Privacy Policy

1. Data controller

CloudSync Technologies LLC, a company registered in Dubai, UAE (“CloudSync”, “we”, “us”, “our”), is the data controller for personal data processed via the Probita platform (“Service”). For data-related enquiries, contact: privacy@synctechnologies.ae.

2. What data we collect

When you or your school signs up for Probita, we may collect:

• Account data: name, work email address, school or organisation name, job title, phone number.
• IT asset data: device records, software licences, maintenance logs, helpdesk tickets, and audit evidence you upload.
• Usage data: pages visited, features used, session duration, device type, and browser — collected via server logs only. We do not use third-party analytics or advertising pixels on authenticated user sessions.
• Authentication data: argon2id-hashed passwords (we never store plaintext passwords) and, if you use SSO, the provider-supplied identifier.

We do not collect student personal information. Probita is an IT management tool for school staff, not a student information system.

3. Legal basis for processing

• Contract performance: processing necessary to provide the Service you have subscribed to (UAE PDPL Art. 7(1)(b) / GDPR Art. 6(1)(b)).
• Legitimate interests: service security, fraud prevention, and product improvement based on aggregated usage patterns (UAE PDPL Art. 7(1)(f) / GDPR Art. 6(1)(f)).
• Legal obligation: where applicable UAE law requires retention or disclosure.

4. Sub-processors

We use a small, audited list of sub-processors. Full details are at /subprocessors. The key sub-processors are:

• Amazon Web Services (AWS) — ap-south-1 (Mumbai, India): hosting, database, object storage, and email delivery infrastructure.
• Prisma (Prisma Data, Inc.): ORM framework used at build time only — no customer data is transmitted to Prisma.

5. Data location

All customer data is stored on AWS infrastructure in the ap-south-1 region (Mumbai, India). We do not currently operate a UAE-native data region. A UAE-native deployment is on our roadmap for Q4 2026; we will notify customers before any region migration.

6. Data retention

Active account data is retained for the duration of your subscription plus a 30-day grace period after cancellation, during which you may export your data. After this period, your data is permanently deleted. Audit logs are retained for 7 years to comply with UAE commercial record-keeping requirements. You may configure shorter retention periods within the app under Settings → Data Retention.

7. Your rights (data subject rights)

Under the UAE Personal Data Protection Law (PDPL) and applicable data protection laws, you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion (“right to be forgotten”)
• Data portability (export in machine-readable format)
• Object to processing based on legitimate interests

To exercise any of these rights, email privacy@synctechnologies.ae with your name, email address, and the specific right you wish to exercise. We will respond within 30 days.

8. Cookies

Probita uses only functional cookies necessary to operate the Service:

• Session cookie: httpOnly, sameSite=Lax, never exposed to JavaScript. Expires at session end or after 7 days.
• Preference cookies: timezone, locale — stored for 1 year.

We do not use advertising, tracking, or analytics cookies. We do not share cookie data with third parties.

9. Security

We implement appropriate technical and organisational measures including TLS 1.3 in transit, AES-256-GCM encryption at rest for sensitive secrets, argon2id password hashing, row-level security tenant isolation, and mandatory two-factor authentication for operator accounts. For details, see our Security page.

10. Changes to this policy

We will notify you by email at least 14 days before making material changes to this policy. The “Last updated” date above always reflects the current version.

11. Governing law

This policy is governed by the laws of the United Arab Emirates. Any disputes are subject to the exclusive jurisdiction of the courts of Dubai, UAE.

12. Contact

For privacy questions or DSR requests: privacy@synctechnologies.ae
CloudSync Technologies LLC, Dubai, UAE