Privacy Policy

Effective date: 10 October 2026

This Privacy Policy explains how Sphere Matrix For Technologies, trade licence number 1670010, of Dubai, United Arab Emirates ("we", "us") collects, uses, stores and shares personal data in connection with Auto Sphere Pro (the "Platform"). It is written to meet Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the "PDPL") and its executive regulations. Questions and requests about personal data go to info@spherematrix.ae.

1. Who we are and our roles

• For the personal data of users of the Platform (the people who sign in: owners, managers, salespeople and accountants of the companies that use it, and platform administrators) we are the Controller.
• For the personal data that a company enters into the Platform about its own customers, suppliers, consignees, counterparties and employees, that company is the Controller and we are its Processor, acting on its instructions under the Data Protection section of our Terms and Conditions. If you are a customer of a car showroom that uses the Platform, your rights are exercised against that showroom, and we help it answer you.

2. The personal data we collect

About users of the Platform

• Identity and contact: name, email address, username, job title, mobile and WhatsApp numbers, and the picture or avatar you choose.
• Account and security: password (stored only as a one-way hash), the date of your last sign-in, failed sign-in attempts and lockouts, password reset requests, and your acceptance of these documents with its date, version, IP address and browser.
• Activity: an audit trail of the actions you take on the Platform (what was created, changed, posted, signed, exported or deleted, when, and from which IP address and browser). The audit trail exists to protect the companies’ records and cannot be edited.
• Preferences: screen settings such as which columns a list shows.

Entered by companies about their own contacts (as Processor)

• Customers, suppliers and consignees: names, company names, phone numbers, emails, addresses, nationality, Emirates ID and passport numbers and expiry dates, trade licence details, bank details for payments.
• Transactions: cars bought and sold, prices, payments, receipts, cheques, trade-ins and consignment agreements, together with the documents and photos uploaded for them.
• Agreements: signatures drawn or typed, the date, IP address and browser of a signature, and uploaded signed copies.
• Documents submitted for reading by artificial intelligence, such as registration cards, invoices and identity documents, and the values read from them.

We do not knowingly collect data from anyone under 18, and the Platform is not meant for them.

3. Why we use personal data and on what legal basis

• To provide the Platform to you and your company: creating and securing accounts, showing you the data your role allows, sending system emails (sign-in links, password resets, agreements to sign). Basis: performance of a contract (Article 4(1)(a) of the PDPL) and our legitimate interest in running the service.
• To keep the Platform secure and to prevent fraud and misuse: sign-in lockouts, the audit trail, session management. Basis: our legitimate interest and legal obligations.
• To meet legal obligations: keeping accounting records, answering lawful requests from authorities, keeping evidence of consent. Basis: compliance with UAE law.
• To support and improve the Platform: answering your questions, fixing errors, understanding how the Platform is used in aggregate. Basis: legitimate interest.
• Data entered by companies is processed only on the company’s instructions to provide the Platform. Basis: the contract with the company; the company is responsible for its own lawful basis towards its contacts.

We do not use personal data for marketing to third parties, we do not sell it, and we make no decisions about you by automated means that have legal or similarly significant effects.

4. Who we share personal data with

• Your company and its administrators, who see the users and data of their company, including the audit trail of their users.
• Service providers (sub-processors) who process data on our behalf under written contracts: MongoDB Atlas (database hosting), Cloudinary (storage of photos and documents), Resend (email delivery), Anthropic (reading of the documents a user submits for artificial-intelligence reading), the hosting provider of the Platform servers, and WhatsApp Business where a company has connected it to send its own messages.
• Authorities and courts where UAE law requires it or to protect our rights or the safety of people.
• A successor to our business, in a merger or sale, under this Policy.

5. Transfers outside the UAE

Some of our service providers store or process data outside the United Arab Emirates. We transfer personal data abroad only as the PDPL allows (Articles 22 and 23): to countries the UAE Data Office recognises as giving adequate protection, or under contracts with the provider that protect the data to the standard required by the PDPL, with the technical measures described below. You may ask us at info@spherematrix.ae for information about the safeguards in place.

6. How long we keep personal data

• User accounts: for as long as the account exists, and up to twelve (12) months after it is closed so that the company’s records keep the name of the person who made each entry.
• The audit trail: entries are kept live for the period the platform or the company sets (twelve months by default) and are then moved to an archive; the platform administrator may delete archived entries after exporting them.
• Company data: for as long as the company’s subscription lasts and the retention period described in the Terms and Conditions after it ends. Accounting and tax records are kept for at least five (5) years as UAE law requires.
• Backups: deleted data may remain in backups for the backup cycle, after which it is overwritten.

7. How we protect personal data

We encrypt data in transit (HTTPS), store passwords as one-way hashes and integration keys encrypted, limit access by role, record every change in an audit trail, lock accounts after repeated failed sign-ins, keep regular backups, and keep the software up to date. No system is completely secure; tell us at info@spherematrix.ae at once if you suspect a problem with your account. If a personal data breach is likely to put your rights at risk, we tell the affected company and, where the PDPL requires it, the UAE Data Office and the people concerned without undue delay.

8. Your rights

Under the PDPL you have the right to:

• be told how your data is used and receive a copy of it (access);
• have inaccurate or incomplete data corrected (correction);
• have your data erased where it is no longer needed, where consent is withdrawn or where processing is unlawful (erasure), subject to records we must keep by law;
• restrict or object to processing in certain cases, including processing based on legitimate interests (restriction and objection);
• receive the data you gave us in a structured, machine-readable form (portability);
• not be subject to automated decisions that significantly affect you; and
• complain to the UAE Data Office if you believe we have not respected your rights.

To exercise a right, write to info@spherematrix.ae from the email address of your account, or ask your company administrator. We answer within one month, and may ask you to confirm your identity first. If your request concerns data a company entered about you as its customer or supplier, we pass it to that company and help it answer.

9. Cookies and browser storage

The Platform uses no advertising or tracking cookies. It stores in your browser only what is strictly necessary to run: your sign-in token (so you stay signed in for the session length set by the platform), the company you have opened if you are a platform administrator, and your screen preferences. These are deleted when you sign out or clear your browser data. Because this storage is strictly necessary, no cookie banner or consent is required.

10. Changes to this Policy

We may update this Policy. A new version is published on the Platform with its effective date and a summary of the changes, and every user is asked to accept it at the next sign-in. Earlier versions remain available on the Platform.

11. Contact

Sphere Matrix For Technologies
Dubai
Email: info@spherematrix.ae

You may also contact the UAE Data Office, the federal data protection authority, if you are not satisfied with our answer.