1. Who We Are
Raqib ("we", "us", "our") operates the compliance management platform at raqib.me. We are committed to protecting your personal data in accordance with the UAE Federal Decree-Law No. 45 of 2021 on Personal Data Protection (PDPL) and applicable data protection regulations across the GCC.
2. Data We Collect
We collect the following categories of data:
- Account data: Email address and password (hashed and salted) when you create an account.
- Business data: Company name, trade license number, Tax Registration Number (TRN), entity type, revenue bracket, and other information you provide during onboarding. Trade license numbers and TRNs are encrypted at the application layer before storage.
- Usage data: Pages visited, features used, and actions taken within the platform, collected to improve the service.
- Documents: Files you upload to the document storage feature, stored encrypted in GCC infrastructure.
3. How We Use Your Data
We use your data strictly to:
- Provide and improve the compliance management platform.
- Generate your personalised compliance profile and action items.
- Send deadline reminders and compliance notifications via WhatsApp and email.
- Respond to support requests.
- Comply with applicable UAE and GCC legal obligations.
We do not use your data for advertising, profiling, or sale to third parties.
4. Data Residency — GCC Only
All data is stored and processed within the GCC region. Our infrastructure runs on AWS Bahrain (me-south-1). Your financial records, business information, and uploaded documents never leave the GCC. This is a deliberate architectural decision, not an afterthought — we built data residency into the platform from day one to comply with UAE PDPL requirements on cross-border data transfers.
5. Security
We implement the following security controls:
- Encryption at rest (AES-256) and in transit (TLS 1.2+).
- Application-layer encryption for sensitive identifiers (TRN, trade license number).
- Row-level security on all database tables — users can only access their own organisation's data.
- Regular security reviews and dependency audits.
6. Data Sharing
We do not sell your personal data. We do not share it with advertisers or data brokers.
We share data only with:
- Infrastructure providers: AWS (Bahrain) and Supabase for hosting and database services, under strict data processing agreements.
- Legal requirements: When compelled by UAE law, court order, or regulatory authority — and only to the extent legally required.
7. Your Rights Under UAE PDPL
Under the UAE Federal Decree-Law No. 45 of 2021, you have the right to:
- Access the personal data we hold about you.
- Request correction of inaccurate or incomplete data.
- Request deletion of your account and all associated data.
- Object to or restrict certain processing activities.
- Data portability — receive your data in a structured, machine-readable format.
To exercise these rights, email us at privacy@raqib.me. We will respond within 30 days.
8. Cookies
We use only essential cookies required for authentication and session management. We do not use tracking, analytics, or advertising cookies. No third-party cookies are set by Raqib.
9. Data Retention
We retain your account data for as long as your account is active. If you delete your account, all personal data is permanently deleted within 30 days, except where we are legally required to retain it (e.g., audit logs mandated by UAE commercial law).