Privacy notice
This notice explains what personal data Musaddaq collects, why, where it is kept and for how long, and the choices you have. It is written under the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) and applies to everyone who uses the Service, and to people named in documents that users upload.
1. What we collect
- Account data. your work email address, name, preferred language, and the organisation you act for.
- Organisation records. legal and trade names, licence number, issuing authority, dates, TRN, registered address and licensed activities, as read from documents and confirmed by you.
- Documents. trade licences, VAT registration certificates and, for Enhanced verification, bank confirmation letters and an authorised signatory's identity document.
- People named in documents. owners, partners, managers and signatories as printed on a licence or identity document: name, role, nationality and share. For identity documents we keep only the last four characters of the number.
- Activity. sign-ins, documents uploaded, checks run, contact reveals, evidence files generated, and reviewer decisions, with time, IP address and browser, in an append-only audit log.
- Payments. if you buy a plan, our payment provider (Stripe) holds card details; we hold only the plan, status and invoice references.
2. Why we use it
- To verify suppliers: reading documents, matching names and numbers, checking dates, screening against sanctions lists and public sources, and recording the results. This is the Service you asked for.
- To show verified listings to buyers, and to reveal a supplier's contact details when a buyer chooses to, with the supplier able to see who did.
- To produce evidence files that record what was checked and when, so buyers can keep proof of supplier verification.
- To run the Service: sign-in codes, renewal reminders, reviewer alerts, security, fraud prevention and support.
- To contact you about your listing and the Service. Your name, email address and telephone number, and your organisation's contact details, are visible to FW Global Consulting L.L.C and its authorised staff for this purpose, with your permission given at registration. We also ask separately, and optionally, whether we may contact you about our other services; that one you can decline or withdraw without affecting your listing.
- To meet legal obligations, including record-keeping for tax purposes.
We do not sell personal data, and we do not use it for advertising.
3. Automated document reading
Uploaded documents are read first by rules that run entirely on our own servers. When a document is a scan or photograph, or its layout is not recognised, it is sent to Anthropic's Claude API to extract the printed fields. Anthropic processes the document to return those fields and does not use it to train models. Every read is recorded, and you confirm the result before anything is stored on your organisation record.
4. Who sees what
- Public. a verified supplier's listing: names, emirate, categories, verification tier and check summary. Never documents, never contact details.
- Buyers who reveal. contact details, and any documents the supplier chose to share during onboarding.
- Musaddaq reviewers. everything on a verification, in order to complete it.
- Processors. Supabase (database, file storage and sign-in), Vercel (hosting), Resend (email), Stripe (payments) and Anthropic (document reading, as above). Each acts on our instructions under contract.
- Authorities. where the law requires, or to establish or defend legal claims.
5. Where data is kept
Our database, file storage and application are hosted by established cloud providers in access-controlled facilities outside the UAE, and our email and payment providers process data in their own regions. Every such transfer is made under contractual safeguards that meet the UAE Personal Data Protection Law. If your organisation requires data to stay in the UAE, contact us before uploading.
6. How long we keep it
- Account and organisation records: while your account is open, then 90 days.
- Documents and verification records: for the life of the listing and for five years after, matching the period buyers must keep supplier-verification records for VAT purposes. A superseded document is kept for the same period so evidence files stay complete.
- Evidence files issued to a buyer: five years from issue; they cannot be altered.
- Audit log: five years.
- Consent records: the statements you agreed to, with their version, the date and time, the IP address and browser, kept for the life of the account and for five years after, as the record that permission was given. Withdrawal is recorded on the same record rather than deleting it.
- Identity documents for Enhanced verification: the file is deleted once the check is complete; the masked number and the check result are kept with the verification.
7. Your rights
You may ask for a copy of your personal data, ask us to correct it, ask us to delete it where we no longer need it, object to a use of it, or ask us to restrict processing. Suppliers can change what they share and withdraw a listing at any time from their account. You can withdraw the optional permission to be contacted about our other services at any time from Settings, and you can see and request a copy of every consent record we hold for you. People named on a licence who are not users may contact us directly. We respond within 30 days. You may also complain to the UAE Data Office.
8. Consent, and how we record it
Where we rely on your consent, including the permission for FW Global Consulting L.L.C to hold and use your contact details, we record what you agreed to: the statement word for word, a hash of that text, its version, whether it was granted or declined, who agreed, for which organisation, and the date, time, IP address and browser. The statements are published in full in the consent record, and your own records are listed under Settings.
9. Security
Documents are stored in a private bucket and served only through short-lived signed links to people entitled to see them. Access is by one-time code, not passwords. The database is not reachable from the internet except through our application. Reviewer actions are individually logged.
10. Cookies
We set only the cookies needed to keep you signed in and to remember your language. There is no advertising or cross-site tracking.
11. Changes and contact
We will announce material changes to this notice on the Service or by email. Questions and requests: FW Global Consulting L.L.C, Dubai, United Arab Emirates · privacy@musaddaq.ae