Privacy policy
What this site collects, why, and who else sees it. In short: a contact form, an AI advisor, one cookie that counts messages, and no tracking of any kind.
Last updated 24 August 2026
Who we are
TellzLabs (“we”, “us”) is an AI, automation and custom-software consultancy based in Dubai, United Arab Emirates. This policy covers this website and the AI advisor on it. It does not cover work we do under a signed client agreement — that is governed by the agreement itself.
The controller of the personal data described here is TellzLabs Sole Proprietorship, licensed in Dubai, United Arab Emirates. To reach us about anything on this page, use the contact form and say it is a privacy request.
What we collect
When you use the contact form. Your name, email address, company if you give one, and whatever you write in the message. All of it is optional in the sense that you choose to send it; none of it is collected if you do not.
When you use TellzAI, the AI advisor. Whatever you type into it. If the conversation reaches the point where you offer your name and email so we can follow up, those are recorded too, along with a short summary of what you need. We ask for nothing else and you are never required to give any of it — you can use the advisor without identifying yourself at all.
Automatically, by our hosting provider. Standard server logs, which include your IP address, the pages requested, and your browser’s user-agent string. We do not use these to build a profile of you; they exist so the site can be operated and debugged.
Aggregate traffic measurement. We use a privacy-focused analytics service to count page views and to see which pages and referrers are popular. It sets no cookies, it does not follow you to other websites, and it does not build a profile of you. The provider is named on our sub-processor list.
It does distinguish repeat visits within a short period, and it does that without a cookie: your IP address and browser details are used momentarily to derive a short-lived value, which is then all that is kept. Your IP address itself is not stored by the analytics service and is never shown to us. What we see is counts, countries and referrers — never an individual visitor.
What we do not collect. No advertising pixels, no session recording, no heatmaps, and no third-party trackers of the kind that follow you across the web. We do not buy data about you, we do not enrich what you give us from other sources, and we do not sell or rent it to anyone.
Why we process it, and on what basis
Everything below is a separate purpose with its own legal basis, because lumping them together would hide the one people care about most.
To answer you. If you send a message or leave your email, we use it to reply. Our legal basis is our legitimate interest in responding to an enquiry you made and, where you are asking us to quote for work, taking steps at your request before entering into a contract.
To run the AI advisor. Processing what you type is how the advisor produces an answer. Our legal basis is our legitimate interest in operating an advisory tool people have chosen to use — and yours, in getting the answer you asked for.
To keep a copy of advisor conversations and read them later. This is a different purpose from answering you, so it gets its own entry. Our legal basis is our legitimate interest in finding where the advisor answered badly and improving it. We have weighed that against your interests: the copy is stripped of contact details, is kept for a limited period, is read only by us, and is never used to market to you or to make any decision about you. You can object to it — see “Your rights” — and if you do, we will delete the conversations we can identify as yours and stop keeping further ones.
To tell you about our work. If you enquire, we may send you occasional notes about the kind of work we do — our own services, nothing else, and never anybody else’s advertising. Our legal basis is our legitimate interest in staying in touch with someone who asked us to quote, and you were told so at the point you gave us the address. You can stop it in one click from any message, or by asking us, and stopping it does not affect our reply to your enquiry. If you never enquired — you subscribed to read what we publish — the basis is your consent, which you gave by asking, and you can withdraw it the same way.
To measure traffic. Our legal basis is our legitimate interest in knowing which pages are read, using the aggregate, cookieless method described above.
To keep the site working and safe. Server logs and the message-count cookie serve our legitimate interest in operating the site and preventing abuse.
You are not required to give us any of this. Nothing on this site obliges you to identify yourself, the advisor works without your name, and the only consequence of not filling in the contact form is that we cannot reply to you.
We do not use your data for automated decision-making that produces legal or similarly significant effects about you. The AI advisor gives opinions; it does not decide anything about you.
What happens to what you type into the AI advisor
This is the part most worth reading.
What leaves this site. TellzAI is powered by a large language model. When you send a message, that message and the earlier ones in the same conversation are transmitted to the model provider’s API so a reply can be generated. We do not send your name, your IP address or your identity with it. Today that provider is OpenAI, and we use a paid API tier — we name it here rather than leaving it to a list, because who reads what you type is the one thing that should change what you choose to type. On this tier the provider does not train its models on data submitted through the API by default, and retains it only briefly for abuse monitoring, which is a meaningfully better arrangement than a free tier, where prompts are commonly used to improve the provider’s products. If we change provider, this paragraph changes with it.
Even so, please use judgement about what you type. The advisor is a public chat box on a website, not a confidential channel, and a third party processes every message. If a conversation needs to be confidential, book a call instead — and do not send us anything under an NDA through this site until one is in place.
What we keep. We keep a copy of the conversation, and we read them to find where the advisor answered badly, which questions come up repeatedly, and what our published answers are missing. It is the only way the thing gets better. Before anything is written down, email addresses, phone numbers and card-like numbers are stripped out automatically, so if you type your details into the chat they are removed from our copy. We do not record your IP address, your browser, or any cookie value.
Be aware of the limits of that. The stripping is automatic and it catches patterns, not meaning. If you write your name, your employer or something identifying in the body of a sentence, it stays in our copy, because no automatic process can reliably remove it. Conversations are grouped under a one-way key rather than under your identity — that makes them pseudonymous, not anonymous, and we treat them as personal data throughout. We keep them for 90 days and then delete them, which is done by an automatic daily process rather than by intention. You can ask us to delete yours sooner, and you can object to us keeping them at all.
What reaches us when you ask for follow-up. If the advisor asks whether it can pass your details to the team and you say yes, it records your name, your email, your company if you gave one, and a short summary of what you need. The conversation itself is sent to us with it, in full and without the stripping described above — because the person replying to you needs to know what you actually said, and stripping it there would lose the context and protect nobody. That is a step you can see happening in the conversation, and it is the only route by which your contact details reach us from the chat.
Who else processes your data
We keep the list short on purpose. Each of these acts on our instructions as a processor, not as an independent recipient, and none of them is permitted to sell your data.
Below we describe them by what they do, because that is the part that stays true. The current provider of each is named, with the date it was last checked, on our sub-processor list — one page, one click, always current. We keep the names there rather than in this paragraph so that changing a supplier is a change to a list rather than a rewrite of a legal document that then does not get rewritten. If you would rather not click, ask us and we will tell you who they are.
- The model provider behind the AI advisor — named in the section above, and the one recipient we name in both places, because what it is changes what you may want to type.
- Our hosting and content-delivery provider, a United States cloud platform. All site traffic passes through it, and it holds the standard server logs described above and the file store in which advisor conversations are kept.
- Our transactional email provider, a United States service that delivers the notification telling us you have been in touch and carries your message inside it.
- Our analytics provider, for the aggregate, cookieless page-view counts described above.
- Our email provider, where an enquiry lives once it reaches us and from which we reply to you.
We may disclose data where the law requires it, and we will tell you if that happens unless we are legally prohibited from doing so.
Where your data goes
We are in the United Arab Emirates and our providers are largely in the United States, so your data will be transferred outside the country you are in, and outside the European Economic Area and the United Kingdom.
Where that involves personal data of people in the EEA or the UK, we rely on the Standard Contractual Clauses in each provider’s data processing terms, together with the UK Addendum where it applies. You can ask us for a copy of the safeguards relied on for any particular provider and we will send it to you. Which safeguard applies to which provider is recorded on the sub-processor list.
How long we keep it
Enquiries and the contact details attached to them. We keep these for as long as we might reasonably still be talking, and then for a further period so that we have a record of our dealings and so that a conversation which paused can be picked up rather than restarted. In practice that is up to three years from our last contact, unless you ask us to delete them sooner or we are required to keep them longer.
Advisor conversations. Ninety days, deleted by an automatic daily process rather than by intention.
The message-count cookie expires after 24 hours. The conversation in your browser is gone when you close the tab. Server logs are retained on our host’s standard schedule, which is a matter of days to weeks.
These are periods we act on, not aspirations. If you think we are holding something past its time, tell us and we will check.
Your rights
Depending on where you are, you may have the right to ask us for a copy of the personal data we hold about you, to correct it if it is wrong, to have it deleted, to restrict or object to how we use it, and to receive it in a portable form. Where we rely on our legitimate interests — which is most of what is described above — you have the right to object, and that includes objecting to us keeping a copy of your conversation with the advisor. Where we rely on consent, you can withdraw it at any time.
You are also entitled to be told who we have shared your data with, not merely the kinds of organisation. The sub-processor list answers that in advance; ask us and we will confirm it for your data specifically.
These rights are given by the UAE’s Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, and by the UK and EU GDPR where they apply to you. To exercise any of them, use the contact form and say it is a privacy request. We will respond within one month. If a request is complex or there are several, the law lets us take up to two months longer, and we will tell you inside the first month if that happens. We will not charge you, and we will not make you justify the request.
One practical point: if you ask us to delete an advisor conversation, tell us roughly when it happened and what it was about. We do not store your name against it, which is deliberate, and it means we need your help to find it.
If you are unhappy with how we have handled your data you can complain to your local supervisory authority — in the UAE, the UAE Data Office; in the EEA, your national data protection authority; in the UK, the Information Commissioner’s Office. We would rather you told us first so we can fix it.
Security
The site is served only over HTTPS. Credentials for our providers are held as server-side environment variables and are never exposed to your browser. The message-count cookie is signed so it cannot be altered, and marked HttpOnly so scripts cannot read it. We keep the amount of data we hold deliberately small, because the most reliable way to protect information is not to be holding it.
No system is perfectly secure, and we do not claim otherwise. If we discover a breach affecting your personal data we will notify the relevant authority, and you, where the law requires it.
Children
This site is intended for people acting in a business capacity. It is not directed at children and we do not knowingly collect data from anyone under 18. If you believe a child has sent us personal data, tell us and we will delete it.
Changes to this policy
We update this page when what we do changes, and we are deliberate about what counts.
If we replace a supplier with another doing the same job on no weaker terms, we change the sub-processor list and the date on it. This page does not move, because nothing you would care about has.
If we collect something new, use it for a new reason, keep it longer, add a kind of recipient we have not described, or start using anything that requires your consent, we change this page and the date at the top moves. If a change materially affects data we already hold about you — a new purpose for it, or a longer period — and we have your contact details, we will tell you before it takes effect rather than rely on you noticing.
The date at the top always reflects the current version of this page.