Privacy Policy

1. Who we are

RR studio is a web development and AI integration practice operated by Rafeek Rabbat in Dubai, United Arab Emirates. We are the controller of personal data collected through this website. You can reach us at rafeekrabbat@gmail.com or +971 52 798 9825.

This policy covers this website and the enquiries that come through it. It applies to visitors anywhere in the world.

2. The short version

We collect only what you choose to send us, we use it only to answer you and do the work, we never sell it, and we run no analytics or advertising trackers on this site. The detail below explains exactly how that works.

3. What we collect

• Enquiry details. Your name, email address, business name and location, phone number, the tier you selected and the message you wrote, when you complete the quote or consultation form.
• Direct correspondence. Anything you send us by email, phone, or WhatsApp, kept as part of that conversation.
• Project data. During an engagement, the content, credentials and account access you provide so the work can be delivered.
• Server logs. Our hosting provider records standard technical data such as IP address, browser type and time of request, for security and reliability. We do not use these logs to build a profile of you.

4. What we do not do

We run no analytics, no advertising pixels and no behavioural tracking on this site. We set no cookies for tracking or marketing. We do not sell, rent or trade personal data, and we never share it for advertising. We do not knowingly collect data from anyone under 18.

5. How the enquiry forms work

This is worth being specific about, because the forms on this site behave differently from most.

The forms do not send your details to a database of ours. When you press send, the details you typed are formatted into a message and handed to either WhatsApp or your own email application, and you choose whether to send it. Nothing reaches us until you do.

If you send by WhatsApp, the message is delivered through WhatsApp and handled under Meta's own privacy policy, which is outside our control. If you would rather not use WhatsApp, use the email option on the same form, or contact us directly by email or phone. Whichever route you choose, the resulting message sits in that inbox and is handled as described here.

6. Why we use it, and on what basis

Enquiry data is used solely to respond to you, prepare a quote, and deliver work you go on to commission. Where a business relationship follows, we keep records for accounting, tax and legal purposes.

The legal bases are your consent in choosing to contact us, the performance of a contract with you, our legitimate interest in responding to business enquiries and keeping our systems secure, and compliance with our legal obligations. If you are in the EU or UK, those are the equivalent bases under the GDPR.

7. Who else is involved

Personal data reaches third parties only where a service is genuinely needed to operate:

• Messaging and email. WhatsApp, operated by Meta, and Google, which provides our email, where you use those channels to reach us.
• Hosting. Our hosting provider, which serves this site and keeps the server logs described above.
• Payments. For clients only, Ziina or Stripe process payment details directly. We never see or store your full card or bank details.
• Legal obligation. Any disclosure required by UAE law or a competent authority.

These providers act on our behalf or as controllers in their own right for their own services, and none of them are permitted to use your data to market to you on our behalf.

8. International transfers

Some of these providers operate outside the UAE, so your data may be processed abroad, including in the United States and the European Union. We use established providers that offer recognised contractual safeguards for such transfers. If you would prefer your enquiry stay on a single channel, email or phone us directly and say so.

9. How long we keep it

• Enquiries that do not become projects: deleted within twenty-four months.
• Client records: kept for the engagement and for as long afterwards as UAE accounting and tax rules require.
• Project credentials: removed from our password manager once a project ends and access is no longer needed.

You can ask us to delete your data sooner, and we will unless a legal obligation requires us to keep it.

10. Security

This site is served over HTTPS. Access to our inbox and project accounts is protected by strong authentication. Credentials you share are stored in an encrypted password manager and removed when a project ends. No system is perfectly secure, but we take steps proportionate to the data we hold, and we will tell you promptly if a breach affects your data.

11. Your rights

Under the UAE PDPL, and under the GDPR if you are in the EU or UK, you may:

• Request access to the personal data we hold about you
• Have inaccurate data corrected
• Request deletion of your data
• Restrict or object to certain processing
• Receive your data in a portable format
• Withdraw consent at any time, without affecting processing already carried out

To exercise any of these, email rafeekrabbat@gmail.com. We respond within thirty days and we do not charge for it. If you are not satisfied with our response you may complain to the UAE Data Office, or to your local data protection authority if you are in the EU or UK.

12. Cookies

This site sets no cookies. Fonts are loaded from Google Fonts, which means your browser makes a request to Google's font servers and Google receives your IP address as part of that request. No cookie is set by that request and we receive nothing from it.

13. External links

This site links to client work hosted elsewhere and to third-party messaging services. Those sites have their own privacy policies and we are not responsible for their practices.

14. Changes

If this policy changes, the revised version is published here with a new "last updated" date. Material changes affecting existing clients will be communicated directly rather than left for you to notice.