Legal · iluxa.ae
Privacy
Policy
01 / 16
Who We Are
This Privacy Policy explains how iluxa AI collects, uses, stores, shares and protects personal data in connection with the operation of the iluxa AI platform. It applies to all users of the Platform including subscribing venue businesses ("Clients") and the end customers of those businesses ("End Users").
iLuxa AI L.L.C-FZ operates the iluxa AI platform — an AI operating system that connects customer conversations, venue operations and business intelligence for UAE hospitality and wellness businesses. We are the data controller in respect of personal data collected through our website, marketing activities and our business relationship with Clients. In relation to End User data processed through the Platform on behalf of Clients, we act as a data processor.
Our registered address is: Meydan Grandstand, 6th Floor, Meydan Road, Nad Al Sheba, Dubai, U.A.E. (Trade Licence No. 2648498.01)
Our data protection contact is reachable at: hello@iluxa.ae
Our registered address is: Meydan Grandstand, 6th Floor, Meydan Road, Nad Al Sheba, Dubai, U.A.E. (Trade Licence No. 2648498.01)
Our data protection contact is reachable at: hello@iluxa.ae
02 / 16
Who This Policy Covers
This Privacy Policy applies to three categories of individuals whose personal data we may process:
- Clients — businesses and individuals who have subscribed to the iluxa AI platform, including owners, managers and authorised staff of subscribing venues.
- End Users — customers and guests of iluxa AI Clients who interact with the Platform through WhatsApp, Instagram, Facebook Messenger or voice channels when booking services at a Client venue.
- Website Visitors — individuals who visit iluxa.ae, contact us by email or WhatsApp, or interact with our marketing communications.
Note for End Users: If you are an end customer of a business that uses iluxa AI — for example, if you booked a salon appointment or beach club cabana through a WhatsApp conversation — your data is processed on behalf of that business (our Client). For questions about how that business handles your data, please contact them directly. iluxa AI processes your data only in our capacity as a technology service provider to that business.
03 / 16
Data We Collect
3.1
Client Data
- Identity data — name of business owner or primary contact, job title, trade licence details
- Contact data — email address, phone number, WhatsApp number, business address
- Account data — login credentials (stored in hashed form), subscription plan, billing history
- Connected account data — when a Client chooses to connect a Facebook Page or Instagram professional account to the Platform (through Facebook Login for Business): the Page and account names and IDs, and the access tokens Meta issues for them. Tokens are stored encrypted, used only to receive and send that Client's messages, and deleted when the Client disconnects the account
- Venue configuration data — service catalogues, staff names and qualifications, pricing, business rules and deposit settings provided during onboarding
- Financial data — billing contact details, payment method information (processed and stored by our payment processor — we do not store full card details)
- Communications data — emails, support messages and any other correspondence with iluxa AI
3.2
End User Data
- Contact data — phone number (from WhatsApp or voice call, or if provided during an Instagram or Messenger conversation), name (if provided during the conversation), and, on Instagram and Messenger, the public profile name, username and the account ID Meta assigns to the conversation
- Booking data — service requested, preferred date and time, staff preference, location selected
- Conversation data — the content of WhatsApp, Instagram and Facebook Messenger messages, and voice call transcripts, processed by the Platform
- Payment data — deposit payment confirmation (not full card details, which are handled by the payment processor)
- Interaction history — prior bookings made through the Platform for the same Client venue
3.3
Website Visitor Data
- IP address and device/browser information recorded in our hosting provider's standard server logs
- Name, email address, phone or WhatsApp number and message content when you contact us
- Website technical data as described in Section 12
3.4
Data We Do Not Collect
iluxa AI does not intentionally collect sensitive personal data including racial or ethnic origin, political opinions, religious beliefs, health data, biometric data or criminal record information. If any such data is inadvertently received through a booking conversation, it will not be stored or processed beyond what is strictly necessary.
04 / 16
How We Collect Data
- Directly from Clients — during the subscription sign-up process, onboarding, and ongoing account management
- Through the Platform — automatically, when End Users interact with the Platform via WhatsApp, Instagram, Facebook Messenger or voice channels operated on behalf of Clients
- Through Facebook Login for Business — when a Client connects its Facebook Pages or Instagram professional accounts, Meta shares the account details and access permissions the Client approves
- From our website — when individuals contact us by email or WhatsApp, or browse our site
- From third-party services — including Meta (WhatsApp delivery data), Vapi and Twilio (voice call data), and analytics providers
- From marketing interactions — when individuals respond to our email campaigns, social media content or paid advertisements
05 / 16
How We Use Data
| Purpose | Data Used | Legal Basis |
|---|---|---|
| Providing the Platform to Clients — processing bookings, managing availability, sending confirmations | Client data, End User data | Contract performance |
| Client account management — billing, subscription administration, support | Client data | Contract performance |
| Onboarding and configuration — building venue setup, service catalogues, staff profiles | Client data, venue configuration data | Contract performance |
| Platform improvement — analysing aggregated usage patterns to improve AI accuracy and features | Anonymised aggregated data | Legitimate interest |
| Security and fraud prevention — monitoring for unusual activity, protecting system integrity | Account data, usage data | Legitimate interest |
| Marketing to prospects — sending information about iluxa AI to interested businesses | Website visitor data, email and WhatsApp enquiries | Consent / Legitimate interest |
| Legal compliance — meeting obligations under UAE law including tax, anti-money laundering | Client data, financial data | Legal obligation |
| Responding to enquiries — demo requests, support queries, complaints | Contact data, communications data | Legitimate interest / Consent |
06 / 16
Legal Basis for Processing
Under UAE Federal Decree Law No. 45 of 2021 on the Protection of Personal Data (PDPL), we rely on the following legal bases for processing personal data:
- Contract performance — processing necessary to provide the Platform to Clients under our subscription agreement
- Legitimate interests — processing for platform security, fraud prevention, product improvement and marketing to business contacts, where these interests are not overridden by individual rights
- Legal obligation — processing required to comply with UAE law including tax, regulatory reporting and record-keeping obligations
- Consent — for marketing to individuals who have opted in to receive communications from us, and for any non-essential cookies on our website
End User data is processed under the authority of the Client as data controller. Clients are responsible for ensuring they have an appropriate legal basis for collecting and using their customers' data through the Platform.
07 / 16
Third-Party Services
The iluxa AI Platform operates as an agentic AI system that depends on the following third-party services. Data is shared with these providers as necessary to deliver the Platform's functionality. Each provider processes data in accordance with their own privacy policies and data processing agreements:
| Provider | Purpose | Data Shared | Location |
|---|---|---|---|
| Meta Platforms, Inc. | WhatsApp Business API, Messenger Platform and Instagram messaging — delivery and receipt of messages between the Platform and End Users; Facebook Login for Business for connecting Client accounts | Phone numbers, Instagram and Facebook account IDs and profile names, message content | USA / Global |
| Vapi | Voice AI infrastructure — processing inbound voice calls, speech-to-text, call management | Voice recordings, call transcripts, phone numbers | USA |
| Twilio, Inc. | Telephony — inbound toll numbers, call routing and SMS confirmations | Phone numbers, call metadata, SMS content | USA |
| Anthropic, PBC | Claude language model — AI language processing, understanding booking intent and generating responses | Conversation content (anonymised where possible) | USA |
| Supabase, Inc. | Database infrastructure — storage of booking records, client configurations, staff profiles | All Platform data | South Korea (data at rest); USA (provider access) |
| Render Services, Inc. | Cloud hosting — hosting and running the iluxa AI application | All data in transit through the application | USA |
| Payment Processor (TBC) | Processing deposit payments from End Users | Payment details (not stored by iluxa AI) | TBC |
Important: iluxa AI does not sell personal data to third parties. Data shared with the providers above is shared solely for the purpose of delivering the Platform's functionality and not for those providers' own marketing or commercial purposes, subject to their respective terms of service.
08 / 16
International Data Transfers
Several of the third-party services listed in Section 7 are based outside the UAE and process data outside the UAE. Our primary database is hosted in South Korea (Amazon Web Services, Asia Pacific — Seoul region), and our remaining service providers are based in the United States. Provider personnel may also access data remotely from the countries in which they operate. Under the UAE PDPL, international transfers of personal data are permitted where the recipient country offers an adequate level of data protection, or where the transfer is made under a contract that requires the recipient to protect the data to a standard equivalent to the PDPL.
Where data is transferred internationally, iluxa AI relies on written data processing agreements with each of its third-party service providers, which require them to keep the data confidential and secure and to use it only to provide their service to iluxa AI. The services that operate outside the UAE are listed in Section 7.
Clients who have specific data residency requirements should contact us at hello@iluxa.ae to discuss whether alternative configurations are available.
Where data is transferred internationally, iluxa AI relies on written data processing agreements with each of its third-party service providers, which require them to keep the data confidential and secure and to use it only to provide their service to iluxa AI. The services that operate outside the UAE are listed in Section 7.
Clients who have specific data residency requirements should contact us at hello@iluxa.ae to discuss whether alternative configurations are available.
09 / 16
Data Retention
9.1
Client Data
We retain Client account data for the duration of the subscription and for 3 years following termination, to satisfy legal, accounting and dispute resolution requirements. Financial and billing records are retained for 5 years in accordance with UAE commercial law requirements.
9.2
End User Booking Data
End User booking data is retained on behalf of the Client for the duration of the Client's subscription, plus 30 days following termination, after which it is permanently deleted from iluxa AI's systems.
9.3
Conversation Data
Message content (WhatsApp, Instagram and Facebook Messenger) and voice call transcripts processed through the Platform are retained on behalf of the Client for the duration of the Client's subscription, so that the Client can review past conversations and its performance over time, plus 30 days following termination, after which they are permanently deleted. A Client may ask us to delete older conversations sooner, and an End User may ask for their own conversations to be deleted (see Section 11 and our Data Deletion page). Residual copies in backup systems are purged on a rolling 30-day backup cycle.
When a Client uses Voice AI, callers are told at the start of each call that they are speaking with an AI assistant and that the call is transcribed (and recorded, where call recording is switched on).
When a Client uses Voice AI, callers are told at the start of each call that they are speaking with an AI assistant and that the call is transcribed (and recorded, where call recording is switched on).
9.4
Website and Marketing Data
Data collected from website visitors and marketing interactions is retained for a maximum of 24 months from the date of collection, or until a withdrawal of consent is received, whichever is earlier.
9.5
Early Deletion
We will delete personal data earlier than the above periods where: (a) a valid erasure request is received and no legal basis for retention exists; (b) the data is no longer necessary for the purpose for which it was collected; or (c) we are required to do so by applicable law.
10 / 16
Data Security
iluxa AI implements the following technical and organisational security measures to protect personal data:
- Encryption in transit — all data transmitted between users, the Platform, and third-party services is encrypted using TLS 1.2 or higher
- Encryption at rest — data stored in our database infrastructure is encrypted at rest
- Access controls — access to personal data is restricted to authorised personnel on a need-to-know basis
- Authentication — secure authentication protocols are used for all administrative access to Platform systems
- Third-party security — we select third-party providers who implement industry-standard security measures and maintain relevant security certifications
- Security reviews — we conduct periodic reviews of our security practices and update controls as threats evolve
Despite these measures, no system is entirely secure. In the event of a confirmed data breach that is likely to result in risk to individuals, we will notify affected Clients without undue delay and within 72 hours of becoming aware, in accordance with our obligations under the UAE PDPL.
11 / 16
Your Rights
Under the UAE Federal Decree Law No. 45 of 2021, individuals whose personal data we process have the following rights:
- Right of access — you may request a copy of the personal data we hold about you
- Right to correction — you may request correction of inaccurate or incomplete personal data
- Right to erasure — you may request deletion of your personal data where we no longer have a legal basis to retain it
- Right to restrict processing — you may request that we limit the processing of your data in certain circumstances
- Right to data portability — you may request your personal data in a structured, commonly used format
- Right to withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing
- Right to object — you may object to processing based on legitimate interests where your rights override those interests
Note for End Users: If you are an end customer of a business using iluxa AI and wish to exercise rights in relation to booking data held about you, we recommend contacting the business directly in the first instance, as they are the data controller for that data. You may also contact us at hello@iluxa.ae and we will assist in coordinating with the relevant Client.
11.1
How to Submit a Request
To exercise any of the above rights, please contact us at hello@iluxa.ae with your name, contact details and a description of your request. We will respond within 30 calendar days. We may request proof of identity before processing your request. We will not charge a fee for legitimate requests unless they are manifestly unfounded or excessive. How to have your Instagram, Facebook Messenger or WhatsApp conversation data deleted is explained on our Data Deletion page.
12 / 16
Cookies & Tracking
Our website (iluxa.ae) does not set its own cookies and does not use analytics or marketing cookies. Some limited technical data is still processed when you visit:
- Hosting — the website is hosted by Vercel Inc., which records standard technical information such as IP address, browser type and the pages requested, in order to deliver and secure the site.
- Fonts — the website's typefaces are loaded from Google Fonts, so your browser connects to Google's servers, which receive your IP address.
- WhatsApp and email — if you choose to contact us through WhatsApp, that conversation is also handled by WhatsApp (Meta Platforms, Inc.) under its own privacy policy.
If we introduce analytics or marketing cookies in future, we will update this section and ask for your consent before setting any non-essential cookies. The Platform itself (WhatsApp and voice channels) does not use cookies.
13 / 16
Children's Privacy
The iluxa AI Platform and website are not directed at children under the age of 18. We do not knowingly collect personal data from individuals under 18. If we become aware that we have inadvertently collected data from a minor, we will delete it promptly.
If a venue serves individuals under 18, the Client is responsible for ensuring appropriate consent mechanisms are in place for any data collected through the Platform.
If a venue serves individuals under 18, the Client is responsible for ensuring appropriate consent mechanisms are in place for any data collected through the Platform.
14 / 16
Client Responsibilities
Clients who use the iluxa AI Platform to process End User data are acting as data controllers in respect of that data. This means they have independent obligations under the UAE PDPL, including:
- Maintaining a lawful basis for collecting and processing End User personal data through the Platform
- Providing End Users with clear and accessible privacy information, including that a third-party AI platform (iluxa AI) processes their booking data on the Client's behalf
- Handling data subject access requests, correction requests and erasure requests received from their End Users in a timely manner
- Ensuring any data uploaded to the Platform during onboarding (such as staff personal information) is collected and shared lawfully
- Notifying iluxa AI promptly of any data subject requests that require iluxa AI's assistance to fulfil
Clients who require a formal Data Processing Agreement (DPA) with iluxa AI — for example, to satisfy their own regulatory obligations — should contact us at hello@iluxa.ae.
15 / 16
Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, the Platform's functionality, applicable law, or guidance from the UAE Data Office. When we make material changes, we will notify Clients by email to the address on record and update the "Last Updated" date at the top of this document.
We encourage all users to review this Policy periodically. Continued use of the Platform following the effective date of any update constitutes acceptance of the revised Policy.
The current version of this Privacy Policy is always available at: iluxa.ae/privacy
We encourage all users to review this Policy periodically. Continued use of the Platform following the effective date of any update constitutes acceptance of the revised Policy.
The current version of this Privacy Policy is always available at: iluxa.ae/privacy
16 / 16
Contact & Complaints
For any questions, concerns or requests relating to this Privacy Policy or the way we handle personal data, please contact our data protection contact:
Data Protection Contact
iLuxa AI L.L.C-FZ
Email: hello@iluxa.ae
Address: Meydan Grandstand, 6th Floor, Meydan Road, Nad Al Sheba, Dubai, U.A.E.
Website: iluxa.ae
Address: Meydan Grandstand, 6th Floor, Meydan Road, Nad Al Sheba, Dubai, U.A.E.
Website: iluxa.ae
16.1
Complaints
If you are not satisfied with our response to a privacy concern, you have the right to lodge a complaint with the UAE Data Office, the supervisory authority responsible for enforcing the UAE PDPL. Information about the UAE Data Office and how to submit a complaint is available at uaedataoffice.ae.