Farq by Hayatiq
Privacy notice
Version 2026-10-20 · Last updated 1 Nov 2026
This notice explains what personal data Hayatiq AI Solutions FZE collects when you use Farq by Hayatiq, why, where it is kept, who helps us process it, how long we keep it and what you can ask us to do. It follows the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021).
1. Who is responsible
For your account details and how you use the software, Hayatiq AI Solutions FZE ("Hayatiq", "we") is the controller.
For the data you upload about your business or your clients (ledgers, invoices, customer and supplier names), you or your client are the controller and Hayatiq processes it on your behalf, under section 13 of the Terms of use.
Contact for anything in this notice: support@hayatiq.ai.
2. What we collect
About you, as a user:
- your email address, your display name and the name and kind of the workspace you create (accounting firm or own business);
- your role in each workspace and the invitations sent to you (we keep only a fingerprint of the invitation link, not the link itself);
- when you accepted these terms, and whether you ticked the box for VAT deadline reminders and product news;
- your second sign-in step: the authenticator app is registered with our sign-in provider, and we keep your recovery codes only as one-way fingerprints;
- your display preferences (theme, motion, notification time) and the time you were last active;
- an activity log of actions in your workspace (for example who uploaded a file or changed a role), with the ids of the people and records involved;
- product events: which screens and steps are used, recorded as fixed names, counts and ranges with your user and workspace id, never file contents or amounts.
About the data you upload:
- the files themselves (the Hayatiq Excel template, an FTA Audit File, or your accounting software's own VAT return report) and the lines read from them, including customer and supplier names, tax registration numbers, invoice numbers, descriptions and amounts;
- the client details you type in: legal name, tax registration number, emirates and return period;
- what the software produces from them: review items, the recomputed VAT 201, your decisions and sign-off, and the reports;
- the logo and firm name you add for your reports;
- when someone opens a share link you created: the time, whether they opened the web page or the PDF, and the kind of device (computer, phone or other), with no IP address or name.
Technical data:
- your IP address: our own attempt limits store only a keyed fingerprint of it, which expires with the limit window. Our sign-in provider records the IP address and browser of each sign-in session and sign-in event, in our database. These records do not yet have a fixed deletion period; we will set one and update this notice. Our hosting provider keeps standard request logs, which include IP addresses, for a short time;
- the cookies listed in section 7.
3. Why we use it
- To provide the software you signed up for: sign-in, workspaces, running the checks, reports and sharing (performing our contract with you).
- To keep the service and your data secure: two-step sign-in, attempt limits, the activity log and security notices by email (needed to provide a secure service under our contract).
- To send the emails the service needs: sign-in codes and links, invitations, security notices, "checks finished" and export notices, the confirmation that a workspace was deleted, and billing notices once paid plans start (contract).
- To keep the software working well, using product events that hold no file contents or amounts (as part of providing the service).
- To send VAT deadline reminders and product news, only if you ticked that box; you can withdraw at any time by writing to us (consent). We do not send these emails yet.
- To meet legal obligations, for example keeping billing records once paid plans start.
We do not sell personal data, and we do not use your data or your clients' data to train language models. Farq makes no automated decision about you that has legal or similar effects; review items are flags for your own review.
4. Where your data is kept
Your account data, your uploaded files and everything produced from them are stored in the European Union, in Frankfurt, Germany, and the software runs there too. Supabase has no UAE region today, so we do not describe the service as UAE-hosted.
Emails are sent from the European Union (Ireland). Some of our providers are United States companies whose staff, support tools or logs may be outside the EU; section 5 says what each one receives. Our background-job service receives only record ids, never names, files or amounts.
If a client of yours needs their data kept in the UAE, contact us: we can discuss a UAE-region database as a separate arrangement.
5. Who helps us (sub-processors)
We use these providers, each under a contract that limits them to processing data for us:
- Supabase (database, sign-in and file storage), Frankfurt, Germany: all account data and all uploaded and produced data.
- Vercel (hosting of the website and the software), software running in Frankfurt, Germany, with requests carried over Vercel's global network: processes every request while it is handled; keeps request logs.
- Inngest (scheduling of background jobs), United States: record ids only.
- Resend (email delivery), sending from Ireland: recipient address and the content of the email, such as a sign-in code or a link; delivery logs.
Built but switched off today. We will update this list and give workspace owners at least 14 days' notice before switching any of these on:
- Anthropic (language model, United States or global processing), for automated classification of ambiguous line descriptions. Customer and supplier names, tax registration numbers and invoice numbers would be replaced with tokens before sending; descriptions, account names, amount ranges, country and tax codes would be sent. Only a fingerprint of each request and its size would be stored.
- Paddle (merchant of record for card payments): we would send the workspace owner's email, the workspace's legal name and internal ids, and later the country and an optional tax registration number. No client data. Paddle collects card and billing details directly, as a separate controller under its own privacy notice.
- Sentry (crash reporting), European Union: technical details of a fault, with personal data removed.
6. How long we keep it
- Uploaded files and the lines read from them: deleted 90 days after the period is marked reviewed, or 90 days after upload if it never is. A daily job deletes them.
- Review items, the recomputed VAT 201, decisions, sign-offs, reports and the activity log: kept while the workspace exists, so you can see past periods, and deleted with the workspace.
- The fingerprints used to hide names before automated classification: deleted 90 days after they were last used.
- Product events: 13 months.
- Data exports: the download is deleted after 7 days.
- Share links: the shared copy is removed within an hour after the link expires or is revoked (links last 24 hours, 7 days or 30 days).
- Accounts that never confirmed their email: 7 days.
- Notifications and security notices: 30 days.
- Our database provider takes a daily backup and keeps each one for up to 7 days, so deleted data leaves the backups within that time. Uploaded files are not part of these backups.
When a workspace is deleted, its files and records are deleted, and the accounts of people who belonged to no other workspace are removed. We keep a short record that the deletion happened.
8. How we protect it
- Every workspace's data is isolated in the database, and tests check that one workspace cannot read another's.
- Members of accounting firm workspaces must use two-step sign-in before they can see client data; downloads and share links need a recent sign-in.
- Data is encrypted in transit and at rest. Files are kept in private storage and downloaded only through short-lived links.
- Data sent to background jobs and logs carries ids only, never names, descriptions or amounts.
If a personal data breach affects your data, we will tell the workspace owner without undue delay, and within 72 hours of becoming aware of it, and the UAE Data Office where the law requires it.
9. Your rights
You can ask us to give you a copy of your personal data, correct it, delete it, restrict or object to its use, or move it to another service, and you can withdraw consent to reminder emails at any time.
Write to support@hayatiq.ai from the address on your account. We answer within 30 days. A workspace owner can also export the workspace's data and request its deletion from the settings.
If the data is a client's data that a firm uploaded, we will pass your request to that firm, because they decide how it is used, and help them answer it.
If you are not satisfied with our answer, you can complain to the UAE Data Office.
10. Changes to this notice
We will update this notice when what we collect, where we keep it or who helps us changes, and tell workspace owners by email before a change that matters applies. The date at the top shows the latest version.