Privacy Policy

Zynthlabs FZE LLC ("Zynthlabs", "we", "our", or "us"), incorporated at Ajman NuVentures Centre Free Zone under License No. 2628613881888, is committed to protecting your privacy and handling your personal data with the highest standards of transparency, integrity, and security.

This Privacy Policy applies to all personal data we collect and process through our website (zynthlabs.tech), our AI infrastructure products (SynthCore™, NeuralOps™, DataSynth™, AgentStack™), our professional services, and any other interaction you have with Zynthlabs.

By using our website or services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with its terms, please discontinue use of our services and contact us to request deletion of any data we may hold about you.

The data controller responsible for your personal data is:

Field	Details
Legal Name	Zynthlabs FZE LLC
License Number	2628613881888
Registered Address	BC-891431, 26th Floor, Amber Gem Tower, Sheikh Khalifa Street, Ajman, United Arab Emirates
Free Zone	Ajman NuVentures Centre Free Zone (ANCFZ)
Data Protection Contact	m@zynthlabs.tech
Responsible Person	Mahesha Rukshani Fernando Warnakulasooriya

For all data protection enquiries, requests to exercise your rights, or complaints, please contact us at m@zynthlabs.tech with the subject line "Data Protection Request".

We collect personal data in the following categories depending on your relationship with us:

3.1 Data You Provide Directly

• Contact & Identity Data: Name, email address, phone number, company name, job title, and country when you submit enquiries, sign up for services, or communicate with us.
• Account Data: Username, password (hashed), billing information, and account preferences when you register for our platform.
• Communication Data: Content of emails, messages, support tickets, and any other correspondence you send us.
• Contractual Data: Information provided during onboarding, service agreements, and procurement processes.

3.2 Data Collected Automatically

• Usage Data: Pages visited, features used, clickstream data, session duration, and interaction logs on our website and platform.
• Technical Data: IP address, browser type and version, device identifiers, operating system, time zone, and referral URLs.
• API & Platform Data: API request metadata (timestamps, endpoints called, response codes) — we do not store the payload content of your AI model inputs/outputs unless explicitly required for debugging and agreed by you.
• Cookies & Tracking: See Section 10 for full details on our cookie usage.

3.3 Data From Third Parties

• Business contact information from publicly available professional directories where we have a legitimate interest in outreach.
• Verification data from identity verification providers used during enterprise onboarding.
• Analytics data aggregated by third-party analytics providers (anonymised before reaching us where possible).

We process your personal data for the following specific purposes:

Purpose	Data Used	Legal Basis
Responding to enquiries & providing support	Contact data, communication data	Contractual necessity / Legitimate interest
Delivering and operating our AI platform services	Account data, usage data, API data	Contractual necessity
Billing and invoicing	Identity data, billing data	Contractual necessity / Legal obligation
Security monitoring and fraud prevention	Technical data, usage data	Legitimate interest / Legal obligation
Product improvement and analytics	Usage data (anonymised)	Legitimate interest
Marketing and service updates (opt-in)	Contact data	Consent
Legal compliance and regulatory reporting	All categories as required	Legal obligation
Service notifications and operational communications	Contact data	Contractual necessity

We will never sell, rent, or trade your personal data to third parties for their own marketing purposes.

Under UAE PDPL and GDPR (where applicable), we rely on the following legal bases for processing your personal data:

• Contractual Necessity: Processing required to enter into or perform our contract with you, including service delivery, billing, and account management.
• Legitimate Interests: Where our legitimate business interests do not override your fundamental rights — such as fraud prevention, platform security, and business analytics.
• Legal Obligation: Processing required to comply with UAE law, ANCFZ regulations, tax obligations, and applicable international regulations.
• Consent: For marketing communications, non-essential cookies, and any processing not covered by the above bases. You may withdraw consent at any time by contacting us at m@zynthlabs.tech.

We share your personal data only in the following circumstances:

6.1 Service Providers

We engage trusted third-party vendors to help us operate our business. These providers act as data processors under our instructions and are bound by data processing agreements:

• Cloud infrastructure providers (for hosting and compute)
• Payment processors (for billing and invoicing)
• Email delivery platforms (for transactional communications)
• Analytics and monitoring tools (processing anonymised data)
• Customer support platforms

6.2 Legal Requirements

We may disclose personal data where required by UAE law, ANCFZ regulations, court order, or lawful request by a government authority. We will notify you of such requests where legally permitted.

6.3 Business Transfers

In the event of a merger, acquisition, or sale of company assets, your data may be transferred to the acquiring entity, subject to the same protections described in this Policy. You will be notified of any such transfer.

6.4 With Your Consent

We may share your data with third parties for purposes not listed above with your explicit prior consent.

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected and as required by applicable law:

Data Category	Retention Period	Basis
Active account data	Duration of relationship + 3 years	Contractual / Legitimate interest
Billing & financial records	7 years from transaction date	UAE Commercial Transactions Law
Support & correspondence	3 years from last interaction	Legitimate interest
API usage logs (metadata)	90 days rolling	Security / Debugging
Marketing consent records	Until withdrawal + 3 years	Legal obligation
Website analytics (anonymised)	26 months	Legitimate interest
Job applicant data	12 months if unsuccessful	Legitimate interest

Upon expiry of the applicable retention period, your personal data will be securely deleted or anonymised in accordance with our data disposal procedures.

Subject to applicable law, you have the following rights with respect to your personal data held by Zynthlabs:

• Right of Access: Request a copy of the personal data we hold about you and information about how we process it.
• Right to Rectification: Request correction of inaccurate or incomplete personal data.
• Right to Erasure: Request deletion of your personal data where there is no compelling reason for us to retain it (subject to legal obligations).
• Right to Restrict Processing: Request that we limit how we use your data in certain circumstances.
• Right to Data Portability: Receive your personal data in a structured, machine-readable format to transfer to another provider.
• Right to Object: Object to processing based on our legitimate interests, including direct marketing.
• Right to Withdraw Consent: Where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing.
• Right to Lodge a Complaint: File a complaint with the UAE Data Office or the relevant supervisory authority in your jurisdiction.

To exercise any of these rights, please contact m@zynthlabs.tech with subject "Data Rights Request". We will respond within 30 days. We may ask you to verify your identity before processing your request.

We implement robust technical and organisational measures to protect your personal data against unauthorised access, loss, destruction, or alteration:

• End-to-end encryption of data in transit (TLS 1.3) and at rest (AES-256)
• Role-based access controls with principle of least privilege
• Multi-factor authentication for all internal systems
• Regular penetration testing and security audits
• Intrusion detection and real-time threat monitoring via NeuralOps™
• Zero-trust network architecture
• Secure software development lifecycle (SSDLC) practices
• Data processing limited to UAE-based infrastructure for UAE-resident data

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and affected individuals without undue delay, in accordance with UAE PDPL requirements.

Our website uses cookies and similar tracking technologies to enhance your experience and understand how our site is used.

Cookie Type	Purpose	Duration	Consent Required
Essential	Core website functionality, session management, security	Session	No
Functional	Remembering your preferences, language settings	1 year	Yes
Analytics	Understanding site usage patterns (anonymised)	26 months	Yes
Marketing	Targeted advertising (we do not use these)	N/A	N/A

You can manage your cookie preferences at any time through your browser settings or by contacting us. Please note that disabling essential cookies may affect website functionality.

We do not use cookies for advertising profiling or cross-site tracking. We do not permit third-party advertising cookies on our website.

Zynthlabs is headquartered in the UAE and primarily processes data within the UAE. Where we transfer personal data outside the UAE (for example, to service providers in other jurisdictions), we ensure appropriate safeguards are in place:

• Transfers only to countries with an adequate level of data protection as recognised by the UAE Data Office
• Standard contractual clauses (SCCs) or equivalent mechanisms for other transfers
• Data processing agreements with all third-party processors
• Assessment of the data protection laws of the destination country prior to transfer

Enterprise clients may request UAE data residency as part of their service agreement, ensuring all data processing occurs within UAE territory.

Our services are directed exclusively at businesses and professional users. We do not knowingly collect, process, or store personal data from individuals under the age of 18.

If you believe we have inadvertently collected data from a minor, please contact us immediately at m@zynthlabs.tech and we will take immediate steps to delete such data.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

• Update the "Effective Date" at the top of this Policy
• Notify registered users by email at least 14 days before changes take effect
• Display a prominent notice on our website
• For significant changes, seek fresh consent where required by law

We encourage you to review this Policy periodically. Your continued use of our services after changes take effect constitutes your acceptance of the updated Policy (to the extent permitted by applicable law).

For all privacy-related matters, requests, or complaints, please contact our Data Protection contact:

Method	Details
Email	m@zynthlabs.tech — Subject: "Privacy Policy Enquiry"
Post	Zynthlabs FZE LLC, BC-891431, 26th Floor, Amber Gem Tower, Sheikh Khalifa Street, Ajman, UAE
Supervisory Authority	UAE Data Office — uaedataoffice.gov.ae

We take all privacy concerns seriously and aim to respond to all enquiries within 5 business days, and to formal data rights requests within 30 calendar days.