Note for EU residents: If you are a resident of the European Union accessing ExpatPilot UAE, your data is also protected under the EU General Data Protection Regulation (GDPR). The stricter of the two frameworks applies where they differ.
1. Who We Are
ExpatPilot UAE is operated by ExpatPilot (registered in the Netherlands, KVK 86009613) as an online platform providing guidance and tools for expats living and working in Dubai and Abu Dhabi. We are reachable at hello@expatpilot.ae.
This Privacy Policy covers the processing of personal data of users who access ExpatPilot UAE at expatpilot.ae (or expatpilot.nl/uae during the pre-domain phase).
2. Applicable Law
We comply with Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL) — the UAE's federal data protection law — as well as the executive regulations issued under Cabinet Decision No. 111 of 2023.
Note: DIFC and ADGM free zones maintain separate data protection frameworks (DIFC Law No. 5 of 2020 and ADGM Data Protection Regulations 2021). If you are based in one of these zones and believe a different framework applies to your situation, please contact us.
The UAE Data Office is the supervisory authority for the PDPL. Contact: dataoffice.gov.ae
3. What Data We Collect and Why
Account data — when you create an account: your email address, name (if provided via Google/LinkedIn sign-in), and hashed password. Legal basis: contract performance (providing you access to the service).
Questions you ask — when you use Ask ExpatPilot UAE: your question, the AI's answer, and your selected emirate (Dubai/Abu Dhabi). We store this to improve our knowledge base and identify gaps. Legal basis: legitimate interest (platform improvement) with your awareness of this through this policy.
Journey data — if you use the Journey Dashboard or profile features: your visa type, arrival date, family members' names/relationships/visa dates you choose to add, and task completion status. Legal basis: contract performance (providing the service you requested). We never store ID card numbers, passport numbers, BSN/Emirates ID numbers, or financial account numbers.
Documents you translate — text or images you paste or upload into the Document Translator are sent to our AI provider (Anthropic, USA) for processing. We do not store the content of translated documents after the session ends. Legal basis: contract performance.
Analytics — aggregated, anonymised usage data via Vercel Analytics. No personal identifiers are tracked. Legal basis: legitimate interest (understanding which features are used).
4. AI Processing — What Happens to Your Questions
When you use Ask ExpatPilot UAE, your question is sent to Anthropic's Claude AI (USA) to generate an answer. Anthropic processes your query in accordance with their Privacy Policy and does not use inputs from ExpatPilot to train their models under our commercial API agreement.
We also log your question and the AI's answer in our database to build our UAE knowledge base and detect gaps. Questions are stored with your emirate (city) but are not linked to your name or email in the public-facing logs.
We do not use your personal data for automated decision-making that produces legal effects about you.
5. Where Your Data Is Stored
Your data is stored on Supabase (Postgres database), hosted on infrastructure provided by Amazon Web Services (AWS). Server regions may include the USA and/or the EU. Supabase is our data processor and operates under data processing agreements compliant with international data protection standards.
Our application is deployed on Vercel (USA). Your requests to ExpatPilot UAE pass through Vercel's global edge network.
Under the UAE PDPL, cross-border data transfers require either that the receiving country provides adequate data protection, or that appropriate safeguards are in place. Our data processors (Supabase/AWS, Vercel, Anthropic) operate under data processing agreements that include appropriate contractual safeguards. You acknowledge and consent to this international transfer by using the service.
6. Your Rights Under the UAE PDPL
As a data subject under the UAE PDPL, you have the right to:
- Access: request a copy of the personal data we hold about you
- Rectification: correct inaccurate data
- Deletion: request erasure of your personal data (subject to legal retention obligations)
- Objection: object to processing based on legitimate interest
- Restrict processing: request that we limit how we use your data in certain circumstances
- Data portability: receive your data in a machine-readable format
- Withdraw consent: where processing is based on consent, you may withdraw it at any time without affecting prior processing
To exercise any right, email hello@expatpilot.ae. We will respond within 30 days. If you are not satisfied with our response, you may file a complaint with the UAE Data Office at dataoffice.gov.ae.
7. Children's Data
ExpatPilot UAE is intended for adults (18+). We comply with the UAE Federal Decree-Law No. 26 of 2025 on Child Digital Safety. We do not knowingly collect personal data from users under 18. If we become aware that a user is under 18, we will delete their account data promptly. If you believe we have collected data about a child, please contact us immediately at hello@expatpilot.ae.
Family member data you enter about your children (for the Kids' Education Journey feature) is stored solely for your own use within the platform and is not shared with third parties or used for profiling.
8. Data Retention
We retain your personal data for as long as your account is active. If you delete your account, we delete your personal data within 30 days, except where retention is required by applicable UAE law or legitimate business records purposes (such as fraud prevention or audit trails), in which case we retain only the minimum necessary data for the required period.
Anonymised, aggregated data (such as question topics and category usage statistics) may be retained indefinitely as it cannot identify you.
9. Cookies and Tracking
ExpatPilot UAE uses minimal cookies: essential cookies for authentication (Supabase session cookies) and functional cookies for user preferences (emirate selection, language). We use Vercel Analytics for aggregated, anonymised traffic analytics only — no advertising tracking, no cross-site tracking, and no third-party advertising cookies.
You can disable non-essential cookies in your browser settings at any time without losing access to the core service.
10. Third-Party Services We Use
- Anthropic Claude (USA) — AI language model for Ask ExpatPilot, Document Translator, and content generation. Privacy Policy →
- Supabase (USA/EU, AWS-hosted) — Database and authentication. Privacy Policy →
- Vercel (USA) — Application hosting and edge delivery. Privacy Policy →
- Resend (USA) — Transactional email delivery. Privacy Policy →
- Expo — Mobile app framework (if using the ExpatPilot mobile app). No additional personal data is collected beyond what the web app collects.
We do not sell, rent, or share your personal data with advertisers or data brokers.
11. Security
We implement technical and organisational measures to protect your personal data, including: TLS encryption for all data in transit, encrypted database storage (Supabase/AWS), access controls limiting staff access to personal data, rate limiting on all API endpoints to prevent abuse, and server-side session validation for authenticated requests.
In the event of a personal data breach that may affect your rights, we will notify affected users and the UAE Data Office in accordance with the PDPL's breach notification requirements.
12. Changes to This Policy
We may update this policy as our services evolve or as UAE data protection regulations are updated. We will notify registered users of material changes by email. The current version is always available at expatpilot.ae/uae/privacy.
13. Contact
Data controller: ExpatPilot, Eindhoven, Netherlands
For privacy inquiries or to exercise your data rights: hello@expatpilot.ae
UAE Data Office (supervisory authority): dataoffice.gov.ae