Aylah Privacy Policy

Effective date: 11 October 2026
Last updated: 11 October 2026

This Privacy Policy explains how EUPPORIA IT SOLUTIONS L.L.C ("Aylah", "we", "us") collects, uses, shares and protects personal data when you use the Aylah website, platform and services (the "Service"), and the rights you have. We process personal data in accordance with the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data and its implementing regulations and decisions (the "PDPL") and other applicable laws. Words defined in our Terms of Use have the same meaning here.

---

1. Who we are

1.1 The controller of your personal data is EUPPORIA IT SOLUTIONS L.L.C, a limited liability company established in Dubai, United Arab Emirates, trade licence No. 1325954, with its registered address at Office No. 13, building owned by Sheikh Ahmed bin Rashid bin Saeed Al Maktoum, Riggat Al Buteen, Dubai, United Arab Emirates.

1.2 For any privacy question or request, contact privacy@aylah.ae.

2. Scope

2.1 This Policy applies to: customers and their authorised users; visitors to our website; Aylah Studio and Aylah Pilot clients; people who contact us; and people whose personal data appears in material that customers provide to us.

2.2 Personal data in Customer Content. When you upload Customer Content that contains other people's personal data, such as faces, voices or names of employees, models or customers, we process it on your instructions and only to provide the Service to you. You are responsible for having a lawful basis and any required consents, and for informing those people, as set out in the Terms of Use and the Acceptable Use Policy.

3. Personal data we collect

3.1 Account data: your name, email address, business name, optional mobile number, logo and brand details, language and currency preferences, and your account settings.

3.2 Sign-in data: sign-in links and tokens sent to your email or messaging number, session records, and, if you choose to sign in with a third-party sign-in provider, the identifier, name and email address that provider shares with us.

3.3 Consent and acceptance records: the date, time, network address and version of the Terms and Policies you accepted, and your marketing consent choices.

3.4 Payment and billing data: purchase records, amounts, currencies, invoices, refund and dispute records, and limited payment details from our payment processor, such as card brand, last four digits, country and payment status. We do not receive or store your full card number.

3.5 Customer Content: images, video, audio, voices, logos, text, prompts, briefs, claims and other material you upload or provide, and the content of web pages or listings at addresses you submit to us, which we fetch on your instruction to prepare Outputs.

3.6 Outputs: the videos, images, scripts, voiceovers and other material generated for you.

3.7 Credit and usage data: credit balances and ledger, generations started, quotes, settings, delivery and download records, errors and moderation decisions.

3.8 Studio and Pilot data: briefs, feedback, approvals, strategy-call bookings and notes, and call recordings only where you have agreed to the recording.

3.9 Communications: emails, support requests, messages sent through any messaging channel we offer, and their attachments.

3.10 Technical data: IP address, device and browser type, operating system, language, approximate location derived from the IP address, pages requested, timestamps, security logs and similar information.

3.11 Cookies and similar technologies: as described in our Cookie Policy.

3.12 We do not intentionally collect sensitive personal data, such as data about health, religion, ethnic origin or biometric data used for identification. Images or voices you upload may reveal such information; we process them only to provide the Service. We do not use facial or voice data to identify anyone.

4. Why we use personal data and on what basis

We process personal data only where the PDPL allows it. Depending on the activity, we rely on: the performance of our contract with you, or steps you ask us to take before entering into it; compliance with legal obligations; the protection of our rights and legal claims; and, where required, your consent. We use personal data to:

• (a) create and manage your Account and verify your sign-in;
• (b) provide the Service, including processing Customer Content with artificial intelligence to generate Outputs, and delivering Studio and Pilot work;
• (c) process payments, refunds and disputes, keep accounting records and meet tax obligations;
• (d) provide support and send service messages, such as receipts, delivery notices, security alerts and notices of changes to our Terms;
• (e) moderate content, prevent fraud and abuse, including duplicate accounts and welcome-credit abuse, and keep the Service secure;
• (f) enforce our Terms and Policies, and establish, exercise or defend legal claims;
• (g) comply with law and with requests from competent authorities;
• (h) maintain and improve the reliability and performance of the Service using technical and aggregated usage metrics, without using the content of your Customer Content or Outputs; and
• (i) send you marketing emails, only if you have opted in.

5. Artificial intelligence processing

5.1 How AI is used. The Service uses artificial intelligence to analyse your Customer Content and generate Outputs. To do this, we send the relevant Customer Content and instructions to third-party processing and infrastructure providers that perform AI processing for us.

5.2 No training. We never use your Customer Content or Outputs to train, fine-tune or improve any artificial intelligence model, and we do not allow the providers acting for us to do so. They may process your data only to provide the Service to you.

5.3 Automated decisions. We use automated checks to moderate content and to detect fraud and abuse. These checks may block a request or flag an Account. They do not produce legal effects on their own; significant actions, such as closing an Account, are reviewed by a person. You may ask for a human review of an automated decision and express your point of view by writing to privacy@aylah.ae.

5.4 Provenance. We may embed invisible provenance metadata, content credentials or watermarks in Outputs, as described in the AI Content Policy. This information identifies the content as produced through the Service; it is not designed to contain your personal data.

6. Who we share personal data with

6.1 We do not sell personal data. We share it only as described below, and only to the extent necessary.

6.2 Third-party processing and infrastructure providers. We share personal data with providers who process it on our behalf and under our instructions, in the following categories:

• (a) AI processing providers, which generate and edit images, video, voice, music and text from your Customer Content;
• (b) cloud hosting, database and storage providers, which host the Service and store your data;
• (c) payment processing providers, which process payments, refunds, fraud checks and disputes;
• (d) email and messaging providers, which deliver sign-in links, receipts and service messages;
• (e) sign-in providers, if you choose to sign in with one;
• (f) security and content-delivery providers, which protect and deliver the Service; and
• (g) analytics providers, only if we introduce analytics in the future and only as described in our Cookie Policy. We do not use analytics providers at the date of this Policy.

6.3 List of providers. A current list of the providers that process personal data for us, with the country where they process it, is available on request from privacy@aylah.ae.

6.4 Others. We may also share personal data with: our professional advisers, auditors and insurers under duties of confidentiality; competent courts, authorities and regulators where the law requires or permits, or to protect our rights, our users or the public; card networks and banks in connection with payment disputes; and a buyer or successor in connection with a merger, acquisition or sale of all or part of our business, subject to this Policy.

6.5 Your instructions. When you publish Outputs on third-party platforms, you share them under those platforms' terms; we are not responsible for that sharing.

7. International transfers

7.1 Some of our providers process personal data outside the United Arab Emirates. When we transfer personal data abroad, we do so only as permitted by the PDPL, for example to countries with an adequate level of protection, or with contractual or other safeguards the PDPL accepts, or where another legal basis applies.

7.2 You can ask privacy@aylah.ae for information about the safeguards for a particular transfer.

8. How long we keep personal data

We may keep data longer where it is needed for an open dispute, a legal claim, a fraud investigation or a request from a competent authority, and only for as long as necessary.

9. Security

9.1 We use technical and organisational measures appropriate to the risk, including encryption in transit, access controls, separation of production data, logging and regular review of our providers.

9.2 No system is completely secure. Keep your sign-in methods secure and tell us immediately at support@aylah.ae if you suspect unauthorised access.

9.3 If a personal data breach occurs that is likely to affect your privacy, we will notify the UAE Data Office and you where the PDPL requires.

10. Your rights

10.1 Subject to the conditions and exceptions in the PDPL, you have the right to:

• (a) receive information about the personal data we hold about you and how we process it, and obtain a copy;
• (b) receive your personal data in a structured, machine-readable format and have it transferred where technically feasible;
• (c) have inaccurate personal data corrected and incomplete data completed;
• (d) have your personal data erased where it is no longer needed or the processing is unlawful;
• (e) restrict processing in the cases the PDPL provides;
• (f) object to processing, including for direct marketing, and to decisions based solely on automated processing that produce legal or similarly significant effects; and
• (g) withdraw your consent at any time, without affecting processing that took place before.

10.2 How to exercise your rights. Email privacy@aylah.ae from the email address of your Account. You can also delete your Account from your Account settings. We may need to verify your identity. We aim to respond within 30 days and will tell you if we need longer or cannot comply, and why.

10.3 Complaints. If you are not satisfied with our response, you may complain to the UAE Data Office.

11. Marketing

We send marketing emails only if you opt in; the option is unticked by default at sign-up. You can unsubscribe at any time using the link in any marketing email or in your Account settings. Service messages, such as receipts and security notices, are not marketing and will still be sent.

12. Children

The Service is for people aged 18 or over and for businesses. We do not knowingly collect personal data from children. Customers must not upload images, voices or other personal data of minors without the consent of a parent or legal guardian and a lawful basis. If you believe a child has given us personal data, contact privacy@aylah.ae.

13. Cookies

We use cookies and similar technologies as described in our Cookie Policy.

14. Changes

We may update this Policy. We will publish the updated version with a new "Last updated" date and, for material changes, notify you by email at least 14 days before they take effect, unless a change is required sooner by law.

15. Language and contact

This Policy is available in Arabic and English. If there is any conflict, the Arabic version prevails.

Privacy questions and requests: privacy@aylah.ae
EUPPORIA IT SOLUTIONS L.L.C, Office No. 13, building owned by Sheikh Ahmed bin Rashid bin Saeed Al Maktoum, Riggat Al Buteen, Dubai, United Arab Emirates