Privacy Policy

iQanoon® is a legal validation service operated by iLegal Solutions Limited, a legal consultancy firm registered under Innovation City, Ras Al Khaimah, UAE. iQanoon validates AI-generated legal documents and queries through licensed legal professionals across the UAE, Egypt, and Jordan.

For the purposes of applicable data protection law (including the GDPR and the UAE PDPL), iLegal Solutions Limited is the data controller responsible for your personal data.

Data Protection Officer (DPO). Amer serves as the designated Data Protection Officer for iLegal Solutions Limited. For data-protection and privacy matters, including any request to exercise your rights under §7, contact the DPO at [email protected] (please include “Privacy” in the subject line).

Service & billing contact:

• Validation, subscriptions & services rendered: [email protected]

Account & contact data

Name, email address, company or firm name, jurisdiction, and (for affiliates) license type and licensed jurisdictions. Collected when you create an account, submit a request, or apply to become an affiliate.

Submission data

The documents and legal queries you submit for validation. You are required to remove or redact any personally identifiable information (PII) from your submissions before upload (see §10 and our Terms & Conditions §7). iQanoon is not an AI tool and does not train models on your submitted content.

Payment data

Payment processing is handled by our payment provider, Stripe (and, as added, Network International and other methods). We do not collect or store full card numbers. We retain records of transactions (amounts, dates, billing email) for accounting and tax-compliance purposes.

Communication data

Records of your emails, form submissions, and messages you send us, including inputs to the on-site assistant (a rule-based help tool that does not use AI and does not retain your inputs after the session).

Usage & technical data

Basic technical data such as browser type and IP address may be logged for security and service operation. No third-party analytics or profiling cookies are currently deployed (see our Cookie Policy).

We process your personal data only for specified, explicit, and legitimate purposes, on the following legal bases under GDPR Article 6 (and the equivalent provisions of the UAE PDPL):

• To provide the validation service you requested — performance of a contract (Art 6(1)(b)).
• To process payments and issue invoices — performance of a contract and legal obligation (Art 6(1)(b), 6(1)(c)).
• To communicate with you about your validations, account, and service updates — performance of a contract and legitimate interests (Art 6(1)(b), 6(1)(f)).
• To assign work to the correct licensed affiliate in the relevant jurisdiction — performance of a contract (Art 6(1)(b)).
• To comply with legal, tax, and regulatory obligations (including UAE VAT and record-keeping) — legal obligation (Art 6(1)(c)).
• To maintain security and prevent fraud — legitimate interests (Art 6(1)(f)).
• For any optional analytics or marketing where you have consented — consent (Art 6(1)(a)). You can withdraw consent at any time.

We do not use your personal data for automated decision-making or profiling with legal or similarly significant effects (see §11).

We share personal data only with parties necessary to deliver the service, on a need-to-know basis:

• Licensed affiliates (legal professionals and consultancies in the UAE, Egypt, and Jordan) — receive the documents and queries you submit so they can perform the validation. Affiliates are bound by confidentiality and professional-privilege obligations and process submissions only for the purpose of validation under our instructions.
• Payment providers (Stripe, Network International) — process your payment transactions. Their handling of your card data is governed by their own privacy policies and PCI-DSS compliance.
• Cloud infrastructure provider (AWS) — hosts the platform and stores documents, under encryption, in the AWS UAE region.
• Email & communications providers — used to send you service-related emails.

We do not sell your personal data. We share data with authorities only where required by law.

Data residency. Your data is stored in the AWS UAE region to satisfy UAE data-residency requirements. We do not replicate client content across regions.

Cross-border access. Because validation is performed by licensed affiliates in the UAE, Egypt, and Jordan, your submitted documents may be accessed by a professional located in the jurisdiction you selected (or where assignment requires). By submitting, you acknowledge this cross-border access for the purpose of validation.

EU/UK transfers. For data subjects in the European Economic Area or the United Kingdom, any transfer of personal data outside the EEA/UK is made subject to appropriate safeguards, including Standard Contractual Clauses (SCCs) where required, and only where a valid legal basis exists.

We retain personal data only as long as necessary for the purposes set out in this policy and to meet legal, tax, and regulatory obligations:

• Active account data: for as long as your account is active, and thereafter for a reasonable period to allow re-registration, unless you request deletion.
• Validation records & documents: retained for the period required by applicable tax and record-keeping law. Under UAE tax regulations this may be up to 7 years.
• Payment & invoice records: retained per tax-law requirements.
• Communication data: retained for as long as reasonably needed to respond to inquiries and maintain service records.

When retention is no longer required, we delete or anonymize the data. You may request earlier deletion where legally permitted (see §7).

Under the GDPR and the UAE PDPL, you have the following rights over your personal data:

• Access — to know what data we hold about you.
• Rectification — to correct inaccurate or incomplete data.
• Erasure — to request deletion of your data (“right to be forgotten”), subject to legal retention obligations.
• Restriction — to limit how we process your data.
• Portability — to receive your data in a structured, machine-readable format.
• Objection — to object to processing based on legitimate interests or for direct marketing.
• Withdraw consent — where processing is based on consent, at any time.
• Rights related to automated decision-making — not to be subject to decisions based solely on automated processing with legal/significant effects (see §11).

To exercise any right, email [email protected] with “Privacy” in the subject line. We respond within one month (as required by the GDPR), and within the timeframe set by the UAE PDPL for requests falling under it. We may verify your identity before acting on a request.

Right to complain. If you believe we have not handled your data correctly, you have the right to lodge a complaint with the relevant data-protection supervisory authority — for EU residents, the authority in your member state; for UAE residents, the UAE Data Office or the competent authority under the PDPL.

We take appropriate technical and organizational measures to protect your personal data:

• Encryption at rest (AWS KMS) and in transit (TLS).
• Per-user encrypted document vaults.
• Role-based access control (user / affiliate / admin).
• Append-only audit trails for validation state changes.
• Time-limited access to documents (presigned URLs); no persistent direct access for affiliates.
• Payment data handled by PCI-DSS-compliant providers.

No method of transmission or storage is completely secure, but we work to protect your data using industry-standard safeguards. In the event of a personal-data breach, we will notify you and the relevant supervisory authority as required by applicable law.

Because iQanoon is agnostic in its serving — routing submissions across AI tools and licensed affiliates in multiple jurisdictions — you must remove or redact any personally identifiable information (PII) from your documents before submitting them. This obligation is set out in our Terms & Conditions (§7) and is a core condition of using the service.

iQanoon is not liable for any PII you choose to include in a submission despite this obligation. By submitting a document or query, you confirm that you have removed or are authorized to share any personal information it contains.

iQanoon does not use AI to produce or decide the outcome of validations. Validation is performed by licensed human legal professionals. The on-site assistant is a rule-based help tool (it provides pre-scripted answers and navigation) and does not constitute AI, profiling, or automated decision-making with legal or significant effects.

We do not train AI models on your submitted content without your permission.

iQanoon is a professional legal service and is not directed at individuals under 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will take steps to delete it.

We use only limited cookies and similar technologies. Full details, including the specific cookies we use and how to manage them, are in our Cookie Policy.

We may update this Privacy Policy from time to time. We will revise the “Last updated” date above and notify you of material changes where required. Continued use of the service after a change constitutes acceptance of the updated policy.

For any questions about this Privacy Policy or your personal data, contact us at [email protected]. For matters related to active validations or billing, contact [email protected].