audit trails): 5 years minimum per Federal Decree-Law 8/2017 Article 78 (VAT) and the UAE Commercial Companies Law
• AML/CFT records: 5 years from end of relationship per Cabinet Decision 74/2020 Article 24
• Account data after account closure: archived for 30 days, then permanently deleted unless retention is required by law
• Demo and lead-magnet data: 18 months from collection, then anonymized
• Marketing email engagement: until opt-out + 90 days for compliance audit

8. Your rights (PDPL Articles 12–17)

As a UAE data subject, you have the right to:

• Access — request a copy of your personal data
• Rectification — correct inaccurate data
• Erasure — request deletion (subject to legal retention obligations)
• Restriction — limit how we process your data
• Portability — receive your data in a structured, machine-readable format
• Object — object to marketing or to processing based on legitimate interest
• Withdraw consent — at any time, without affecting prior processing
• Lodge a complaint — with the UAE Data Office (the national PDPL regulator)

To exercise any right, email info@hibr.ai. We respond within 30 days as required by PDPL Article 19.

9. Security

We use TLS 1.3 in transit and role-based access control for staff access, and we keep append-only audit logs of AI-assisted answers. We do not currently encrypt stored documents at rest beyond the encryption our hosting provider applies, and HIBR holds no ISO 27001 or SOC 2 certification and none is in progress. An earlier version of this page claimed AES-256 encryption at rest; that was not accurate and has been corrected.

10. Cookies

We use strictly necessary cookies (session authentication, CSRF protection) without consent. Analytics and marketing cookies are loaded only after explicit consent via the cookie banner. You can withdraw consent anytime via the "Cookie preferences" link in the footer of any HIBR ERP page.

11. Changes to this policy

We may update this policy. Material changes will be announced by email to active customers and posted to this page with a new effective date. Historical versions remain available on request.

12. Contact

• Privacy queries and data-subject requests: info@hibr.ai
• Regulator: UAE Data Office