Privacy notice.

Yallo AI Certs (“Yallo AI Certs”, “we”, “us”) is an educational platform operated by YALLO Management Consultancies LLC, a limited liability company registered in Dubai, United Arab Emirates. We are the data controller for personal data processed through aicerts.yallo.co.

Contact for privacy matters: [email protected].

We collect only what we need to run the service:

• Account data. Email address, name (where you provide it), profile photo and Google account ID when you sign in with Google, and the timestamp of your most recent sign-in.
• Learning progress. Lessons you start and complete, quiz answers and scores, certificates issued, and the timestamps for each.
• Payments. When you purchase a programme, payment is processed by Stripe. We never see your full card number; we receive a payment confirmation, the last four digits of the card, and a Stripe customer ID.
• Communications. Emails you send to us, support requests, and form submissions (contact, waitlist, readiness assessment).
• Technical data. IP address, browser type, device type, pages viewed, referrer, and approximate location derived from IP. Collected automatically via cookies and our analytics providers.

• To authenticate you and keep you signed in.
• To deliver lessons, track progress, and issue certificates.
• To process payments and manage subscriptions.
• To respond to your messages and provide support.
• To improve the platform (anonymous and aggregated analytics).
• To send transactional email (sign-in codes, receipts, certificate issuance). We do not send marketing email without your separate opt-in.
• To detect fraud, abuse, and breach of our Terms of Service, and to comply with legal obligations.

We are established in the UAE and primarily subject to the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021). Because we knowingly offer our service to learners in the European Union and the EEA, the EU General Data Protection Regulation (Regulation 2016/679) also applies extraterritorially under its Article 3(2). Where the two regimes diverge we apply the standard that is more protective of you.

• Contract. Processing necessary to deliver the service you signed up for (Art. 5(c) UAE PDPL; Art. 6(1)(b) GDPR).
• Legitimate interests. Securing the platform, preventing abuse, and improving the product (Art. 5(g) UAE PDPL; Art. 6(1)(f) GDPR).
• Consent. Non-essential cookies and any marketing email — withdraw at any time (Art. 6 UAE PDPL; Art. 6(1)(a) GDPR).
• Legal obligation. Tax, accounting, and consumer protection laws under UAE federal law and any equivalent obligation in your country of residence (Art. 6(1)(c) GDPR).

We rely on the following providers to operate the service. Each is bound by a data-processing agreement and processes data only on our instructions.

• Supabase — authentication and database hosting (EU region).
• Stripe — payment processing.
• Vercel — application hosting and edge delivery.
• Sanity — content management for course material.
• Resend — transactional email delivery.
• Google (Sign in with Google) — federated authentication, when you choose that option.
• PostHog and Google Analytics — product and traffic analytics (EU hosting where available).
• Cloudflare Turnstile — bot protection on forms.

Several providers process data outside the UAE — typically in the European Union, the United Kingdom, or the United States. For transfers out of the EU/EEA we rely on Standard Contractual Clauses approved by the European Commission. For transfers out of the UAE we rely on the safeguards permitted under Articles 22–23 of the UAE PDPL, including adequacy where recognised by the UAE Data Office and contractual safeguards otherwise.

• Account and progress data. For as long as your account exists, plus 90 days after deletion (so you can recover it if you change your mind).
• Payment and tax records. Retained for at least 5 years from the end of the relevant tax period, in line with UAE Federal Tax Authority record-keeping rules under the VAT and corporate-tax laws.
• Server logs. Up to 90 days.
• Analytics events. Up to 14 months, then anonymised or deleted.

You may at any time:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Delete your account and associated data (subject to legal retention obligations above).
• Export your data in a portable, machine-readable format.
• Object to or restrict processing based on legitimate interests.
• Withdraw consent at any time, without affecting prior processing.
• Lodge a complaint with the UAE Data Office or, if you are in the EU/EEA, with your local data-protection supervisory authority.

To exercise any of these, email [email protected]. We respond within 30 days.

When you choose “Continue with Google”, Google shares with us your email address, name, profile picture, and Google account ID. We use this solely to create and authenticate your account. We never post to Google on your behalf, never access your Gmail, Drive, Calendar, or Contacts, and never sell or share Google user data with third parties for advertising. You can revoke our access at any time from your Google account permissions.

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

We use a small number of cookies — strictly necessary cookies for authentication and session, plus optional analytics cookies that only load after you accept them. See our cookie notice for the full list.

Data is encrypted in transit (TLS 1.2+) and at rest. Passwords are never stored — authentication is by one-time email code or federated OAuth. Access to production systems is restricted to a small number of named staff under two-factor authentication.

Yallo AI Certs is not directed at children under 16. If you become aware that a child has provided us with personal data, contact [email protected] and we will delete it.

If we make a material change to how we handle personal data, we will post a new “Last updated” date at the top of this page and, where required by law, notify you by email at least 14 days before the change takes effect.