Privacy Policy

1. Introduction

Bayty Technologies ("Bayty", "we", "us", or "our") operates the platform accessible at baytyai.com (the "Platform"). We are a technology company incorporated under the laws of the United Arab Emirates, providing a verified construction project management and marketplace platform for professionals and organisations operating worldwide.

This Privacy Policy explains how we collect, use, store, disclose, and protect personal information when you access or use the Platform, register for an account, submit verification documents, or otherwise interact with our services. It also describes the rights available to you under applicable data protection legislation, including the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the "UAE PDPL") and, where applicable, the EU General Data Protection Regulation (the "GDPR") and UK GDPR.

By creating an account or using the Platform, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our practices, you should discontinue use of the Platform and contact us to close your account.

2. Information We Collect

We collect information in several categories depending on how you interact with the Platform:

Account and Registration Data

When you register, we collect your full name, work email address, mobile number, job title, company name, company size, country of operation, and the tier of membership you select. This information is required to create and maintain your account and to personalise your experience on the Platform.

Professional Verification Documents

To maintain the integrity of the Platform, Bayty requires certain users — including engineers, consultants, contractors, and other licensed professionals — to submit verification documents. These may include government-issued identity documents, professional licences, trade licences, insurance records, and certificates of registration issued by relevant regulatory bodies. These documents are processed solely for identity and credential verification purposes and are handled with heightened security measures.

Project and Transactional Data

When you use the Platform to manage projects, you may upload drawings, contracts, specifications, approval records, site reports, and other project-related documents. You may also create or participate in approval workflows, team directories, and marketplace listings. This data is associated with your account and the projects you are authorised to access.

Usage and Technical Data

We automatically collect technical information when you use the Platform, including your IP address, browser type and version, device type, operating system, referring URLs, pages visited, session duration, and feature interactions. This data is used for platform security, performance monitoring, and aggregate analytics.

Cookies and Tracking Technologies

We use cookies and similar technologies as described in Section 8 of this Policy.

3. How We Use Your Information

We process your personal information on the following legal bases and for the following purposes:

Platform Operation and Service Delivery

We use your account data and project data to provide the core functionality of the Platform — including project creation and management, document storage and version control, approval workflow processing, team directory management, and marketplace participation. This processing is necessary for the performance of our contract with you.

Professional Verification

We process verification documents to confirm the professional credentials and identities of Platform users before granting full account activation. This is a core trust and safety feature of the Platform and is carried out in our legitimate interest and the legitimate interest of other Platform users who rely on verified counterparties.

Communications

We use your contact information to send transactional communications including account activation confirmations, password resets, approval notifications, and platform announcements. Where you have provided consent, we may also send product updates and relevant industry communications. You may withdraw consent to marketing communications at any time by using the unsubscribe mechanism in any such communication.

Analytics and Platform Improvement

We analyse aggregated and pseudonymised usage data to understand how the Platform is used, identify areas for improvement, diagnose technical issues, and develop new features. This processing is in our legitimate interest to maintain and improve the Platform.

Legal Compliance and Enforcement

We may process personal information where necessary to comply with applicable laws and regulations in the jurisdictions where we and our customers operate, to respond to lawful requests from government authorities, or to establish, exercise, or defend legal claims.

4. Data Storage and Security

Platform data, including account information, project documents, and verification records, is stored using Supabase infrastructure, which provides enterprise-grade encrypted database and storage services. Data at rest is encrypted using AES-256 encryption. Data in transit is protected using TLS 1.2 or higher. Supabase maintains SOC 2 Type II certification, providing independent assurance over the security, availability, and confidentiality of stored data.

We configure our infrastructure and enterprise deployment plans to support applicable data localisation, privacy, and security requirements where operationally available. Where data is processed across borders, we rely on appropriate transfer mechanisms including standard contractual clauses, data-processing agreements, or adequacy determinations as applicable.

Access to personal data within Bayty is restricted to personnel who require it to perform their job functions. All staff with access to personal data are subject to confidentiality obligations. We conduct periodic access reviews and maintain audit logs of data access events.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority and, where required, affected individuals in accordance with applicable legal timeframes.

5. Data Retention

We retain your account data, including profile information and project records, for the duration of your active account. Following account deletion or termination, we retain personal data for a period of 90 days to allow for account reinstatement requests and to comply with any contractual obligations owed to other Platform users on joint projects. After this period, account data is permanently deleted from our systems.

Professional verification documents — including identity documents and licence certificates — are retained for 12 months from the date of submission. This retention period supports our ability to respond to regulatory enquiries and dispute resolution processes involving verified credentials. After 12 months, verification documents are securely deleted unless a longer retention period is required by applicable law.

Transactional data related to payment processing is retained in accordance with applicable commercial, tax, accounting, and legal record-keeping requirements, which may vary by jurisdiction.

Aggregated and anonymised analytics data, which cannot be used to identify individual users, may be retained indefinitely for business intelligence purposes.

6. Your Privacy Rights

Depending on where you are located and how your data is processed, applicable privacy laws such as the UAE PDPL, GDPR, UK GDPR, or other regional data protection frameworks may grant you the following rights:

Right of Access

You have the right to request confirmation of whether we process your personal data and, if so, to receive a copy of that data together with information about the purposes of processing, the categories of data processed, and the recipients to whom data has been disclosed.

Right to Correction

You have the right to request that inaccurate or incomplete personal data we hold about you be corrected or completed without undue delay.

Right to Deletion

You have the right to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you withdraw consent on which processing is based, or where you object to processing and there are no overriding legitimate grounds. Deletion requests are subject to our legal retention obligations.

Right to Data Portability

You have the right to receive the personal data you have provided to us in a structured, commonly used, and machine-readable format, and to request that we transmit that data to another controller where technically feasible.

To exercise any of these rights, please contact us at info@baytyai.com. We will respond to verified requests within the timeframes required by applicable privacy law. We may need to verify your identity before processing a rights request.

7. Rights for EU and UK Users

Where the GDPR or UK GDPR applies to the processing of your personal data — for example, if you are located in the European Economic Area or United Kingdom — you have the following additional rights:

Right to Object: You have the right to object to processing of your personal data where we rely on legitimate interests as our legal basis. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests.

Right to Restrict Processing: You have the right to request that we restrict processing of your personal data in certain circumstances, including where you contest the accuracy of the data or object to processing.

Right to Withdraw Consent: Where processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing that took place before the withdrawal.

Right to Lodge a Complaint: You have the right to lodge a complaint with a supervisory authority in the EU member state of your habitual residence, place of work, or place of the alleged infringement. UK users may lodge a complaint with the Information Commissioner's Office (ICO).

For transfers of personal data from the EEA or UK to our infrastructure providers, we rely on the European Commission's standard contractual clauses or the UK International Data Transfer Agreement as appropriate.

8. Cookies

We use cookies and similar technologies on the Platform. Cookies are small text files stored on your device that allow us to recognise your browser and provide certain functionality.

Essential Cookies

These cookies are strictly necessary for the Platform to function. They include session authentication tokens, CSRF protection tokens, and user preference settings. Essential cookies cannot be disabled without materially impairing Platform functionality.

Analytics Cookies

With your consent, we use analytics cookies to collect aggregated information about how users interact with the Platform. This data helps us understand feature usage, identify navigation patterns, and improve the overall experience. Analytics cookies are only set after you accept non-essential cookies via our consent mechanism.

Advertising Cookies

We do not use advertising or retargeting cookies on the Platform. We do not share personal data with advertising networks for behavioural targeting purposes.

You may withdraw consent to non-essential cookies at any time by adjusting your preferences through the cookie settings panel accessible in the Platform footer.

9. Third-Party Services

We work with a small number of trusted third-party service providers who may process your personal data on our behalf as data processors. Each provider is subject to a data processing agreement that restricts their use of your data to the specific services they provide to us.

Supabase

Supabase provides our database, file storage, and authentication infrastructure. Personal data including account information, project documents, and verification records are stored on Supabase servers. Supabase is SOC 2 Type II certified. Supabase Privacy Policy →

Stripe

Stripe processes payment transactions on the Platform. When you subscribe to a paid membership tier, your payment card data is transmitted directly to Stripe and is not stored on Bayty's servers. Stripe is PCI DSS Level 1 certified. Stripe Privacy Policy →

HubSpot

HubSpot is used for customer relationship management and marketing communications. Contact information for users who have requested access or engaged with our enterprise sales process may be stored in HubSpot in accordance with your consent preferences. HubSpot Privacy Policy →

Resend

Resend is our transactional email delivery provider. Your email address and the content of transactional messages (such as account activation and approval notifications) are processed by Resend for the purpose of message delivery. Resend Privacy Policy →

10. Contact and Data Controller

Bayty Technologies is the Data Controller responsible for personal data processed through the Platform. If you have any questions about this Privacy Policy, wish to exercise your data protection rights, or wish to raise a concern about our data practices, please contact our Data Protection team:

Email: info@baytyai.com
Platform: baytyai.com
Jurisdiction: United Arab Emirates

We aim to respond to all substantive data protection enquiries within 10 business days. Where a formal rights request requires identity verification or internal review, we will notify you of any extension to this timeframe and the reasons for it.

We may update this Privacy Policy from time to time to reflect changes in our data practices or applicable law. Where changes are material, we will notify registered users by email and update the "Last updated" date at the top of this page. Continued use of the Platform following notification of material changes constitutes acceptance of the revised Policy.