Privacy Policy

Overview

Qubitorbit Tech Ltd. ("QubitOrbit", "we", "us", or "our") is incorporated in the Dubai International Financial Centre (DIFC). We develop and operate technology products and services, including Bozy, an AI-assisted commodity market intelligence and workflow platform designed for professional market participants.

This Privacy Policy explains how we collect, use, store, and protect personal data in connection with the QubitOrbit website and the products and services we operate. It is drafted in accordance with the DIFC Data Protection Law No. 5 of 2020, as amended, the UAE Federal Decree-Law No. 45 of 2021 on Personal Data Protection, and the EU General Data Protection Regulation (GDPR), where applicable.

QubitOrbit and Bozy are brand and product names. Qubitorbit Tech Ltd. is the legal entity and data controller for the purposes of this Policy, except where we process customer-controlled data on a customer's instructions.

Data we collect

We collect only the data necessary to provide, operate, secure, and improve our professional services.

Data you provide

• Identity and account data: name, business email, company name, and job title.
• Authentication data: password, stored in hashed form. Plain-text passwords are never stored or accessible to any person.
• Demo and contact submissions: name, email, company, and message.
• Marketing preferences: email and consent status, only where you have explicitly opted in through a separate, unticked checkbox.

Data we collect automatically

• Technical data: IP address, browser type, operating system, and device type.
• Behavioral data: session activity, feature usage, login timestamps, and similar service activity.
• Cookies: essential session and preference cookies, and analytics cookies only with your consent. See our Cookie Policy for details.

Customer data from products and services, including Bozy

• Trading positions, curve inputs, uploaded files, workspace configurations, prompts, and other organizational content submitted by or on behalf of a customer organization.
• The customer organization is the data controller for this content. Qubitorbit Tech Ltd. processes it solely on that organization's instructions under the Master Service Agreement or another applicable agreement.

We do not collect Special Categories of Personal Data, including data concerning race, religion, health, biometrics, political opinions, or similar sensitive matters.

Purposes of processing

We use personal data strictly to:

• provide, operate, maintain, and secure the QubitOrbit website and our products and services;
• create and manage accounts, workspaces, permissions, and authentication;
• process uploads, configurations, API requests, and collaborative workflows;
• generate AI-assisted outputs, including classifications, summaries, alerts, curve adjustments, and related workflow outputs, in response to user interactions;
• respond to demo requests, enquiries, and support tickets;
• detect, prevent, and investigate fraud, abuse, and security incidents;
• comply with applicable law, regulation, court order, or legal process;
• send service notices and security alerts; and
• send product updates, market insights, or event invitations only where you have explicitly opted in.

Data privacy and AI integrity

Strict confidentiality

All customer data shared with us, including market data, pricing data, internal company data, uploaded files, prompts, workspace content, and trading positions, is treated as strictly confidential. Customer data is logically segregated, is not accessible to other QubitOrbit customers, and is not used for any purpose other than providing the agreed services.

No AI training

We do not use Customer Data, including trading positions, curves, uploaded files, prompts, workspace configurations, or other customer-provided content, to train, fine-tune, evaluate, or improve any AI model operated by Qubitorbit Tech Ltd. or a third party.

This commitment is contractually binding under the Master Service Agreement and applies to AI inference providers engaged by Qubitorbit Tech Ltd.

No unauthorized data export

Data processed through our products and services is protected against unauthorized external egress through appropriate security measures and contractual restrictions on service providers.

Third-party disclosure

We do not sell personal data. We do not share personal data with advertisers or data brokers.

We disclose personal data only to the following categories of recipients, each operating under appropriate contractual restrictions:

• Cloud infrastructure providers: secure hosting in a jurisdiction recognized as adequate by the DIFC Commissioner of Data Protection, with a Data Processing Agreement in place.
• IT development contractors: platform development and maintenance under Data Processing Agreements.
• Third-party AI inference providers: processing prompts and queries through AI-assisted features. These providers are contractually prohibited from retaining or using Customer Data for model training.
• Email and communications service providers.
• Professional advisers, auditors, and insurers where necessary for compliance or disputes.
• Legal or regulatory authorities where required by applicable law, regulation, court order, or legal process.
• Parties involved in a corporate transaction such as a merger, acquisition, restructuring, or sale, subject to confidentiality protections.

This Policy does not cover the practices of entities we do not control, including operating-system providers, browser vendors, wireless service providers, or external websites linked from our services. We are not responsible for the privacy practices of those third parties.

We will provide a current list of sub-processors to customers on request.

International data transfers

Personal data is stored on secure infrastructure in a jurisdiction recognized by the DIFC Commissioner of Data Protection as providing an adequate level of protection for personal data.

Where we engage sub-processors in other jurisdictions, we implement appropriate safeguards, including contractual restrictions on data use, retention limitations, and equivalent protective mechanisms in accordance with applicable data-protection law.

Data retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including satisfying legal, regulatory, tax, accounting, or reporting requirements. When data is no longer required, it is securely deleted or anonymized.

Where we process data as a processor on behalf of a customer, retention is governed by the customer's instructions under the Master Service Agreement or another applicable agreement.

Security

We take appropriate technical and organizational measures to protect personal data from unauthorized access, loss, misuse, alteration, or destruction. Our services are hosted on secure infrastructure in a DIFC-approved adequate jurisdiction.

While we work to safeguard personal data, no system is completely secure, and we cannot guarantee absolute security. If you believe your data has been compromised, contact [email protected] immediately.

In the event of a personal data breach, we will notify the relevant supervisory authority without undue delay in accordance with the DIFC Data Protection Law. Where required, affected individuals will also be notified.

Your rights

Under DIFC Data Protection Law, the UAE Personal Data Protection Law, and the GDPR, where applicable, you may have the right to:

• Access: request a copy of the personal data we hold about you.
• Correction: request correction of inaccurate or incomplete data.
• Deletion: request deletion of your personal data. Organizational data, including trading data, curves, uploaded files, and workspace content, is controlled by the relevant customer organization and is not deleted through individual requests. Contact your workspace administrator for organization-controlled data.
• Portability: request an export of your personal data in a structured, commonly used format.
• Objection: object to processing based on legitimate interests, including direct marketing.
• Withdraw consent: where processing is based on consent, withdraw it at any time without affecting processing performed before withdrawal.
• Complaint: lodge a complaint with a relevant supervisory authority.

To exercise a right, contact [email protected]. We will respond within 30 days and may need to verify your identity before processing a request.

Marketing communications

We send marketing communications only where you have given explicit consent through a dedicated, unticked opt-in checkbox.

You can unsubscribe at any time through the link in each marketing email or by contacting [email protected]. Opting out does not affect essential service communications.

Cookies

We use cookies to operate the QubitOrbit website and our services. Essential cookies are required for core functionality. Analytics cookies are optional and activated only with your consent through the cookie banner.

Full details are available in our Cookie Policy. You can change your preferences at any time through the Cookie Preferences link in the website footer.

Children

Our services are designed for business professionals. They are not directed at individuals under the age of 18, and we do not knowingly collect personal data from children. If we become aware of such collection, we will delete the data promptly.

Changes to this policy

We may update this Policy from time to time. Material changes will be communicated by email, through the relevant service, or through an in-product notice before the change takes effect. The current version will remain available at qubitorbit.com/privacy-policy.

Governing law

This Privacy Policy is governed by the laws of the Dubai International Financial Centre (DIFC). Any dispute arising from this Policy is subject to the exclusive jurisdiction of the DIFC Courts.