Privacy Policy — what we collect, why, and how to have it deleted.

Zenoweb designs and builds websites in Dubai, United Arab Emirates. This privacy policy explains what happens to personal data that reaches us through zenoweb.ae or the channels below, and it is written to be read rather than survived.

For anything in this policy — a question, a correction, or a request under section 10 — the channels on our contact page all reach the same small team.

It covers this website and the enquiries that arrive through it. It does not cover the websites we build for other people.

On a client's site, the client decides what is collected and why. That makes the client the controller of that data, and their privacy policy governs it, not this one. Where we hold data on a client's behalf — during a build, or under a care plan — we act on their written instructions under a separate agreement with them, and we do not use it for anything of our own.

It also does not cover sites this one links to. A link is not an endorsement of what happens on the other side of it.

What you send us, plus visit statistics from Google Analytics, which identifies a returning browser by a cookie but not you by name. There is no account to create, no pre-ticked box, and nothing that follows you from this site to others.

The last row is the only line collected without you doing anything, and it is written by the server rather than by the page. Every web server keeps an access log; without one a site cannot be debugged or defended. It is not joined to anything else and it is not used to build a profile of you.

The retention period for accounting records is set by UAE tax law rather than by us, and the exact period must be confirmed with an accountant before this page is published. It is stated as a rule above rather than as a number, so that nothing here asserts a figure nobody has checked.

The UAE Personal Data Protection Law — Federal Decree-Law No. 45 of 2021 — is the regime that applies to us, and the third column of the table above names the basis we rely on in each case.

In practice nearly everything falls under one basis: you asked us for something, and we cannot answer without reading what you sent. That is processing necessary for steps taken at your request before entering a contract, and it does not run on consent — which also means withdrawing consent is not the mechanism for stopping it. Asking us to erase the data is, and section 10 explains how.

The one thing that does run on consent is Google Analytics. It does not load until you choose Allow in the cookie banner, and you can withdraw that at any time from Cookie settings at the foot of every page.

We do not rely on consent for marketing, because we do not currently send any. If that changes, consent will be asked for separately and explicitly, and never collected as a side effect of somebody sending an enquiry.

There are two kinds of form here, and only one of them is connected.

The quote form and the project brief

Name, work email, company, current website, project type, indicative budget and your message — the same fields on both. When you press send, what you typed is passed to Resend, an email-delivery service, which delivers it to our inbox as an email. It is not saved to a database on this website, and nothing is kept on the site after it has been sent. Resend receives the contents of the form; it does not receive your IP address, because the request to it is made by our server rather than by your browser.

Two things the form checks and then discards

Each form contains one field you cannot see, which only automated spam programs fill in, and records how long the form took to complete. Both are used for one purpose — telling a person from a bot — and are thrown away at that point. Neither is sent to us, stored, or used for anything else.

The blog subscribe field

A work email address, and nothing else. Not connected: nothing is stored and nobody is added to a list, because there is no list yet.

This page said it would be updated before either form was connected rather than after, and name the service that receives the data. The quote form and the project brief were connected on 12 October 2026, and this section and section 7 were rewritten in the same change. The subscribe field will get the same treatment before it is connected. A policy edited afterwards is a description of something that already happened without you.

This site uses Google Analytics 4 to count visits and see which pages are read. It loads Google's analytics tag and nothing else — no Google Tag Manager container, no advertising pixel, no social embed — and the typeface is served from our own domain rather than a font network.

Google Analytics sets two cookies on this domain: _ga, which tells one visitor from another, and a second beginning _ga_, which keeps track of a single visit. Google documents a default lifetime of two years for both. They record the pages you view, the page you arrived from, your device and browser type, and an approximate location. Google states that Google Analytics 4 does not log or store IP addresses.

We also record two things you do. When you tap to WhatsApp, call or email us, Google Analytics notes the channel and which part of the page you tapped. When you send a brief and we receive it, it notes which form you used and the project type and budget band you chose from the dropdowns. It never receives your name, email address, company, website or message — those go only to us, by email, as described in section 5 — and we do not link the two.

None of this runs until you allow it. The first time you visit, a banner asks; Decline and Allow are the same size and carry the same weight, and until you choose Allow the Google Analytics script is not even requested from Google. If your browser sends a Global Privacy Control signal, we treat that as Decline and do not ask.

You can change your mind at any time from Cookie settings at the foot of every page. Withdrawing takes effect immediately rather than from your next visit: Google Analytics is switched off for the rest of the page you are on, and its two cookies are deleted. You can also block cookies for this site in your browser settings, or install Google's own opt-out add-on for Google Analytics.

We remember your choice in your browser's local storage rather than in a cookie, so remembering that you declined cookies does not itself require one. It stays until you change it or clear your browser's data, and we ask again only if what we are asking about changes.

This site sets no cookies of its own. Our host may set a strictly necessary cookie for security or load balancing; it is named in section 7.

As few people as possible. Nothing is sold, nothing is traded, and nothing is passed to an advertising network or a lead-generation list — not now and not later, because that is not a business we are in.

Four suppliers process something on our behalf:

Vercel Inc.

Hosts this website. It serves the pages and runs the code that receives a form submission, and it keeps the server access logs described in section 3.

Resend

Delivers form submissions to our inbox as email. It handles the contents of the form and nothing else.

Google

Provides Google Analytics, which receives the visit statistics described in section 6. It receives nothing from the forms.

Our email provider

Holds the inbox where enquiries arrive and where we reply from.

Still to be named: value not set yet: email provider. Naming a supplier we have not confirmed would be exactly the kind of unverifiable detail this site refuses to print elsewhere.

Beyond those two, data leaves us only where the law requires it — a lawful request from a UAE authority, or a claim we have to defend. If that ever happens we will tell you, unless we are prohibited from doing so.

Yes, through the suppliers in section 7. Vercel, Resend and Google are all US companies, so both an enquiry sent through a form and the statistics from a visit are processed outside the UAE, even though the company reading them is in Dubai.

The PDPL restricts transfers to jurisdictions that do not offer an adequate level of protection unless an approved safeguard is in place. The safeguard relied on for each supplier is value not set yet: transfer safeguard for Vercel, Resend and Google, to be confirmed with counsel — it is marked here rather than asserted, because a named legal mechanism that is not actually in place is worse than an honest gap.

The right-hand column of the table in section 3 is the answer, and the principle behind it is simple: an enquiry is kept while it is still plausibly a conversation, and deleted when it is not.

Twenty-four months from the last exchange is the default, because a project discussed and shelved genuinely does come back a year later, and losing the original brief helps nobody. If you would rather we did not keep it that long, say so and we will delete it — you do not need a reason, and you will not be asked for one.

Client records are different: contracts, invoices and payment records have to be retained for as long as UAE tax law requires accounting records to be kept, and we cannot delete those on request while that obligation runs.

The Personal Data Protection Law gives you rights over the data we hold about you. Exercising any of them costs nothing, and none of them require a reason.

Access

Ask what we hold about you and get a copy of it, together with what it is used for and who else has seen it.

Correction

Have anything inaccurate corrected, and anything incomplete completed.

Erasure

Ask us to delete it. We will, unless we are legally obliged to keep it — which in practice means client accounting records and nothing else.

Restriction

Ask us to stop processing it while a correction or an objection is being resolved.

Objection

Object to processing we carry out on the basis of a legitimate interest, which here means the server logs and nothing more.

Portability

Receive the data you gave us in a structured, machine-readable format, or have it sent to someone else.

Withdrawing consent

Where processing does rely on consent, withdraw it at any time. Withdrawal is not retrospective, but it stops everything from that point.

Complaining

Raise a complaint with the UAE Data Office if you think we have handled your data badly. You are not obliged to come to us first, though we would rather you did — it is usually faster.

Write to the email address in section 1 to exercise any of these. We will answer within the period the PDPL allows, and sooner where we can — the working week here is value not set yet: response window for data-subject requests, which must be set against the statutory deadline rather than guessed at.

This website stores nothing. It is served over HTTPS, it has no database and no login, and a form submission is never written to the site: it is passed straight to the delivery service in section 7 and arrives in our inbox. So the site itself is not a place personal data can be taken from — what we hold sits in email.

What we hold sits in our email and in our project records. Access is limited to the people who need it to do the work. value not set yet: the specific technical and organisational controls, to be confirmed and stated before this page is published.

No arrangement is perfect and claiming otherwise would be the kind of unevidenced assurance this site avoids everywhere else. If a breach occurs that is likely to affect you, we will notify you and the UAE Data Office as the PDPL requires, and we will tell you what actually happened rather than a sanitised version of it.

This is a business-to-business site and nothing on it is aimed at children. We do not knowingly collect personal data from anyone under 18. If you believe a child has sent us something, write to us and we will delete it.

The date under the title is the date this version took effect, and it is the only version in force. Small corrections are made in place. Anything that changes what we collect, why, or who else sees it is a material change, and the date moves with it.

Where a change follows something new on the site — analytics, a working form, a mailing list — the policy is updated before that thing goes live, not after. Section 5 is the current example of what that looks like in practice.

By email, at the address in section 1, or through any channel on our contact page. A request about your own data goes to the same place as everything else — there is no separate privacy queue, because we are not a big enough company to need one.

We have not appointed a data protection officer. Whether the PDPL requires one depends on the scale and nature of the processing, and that assessment is value not set yet: DPO requirement, to be confirmed with counsel rather than something to assume either way.

The commercial side of working with us is covered separately, in our terms and conditions.