Privacy Policy

This Privacy Policy explains how izzytap Portal ("izzytap", "we", "us" or "our") handles personal data. izzytap is an independent Software-as-a-Service provider based in Dubai, United Arab Emirates. We provide software tools to corporate service providers and business-setup consultancies (each a "Firm", "Subscriber" or "you"), who in turn serve their own customers (the "End Clients").

We play two distinct roles, and it matters which one applies:

• As a processor — when we handle End-Client personal data that a Firm uploads or generates through our platform, we act only on the Firm's documented instructions. The Firm is the controller of that data and decides why and how it is used.
• As a controller — when we handle a Firm's own account, contact, billing and usage data to operate izzytap, we determine the purposes ourselves and are the controller for that limited set of data.

The personal data involved falls into a few categories:

• Firm account data (we are controller) — names, work email addresses, phone numbers and roles of the individuals who administer or use a Firm's account.
• Billing data (we are controller) — subscription plan, invoices, payment status and limited transaction details. We do not store full card numbers; payments are handled by our payment provider.
• Usage and technical data (we are controller) — log-in records, IP addresses, device and browser information, feature usage and audit trails, used to secure and improve the service.
• End-Client data (we are processor) — the personal data a Firm chooses to enter or store, which may include identity documents, contact details, corporate records and compliance information relating to the Firm's own clients.

We do not seek out special-category or sensitive data for our own purposes; where such data appears within End-Client records, we hold it only as processor on the Firm's behalf.

Where we act as controller, we use Firm and account data to: provide, maintain and secure the platform; authenticate users; process subscriptions and invoices; provide support; detect and prevent fraud or misuse; and comply with our own legal obligations. Our legal bases under UAE data protection law include the performance of our contract with the Firm, our legitimate interests in running and safeguarding the service, and compliance with applicable law.

Where we act as processor, we use End-Client data only to carry out the Firm's instructions and to deliver the functionality the Firm has chosen — we do not use it for our own purposes, and we never sell it. See our Data Processing Addendum for the full terms governing that data.

We do not sell personal data. We share it only where necessary to run izzytap: with vetted service providers who host, secure and support the platform (our subprocessors), with our payment provider to process subscriptions, and where required by law or to protect our rights and users. Every subprocessor is bound by written obligations no less protective than those in this Policy and our Data Processing Addendum.

A current list of the subprocessors that may process End-Client data on our platform is maintained on our Subprocessors page.

izzytap is based in the United Arab Emirates and prefers to store and process data within the UAE where practical. Some of our subprocessors may process data outside the UAE. Where personal data is transferred across borders, we ensure an adequate level of protection through appropriate safeguards — such as contractual data-protection commitments — consistent with the UAE Personal Data Protection Law and its Executive Regulations.

Where we act as controller, we retain Firm account, billing and usage data for as long as the Firm's subscription is active and thereafter only as long as needed for legitimate business, accounting, tax and legal purposes, after which it is deleted or anonymised.

Where we act as processor, retention of End-Client data is controlled by the Firm. On termination, we return or delete End-Client data in accordance with the Firm's instructions and our Data Processing Addendum.

We apply organisational and technical measures appropriate to the risk, including encryption in transit, access controls and strict tenant isolation so that one Firm's data is never accessible to another, audit logging, and regular review of our security practices. No system can be guaranteed completely secure, but we work continuously to protect personal data against unauthorised access, loss or misuse, and we require the same standard of our subprocessors.

Under the UAE Personal Data Protection Law (PDPL), individuals have rights over their personal data, which may include the right to access it, to have inaccurate data corrected, to request deletion, to restrict or object to certain processing, and to data portability, subject to the conditions and exceptions in the law.

If you are a Firm user and wish to exercise these rights over data for which izzytap is the controller, contact us at hello@izzytap.com. If your request concerns End-Client data for which a Firm is the controller, we will refer you to the relevant Firm, as we are only permitted to act on that Firm's instructions.

If you are an End Client — a customer of a Firm that uses izzytap — the Firm, not izzytap, is the controller of your personal data. The Firm decides what data to collect, why, and for how long to keep it, and is your first point of contact for privacy questions and for exercising your rights.

izzytap processes your data only as the Firm's service provider and on its instructions. We will pass any request you send us to the relevant Firm and support them in responding, but we cannot make decisions about your data ourselves.

We use cookies and similar technologies that are necessary to operate the platform — for example to keep you signed in, maintain security, and remember basic preferences — together with limited analytics to understand and improve how the service is used. We keep non-essential cookies to a minimum. For full details, see our Cookie Policy.

izzytap is a business tool intended solely for use by Firms and their staff, and is not directed at children. We do not knowingly collect personal data from children for our own purposes. Where a Firm's End-Client records happen to include data relating to a minor, we hold that data only as processor on the Firm's behalf and under the Firm's responsibility.

We may update this Policy from time to time to reflect changes to our service or the law. Where changes are material, we will take reasonable steps to notify Firms, for example by email or an in-platform notice. The version shown here is the current one, and the date below indicates when it last changed.

For any question about this Policy or your personal data, contact us at hello@izzytap.com. This Policy is governed by the laws of the United Arab Emirates, and any dispute is subject to the exclusive jurisdiction of the competent courts of the United Arab Emirates.

Last updated: 26 July 2026.