Privacy Policy
Effective: 1 June 2025 · Sharjah, UAE
Your privacy matters. This Policy explains what data we collect, why we collect it, and what rights you have under UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (“UAE PDPL”).
Privacy Policy
Effective: 1 June 2025 · Sharjah, UAE
Your privacy matters. This Policy explains what data we collect, why we collect it, and what rights you have under UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (“UAE PDPL”).
1. Who we are
1.1 This Privacy Policy explains how UltoLabs LLC ("UltoLabs", "we", "us", "our") collects, uses, shares and protects personal data. UltoLabs LLC is licensed in the Sharjah Media City Free Zone (Shams), Sharjah, United Arab Emirates, under trade licence number 2646345.01, with its registered address at Sharjah Media City (Shams), Sharjah, UAE.
1.2 Questions about this policy or your data: contact@ultolabs.com
2. What this policy covers
2.1 This policy covers personal data we handle as a controller, meaning we decide why and how it is used. That includes:
visitors to ultolabs.com (the "Website");
people who contact us, fill in a form, book a call or use the Website demo;
our clients' and prospective clients' contacts, such as owners, staff and decision makers;
suppliers and partners.
2.2 Data we process for our clients. When we run a service for a business, such as UltoVoice answering its calls, we process its customers' data on that business's behalf and on its instructions. In that case the business is the controller and is responsible for telling its customers how their data is used. If you called or messaged a business that uses our systems, please contact that business first about your data. We will help them respond.
3. The laws we follow
3.1 We are established in the UAE and comply with UAE Federal Decree Law No. 45 of 2021 on the Protection of Personal Data ("PDPL") and other applicable UAE laws.
3.2 We serve businesses across the Gulf, the wider Arab region and beyond, so we also comply with every other data protection law that applies to us or to the personal data we handle. These include, for example, the Saudi Personal Data Protection Law, Qatar Law No. 13 of 2016 on Personal Data Privacy Protection, Bahrain Law No. 30 of 2018 on Personal Data Protection, the Oman Personal Data Protection Law issued by Royal Decree No. 6 of 2022, Egypt Law No. 151 of 2020 on Personal Data Protection, the Jordan Personal Data Protection Law No. 24 of 2023, and the GDPR and UK GDPR for people in the European Union and United Kingdom. Where more than one law applies, we follow the one that gives you greater protection.
4. What we collect
Information you give us
Identity and contact details: name, job title, company name, email address, phone number and country.
Enquiry and booking details: what you tell us in a contact form, booking form, email, call or message, and the time and date of any meeting booked.
Demo interactions: if you use the voice or chat demo on the Website, the audio, transcript and text of that conversation.
Client and project information: business information, account access, brand assets, workflow details and other materials you share so we can deliver the Services.
Billing details: billing name and address, tax registration number and payment records. Card and bank payments are processed by our payment provider. We do not see or store your full card details.
Information collected automatically
Usage and device data: IP address, approximate location (city or country level), browser and device type, operating system, referring website, pages viewed, time on page, clicks and the date and time of visits.
Cookies and similar technologies: see section 9.
Information from other sources
Business contact details that are publicly available, for example on a company website or professional profile, or that someone shares with us when introducing you.
4.1 We do not ask for sensitive personal data (such as health, biometric, religious, political or criminal record data) through the Website. Please do not share it with us or with the demo.
5. How we use your data, and why
Answering enquiries and bookings. Replying to your message, arranging and holding calls, and sending proposals. Legal ground: your request, and steps before a contract.
Delivering the Services. Setting up, operating and supporting what you have engaged us for. Legal ground: performing our contract.
Billing and accounts. Issuing invoices, taking payments and keeping financial records. Legal ground: contract and legal obligation.
Website analytics and metrics. Measuring visits, traffic sources, popular pages, form completions and bookings, so we can understand how the Website performs and improve our content, services and marketing. Legal ground: your consent where required (see section 9), otherwise our legitimate business interest in running and improving our Website.
Following up and marketing. Contacting you by email, phone or message about our services, relevant offers, updates and events after you have given us your details. Legal ground: your consent, or our legitimate interest in contacting business contacts about related services, where the law allows. You can opt out at any time.
Improving the demo and our services. Reviewing demo conversations to fix errors and improve how the demo responds. Legal ground: legitimate interest, and consent where required.
Security and fraud prevention. Protecting the Website, our systems and our clients, including against payment fraud. Legal ground: legitimate interest and legal obligation.
Legal and regulatory. Meeting tax, accounting and legal duties, and handling legal claims. Legal ground: legal obligation.
5.1 How analytics and follow up work together
We want to be clear about this:
Anonymous browsing. If you visit the Website without giving us your details, our analytics show us activity such as pages viewed and where visits come from. We use this in aggregate to measure performance. We do not use it to find out who you are, and we do not buy or use services that try to identify individual visitors.
Once you give us your details. If you submit a form, book a call, email us or give your details in the demo, we may connect your contact details with your activity on the Website (for example which service pages you looked at) so that we can understand what you are interested in and follow up with relevant information.
Follow up. We may contact you by email, phone or message about the enquiry you made and about related UltoLabs services. Where the law requires your consent for marketing, we will ask for it, for example with a checkbox on our forms.
Stopping it. You can stop marketing at any time by using the unsubscribe link in any email, replying "stop", or emailing contact@ultolabs.com. We will still contact you about an active enquiry or engagement where needed.
5.2 What we do not do
We do not sell or rent your personal data.
We do not use your data, or our clients' data, to train AI models for our own purposes or for anyone else's.
We do not make decisions that have legal or similarly significant effects on you based solely on automated processing.
6. Who we share data with
We share personal data only where needed, with:
Service providers who help us run our business, under contract and only for our purposes, including website hosting and analytics (Framer and Google), email and communication tools, scheduling and form tools, AI model and voice providers that power our demo and Services, telephony providers, cloud hosting, payment processing and accounting.
Professional advisers such as lawyers, accountants and auditors.
Authorities, courts or regulators where the law requires it, or to protect our rights, our clients or others.
A buyer or successor if our business is reorganised, merged or sold, in which case your data stays protected under this policy.
We ask our service providers to keep data secure and to use it only on our instructions. A current list of the main providers is available on request.
7. International transfers
7.1 Some of our providers store or process data outside the UAE, including in the European Union and the United States. Where we transfer personal data outside the UAE, we do so in line with the PDPL and other applicable laws, using safeguards such as contractual protections, adequacy decisions or other lawful transfer mechanisms.
8. How long we keep data
We keep personal data only for as long as we need it for the purpose it was collected for. After that, we delete it or anonymise it. Our retention periods are:
Enquiries and contacts who do not become clients: up to 24 months after our last contact with you, unless you ask us to delete your data sooner.
Marketing preferences and opt outs: for as long as we need them to respect your choice.
Client and project records: for the length of the engagement, then for as long as we have a legal, tax, contractual or legitimate business reason to keep them. Where the law allows, this may be longer than 5 years.
Invoices and financial records: for as long as UAE tax and commercial laws require, which is currently at least 5 years.
Demo conversations: up to 90 days, unless we need them for longer to investigate misuse.
Website analytics: up to 14 months in a form that can identify you, after which we combine them into anonymous totals.
Data we process on behalf of our clients is kept and deleted according to their instructions and our agreement with them.
9. Cookies and analytics
9.1 Cookies are small files placed on your device. We use:
Essential cookies and storage that the Website needs to work, such as security and remembering your cookie choice. These cannot be switched off.
Analytics from Google Analytics (through Google Tag Manager) and Framer Analytics, which help us count visits, see how people reach and use the Website, and measure form completions and bookings. Google Analytics uses cookies such as _ga and ga*.
9.2 We do not use advertising or retargeting cookies on the Website. If that changes, we will update this policy and ask for your consent first where required.
9.3 Where required, we ask for your consent before setting analytics cookies, and you can change your choice at any time through the cookie settings link on the Website. You can also block or delete cookies in your browser settings, and opt out of Google Analytics at tools.google.com/dlpage/gaoptout. Blocking essential cookies may affect how the Website works.
10. The Website demo
10.1 Our voice and chat demo is powered by AI. When you use it, what you say or type is processed by us and our AI and voice providers so the demo can respond, and it may be recorded and transcribed. We use demo conversations to answer you, follow up on any request you make in them, and improve the demo. Please do not share sensitive information in the demo. If you do not want your conversation recorded, please contact us by email instead.
11. How we protect data
11.1 We use appropriate technical and organisational measures to protect personal data against loss, misuse and unauthorised access, including access controls, encryption in transit and at rest where technically feasible, secure development practices, logging and regular review of our security.
11.2 No system is completely secure. If a personal data breach affects you and the law requires us to tell you, we will notify you and the relevant authority without undue delay.
11.3 Payment fraud warning. Payment links are only ever sent from sales@ultolabs.com. We never send bank details in a document or ask you to change payment details by email. If you receive such a message, do not pay it and contact us.
12. Your rights
Depending on the law that applies to you, you have the right to:
be told how your data is used, and get a copy of it;
have inaccurate data corrected;
have your data deleted;
restrict or object to how we use it, including objecting to direct marketing at any time;
receive your data in a portable format;
withdraw consent at any time, without affecting processing before you withdrew it;
object to decisions based solely on automated processing.
To use any of these rights, email contact@ultolabs.com. We may need to confirm your identity first. We aim to reply within 30 days. There is no charge, unless a request is clearly unfounded or excessive.
If you are not satisfied with our response, you may complain to the UAE Data Office or to the data protection authority in your country.
13. Children
13.1 The Website and our Services are intended for businesses and are not directed at anyone under 18. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.
14. Third party websites
14.1 The Website may link to other websites and platforms. Their privacy practices are their own, and we recommend reading their policies.
15. Changes to this policy
15.1 We may update this policy from time to time. The latest version will always be on this page with its date. If we make significant changes, we will highlight them on the Website or tell you directly.
16. Contact
UltoLabs LLC Sharjah Media City (Shams), Sharjah, United Arab Emirates Trade licence no. 2646345.01 contact@ultolabs.com
1. Who we are
1.1 This Privacy Policy explains how UltoLabs LLC ("UltoLabs", "we", "us", "our") collects, uses, shares and protects personal data. UltoLabs LLC is licensed in the Sharjah Media City Free Zone (Shams), Sharjah, United Arab Emirates, under trade licence number 2646345.01, with its registered address at Sharjah Media City (Shams), Sharjah, UAE.
1.2 Questions about this policy or your data: contact@ultolabs.com
2. What this policy covers
2.1 This policy covers personal data we handle as a controller, meaning we decide why and how it is used. That includes:
visitors to ultolabs.com (the "Website");
people who contact us, fill in a form, book a call or use the Website demo;
our clients' and prospective clients' contacts, such as owners, staff and decision makers;
suppliers and partners.
2.2 Data we process for our clients. When we run a service for a business, such as UltoVoice answering its calls, we process its customers' data on that business's behalf and on its instructions. In that case the business is the controller and is responsible for telling its customers how their data is used. If you called or messaged a business that uses our systems, please contact that business first about your data. We will help them respond.
3. The laws we follow
3.1 We are established in the UAE and comply with UAE Federal Decree Law No. 45 of 2021 on the Protection of Personal Data ("PDPL") and other applicable UAE laws.
3.2 We serve businesses across the Gulf, the wider Arab region and beyond, so we also comply with every other data protection law that applies to us or to the personal data we handle. These include, for example, the Saudi Personal Data Protection Law, Qatar Law No. 13 of 2016 on Personal Data Privacy Protection, Bahrain Law No. 30 of 2018 on Personal Data Protection, the Oman Personal Data Protection Law issued by Royal Decree No. 6 of 2022, Egypt Law No. 151 of 2020 on Personal Data Protection, the Jordan Personal Data Protection Law No. 24 of 2023, and the GDPR and UK GDPR for people in the European Union and United Kingdom. Where more than one law applies, we follow the one that gives you greater protection.
4. What we collect
Information you give us
Identity and contact details: name, job title, company name, email address, phone number and country.
Enquiry and booking details: what you tell us in a contact form, booking form, email, call or message, and the time and date of any meeting booked.
Demo interactions: if you use the voice or chat demo on the Website, the audio, transcript and text of that conversation.
Client and project information: business information, account access, brand assets, workflow details and other materials you share so we can deliver the Services.
Billing details: billing name and address, tax registration number and payment records. Card and bank payments are processed by our payment provider. We do not see or store your full card details.
Information collected automatically
Usage and device data: IP address, approximate location (city or country level), browser and device type, operating system, referring website, pages viewed, time on page, clicks and the date and time of visits.
Cookies and similar technologies: see section 9.
Information from other sources
Business contact details that are publicly available, for example on a company website or professional profile, or that someone shares with us when introducing you.
4.1 We do not ask for sensitive personal data (such as health, biometric, religious, political or criminal record data) through the Website. Please do not share it with us or with the demo.
5. How we use your data, and why
Answering enquiries and bookings. Replying to your message, arranging and holding calls, and sending proposals. Legal ground: your request, and steps before a contract.
Delivering the Services. Setting up, operating and supporting what you have engaged us for. Legal ground: performing our contract.
Billing and accounts. Issuing invoices, taking payments and keeping financial records. Legal ground: contract and legal obligation.
Website analytics and metrics. Measuring visits, traffic sources, popular pages, form completions and bookings, so we can understand how the Website performs and improve our content, services and marketing. Legal ground: your consent where required (see section 9), otherwise our legitimate business interest in running and improving our Website.
Following up and marketing. Contacting you by email, phone or message about our services, relevant offers, updates and events after you have given us your details. Legal ground: your consent, or our legitimate interest in contacting business contacts about related services, where the law allows. You can opt out at any time.
Improving the demo and our services. Reviewing demo conversations to fix errors and improve how the demo responds. Legal ground: legitimate interest, and consent where required.
Security and fraud prevention. Protecting the Website, our systems and our clients, including against payment fraud. Legal ground: legitimate interest and legal obligation.
Legal and regulatory. Meeting tax, accounting and legal duties, and handling legal claims. Legal ground: legal obligation
5.1 How analytics and follow up work together
We want to be clear about this:
Anonymous browsing. If you visit the Website without giving us your details, our analytics show us activity such as pages viewed and where visits come from. We use this in aggregate to measure performance. We do not use it to find out who you are, and we do not buy or use services that try to identify individual visitors.
Once you give us your details. If you submit a form, book a call, email us or give your details in the demo, we may connect your contact details with your activity on the Website (for example which service pages you looked at) so that we can understand what you are interested in and follow up with relevant information.
Follow up. We may contact you by email, phone or message about the enquiry you made and about related UltoLabs services. Where the law requires your consent for marketing, we will ask for it, for example with a checkbox on our forms.
Stopping it. You can stop marketing at any time by using the unsubscribe link in any email, replying "stop", or emailing contact@ultolabs.com. We will still contact you about an active enquiry or engagement where needed.
5.2 What we do not do
We do not sell or rent your personal data.
We do not use your data, or our clients' data, to train AI models for our own purposes or for anyone else's.
We do not make decisions that have legal or similarly significant effects on you based solely on automated processing.
6. Who we share data with
We share personal data only where needed, with:
Service providers who help us run our business, under contract and only for our purposes, including website hosting and analytics (Framer and Google), email and communication tools, scheduling and form tools, AI model and voice providers that power our demo and Services, telephony providers, cloud hosting, payment processing and accounting.
Professional advisers such as lawyers, accountants and auditors.
Authorities, courts or regulators where the law requires it, or to protect our rights, our clients or others.
A buyer or successor if our business is reorganised, merged or sold, in which case your data stays protected under this policy.
We ask our service providers to keep data secure and to use it only on our instructions. A current list of the main providers is available on request.
7. International transfers
7.1 Some of our providers store or process data outside the UAE, including in the European Union and the United States. Where we transfer personal data outside the UAE, we do so in line with the PDPL and other applicable laws, using safeguards such as contractual protections, adequacy decisions or other lawful transfer mechanisms.
8. How long we keep data
We keep personal data only for as long as we need it for the purpose it was collected for. After that, we delete it or anonymise it. Our retention periods are:
Enquiries and contacts who do not become clients: up to 24 months after our last contact with you, unless you ask us to delete your data sooner.
Marketing preferences and opt outs: for as long as we need them to respect your choice.
Client and project records: for the length of the engagement, then for as long as we have a legal, tax, contractual or legitimate business reason to keep them. Where the law allows, this may be longer than 5 years.
Invoices and financial records: for as long as UAE tax and commercial laws require, which is currently at least 5 years.
Demo conversations: up to 90 days, unless we need them for longer to investigate misuse.
Website analytics: up to 14 months in a form that can identify you, after which we combine them into anonymous totals.
Data we process on behalf of our clients is kept and deleted according to their instructions and our agreement with them.
9. Cookies and analytics
9.1 Cookies are small files placed on your device. We use:
Essential cookies and storage that the Website needs to work, such as security and remembering your cookie choice. These cannot be switched off.
Analytics from Google Analytics (through Google Tag Manager) and Framer Analytics, which help us count visits, see how people reach and use the Website, and measure form completions and bookings. Google Analytics uses cookies such as _ga and ga*.
9.2 We do not use advertising or retargeting cookies on the Website. If that changes, we will update this policy and ask for your consent first where required.
9.3 Where required, we ask for your consent before setting analytics cookies, and you can change your choice at any time through the cookie settings link on the Website. You can also block or delete cookies in your browser settings, and opt out of Google Analytics at tools.google.com/dlpage/gaoptout. Blocking essential cookies may affect how the Website works.
10. The Website demo
10.1 Our voice and chat demo is powered by AI. When you use it, what you say or type is processed by us and our AI and voice providers so the demo can respond, and it may be recorded and transcribed. We use demo conversations to answer you, follow up on any request you make in them, and improve the demo. Please do not share sensitive information in the demo. If you do not want your conversation recorded, please contact us by email instead.
11. How we protect data
11.1 We use appropriate technical and organisational measures to protect personal data against loss, misuse and unauthorised access, including access controls, encryption in transit and at rest where technically feasible, secure development practices, logging and regular review of our security.
11.2 No system is completely secure. If a personal data breach affects you and the law requires us to tell you, we will notify you and the relevant authority without undue delay.
11.3 Payment fraud warning. Payment links are only ever sent from sales@ultolabs.com. We never send bank details in a document or ask you to change payment details by email. If you receive such a message, do not pay it and contact us.
12. Your rights
Depending on the law that applies to you, you have the right to:
be told how your data is used, and get a copy of it;
have inaccurate data corrected;
have your data deleted;
restrict or object to how we use it, including objecting to direct marketing at any time;
receive your data in a portable format;
withdraw consent at any time, without affecting processing before you withdrew it;
object to decisions based solely on automated processing.
To use any of these rights, email contact@ultolabs.com. We may need to confirm your identity first. We aim to reply within 30 days. There is no charge, unless a request is clearly unfounded or excessive.
If you are not satisfied with our response, you may complain to the UAE Data Office or to the data protection authority in your country.
13. Children
13.1 The Website and our Services are intended for businesses and are not directed at anyone under 18. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.
14. Third party websites
14.1 The Website may link to other websites and platforms. Their privacy practices are their own, and we recommend reading their policies.
15. Changes to this policy
15.1 We may update this policy from time to time. The latest version will always be on this page with its date. If we make significant changes, we will highlight them on the Website or tell you directly.
16. Contact
UltoLabs LLC Sharjah Media City (Shams), Sharjah, United Arab Emirates Trade licence no. 2646345.01 contact@ultolabs.com
