Privacy Policy.

This Privacy Policy explains how Matrixedlabs Technologies - FZCO ("we", "us" or "our") collects, uses, shares and protects personal data when you visit ml-data.io, contact us, use the ML Data dashboard at dashboard.ml-data.io or call the ML Data API. In this policy, the "Service" means the ML Data website, dashboard and API.

We are the controller of that personal data. ML Data is operated by Matrixedlabs Technologies - FZCO, a free zone company with limited liability incorporated in Dubai Silicon Oasis, United Arab Emirates, registration no. 79739, licence no. 86491 issued by the Dubai Integrated Economic Zones Authority, with its registered office at Building A1, Dubai Digital Park, Dubai Silicon Oasis, Dubai, United Arab Emirates.

One policy covers both the website and the dashboard, because they share a single cookie choice and the same first-party cookies on ml-data.io.

This policy is designed to meet the requirements of the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021), the EU and UK GDPR, and, where applicable, the California Consumer Privacy Act.

The website and the Service are meant for business users. They are not directed at anyone under 18. We do not knowingly collect personal data from children. If you believe a child has sent us personal data, contact us and we will delete it.

Contact form. When you use the contact form we collect your first name, last name, email address, company (optional), the topic you choose and your message. The form is protected by Cloudflare Turnstile, which checks technical signals from your browser and your IP address to tell people from bots. The message reaches us by email.

Rate limiting. To stop abuse, the contact form limits how many messages one IP address can send per minute. The rate limiter keeps your IP address in server memory only. It never writes the address to a database or file. Entries disappear when they are cleaned up or the server restarts.

Server logs. Our web servers record standard technical data for each request, such as your IP address, the page requested, the time, your browser type and the referring page.

Cookie choice. We store the choice you make in the cookie banner. The Cookies section below describes it.

Analytics and attribution, only with your consent. If you accept analytics cookies, we record pages viewed, the referring site, campaign parameters (utm tags and the Google Ads click ID, gclid), approximate location (city or region), browser, device type and interaction events. Without your consent, none of this is collected.

Dashboard account. You can sign in to the dashboard with an email address or with your GitHub account. We record the time of each sign-in and the IP address used, for security.

Email sign-in. If you register with an email address, we collect that address, your first name plus, if you give them, your last name and company. If you set a password, we store it only as a salted hash (Argon2id), never in readable form, so we cannot see it. We send one-time sign-in links, verification codes plus password-reset messages to your email address.

GitHub sign-in. If you choose GitHub, GitHub shares a limited profile with us: your name, email address, avatar, username plus the unique account ID it assigns. We request only basic profile and email access (the GitHub OAuth scopes read:user and user:email). We do not request repository or organisation scopes; we would ask for your separate, specific consent before we ever did.

Billing. Payments are handled by Stripe. We receive your billing name and address, any tax ID you give, your plan and payment status, plus the brand and last four digits of your card. We never see or store your full card number.

API usage. When you call the API we log request metadata: the API key used, the endpoint and pairs requested, the time, the response status, the credits charged and the calling IP address.

Caller IP addresses. We log the IP address of every API call for security, abuse prevention, rate limiting and billing accuracy. We keep it for 12 months. The legal basis is set out under Legal basis for processing.

Correspondence. If you email us, we keep the correspondence.

We do not ask for special categories of personal data, such as health data. Please do not include them in messages.

To answer your enquiry. Contact-form data is used to reply to you and follow up on your request.

To provide the Service. Account, usage and billing data is used to create your account, issue API keys, meter credits and apply rate limits. We also use it to enforce the overage spending cap you set and to show you your usage.

To bill you. Billing data is used to charge your plan through Stripe, issue invoices and keep financial records.

To keep the Service secure. Technical, log and usage data is used to block bots and abuse, detect compromised keys and investigate incidents.

To improve the website, with your consent. Analytics data shows us how the website is used and which pages and campaigns lead to dashboard sign-ups. After you sign up, the dashboard reads the attribution cookie once to record which visit led to your account.

To keep you informed. We send service messages about your account, billing, security or changes to our terms.

Product news to customers. If you have bought a plan, we may email you news about the ML Data product you bought. You can opt out at any time. Every such email carries a one-click unsubscribe link.

Other marketing, only with your opt-in. Promotional email about other products, partner offers and any marketing email to prospects or to trial users who have not bought a plan are sent only after your prior opt-in. That opt-in is a box you tick yourself; it is never ticked for you.

To meet legal obligations. We keep records that tax and accounting law requires. We may use data to establish, exercise or defend legal claims.

We do not sell personal data. We do not use it for cross-site advertising. We do not make decisions with legal or similarly significant effects about you by automated means alone.

Contract. We process account, billing and usage data to provide the Service you signed up for. We process contact-form data to take steps you ask for before a contract (GDPR Art. 6(1)(b)).

Consent. Analytics and the attribution cookies mld_vid and mld_attr run only after you accept them (GDPR Art. 6(1)(a)). You can withdraw consent at any time through Cookie settings in the footer. Withdrawal does not affect processing that took place before it.

Legitimate interests. We rely on our legitimate interests to keep the website and the Service secure (Turnstile, rate limiting, server logs), to send service messages and to defend legal claims (GDPR Art. 6(1)(f)). We have weighed these interests against your rights. You can ask us for a summary of that assessment.

Caller IP addresses. We process the IP addresses in API usage logs on the basis of performance of the contract and our legitimate interest in securing the Service (GDPR Art. 6(1)(b) and (f)). Under the UAE Personal Data Protection Law the basis is Article 4: processing necessary for the contract.

Legal obligation. We keep billing and accounting records because the law requires it (GDPR Art. 6(1)(c)).

We keep personal data only as long as we need it for the purposes above or as the law requires. Our indicative periods are:

Contact-form messages: up to 12 months after our last contact with you, unless the message is tied to an active dispute.

Rate-limiter entries: in server memory only, never stored.

Server logs: up to 90 days, unless an active security investigation needs them for longer.

Cookie choice: the mld_consent cookie expires after 180 days, after which we ask again.

Attribution cookies (mld_vid, mld_attr): up to 12 months in your browser.

Google Analytics cookies (_ga, _ga_VNL3PS2HTB): up to two years in your browser.

Analytics data: up to 14 months.

Dashboard account data, including your email address and any password hash: for as long as your account is open. We delete or anonymise it within 30 days after you close your account, except billing records, records under a legal hold and security records, which we keep for the periods in this section.

API usage logs, including caller IP addresses: up to 12 months. After that we keep only aggregated figures that do not identify you.

Billing and invoice records: seven years from the end of the financial year in which the transaction occurred, or longer where required by a legal hold, audit or dispute.

When a period ends, we delete the data securely or anonymise it so that it no longer identifies you.

We share personal data only with service providers that process it for us under written agreements, with professional advisers bound by confidentiality, or with authorities where the law requires it. Our providers are:

Cloudflare, Inc. (United States): network security and content delivery in front of ml-data.io; Turnstile bot protection on the contact form.

Stripe Payments Europe, Limited (Ireland): payment processing, subscriptions plus invoicing for dashboard plans. Stripe also acts as an independent controller for some data, for example for fraud prevention.

GitHub, Inc. (United States): sign-in to the dashboard. GitHub acts as an independent controller for the data it holds about you.

DigitalOcean, LLC (United States): hosting of the ml-data.io website server.

Google LLC (United States): website analytics with Google Analytics 4, only after you accept analytics cookies.

TransIP B.V. (Netherlands): email delivery of contact-form messages plus the dashboard's sign-in links, verification codes and password-reset messages.

Hetzner Online GmbH (Germany): servers for the dashboard, the API plus our self-hosted analytics.

Umami, a second analytics tool we plan to use, runs on our own servers, so no analytics vendor receives that data. We will update this list before we add or change a provider.

Transfers. Several of these providers process personal data outside the UAE, including in the United States. For those transfers we rely on contractual safeguards in each provider's data processing terms, as described under International transfers below.

Depending on where you live, you have the right to access the personal data we hold about you, to have it corrected or deleted, to restrict or object to its processing, to receive it in a portable format and to withdraw consent at any time.

If you are in California, you have the right to know, delete and correct your personal information. We will not discriminate against you for using those rights. We do not sell or share personal information as the California Consumer Privacy Act defines those terms.

You can withdraw analytics consent yourself at any time through Cookie settings in the footer.

To use any other right, write to the privacy address at the end of this page. We may need to verify your identity first. We reply within the period the law sets, typically 30 days, at no charge unless a request is manifestly unfounded or excessive.

You may also complain to a data protection authority: the UAE Data Office in the United Arab Emirates, the authority where you live or work in the European Economic Area, or the Information Commissioner's Office in the United Kingdom. We would welcome the chance to resolve your concern first.

We protect personal data with technical and organisational measures suited to the risk. They include encryption in transit with TLS, least-privilege access, logging of administrative access, regular patching plus confidentiality duties for staff and contractors.

ML Data is operated by Matrixedlabs Technologies - FZCO, whose information security management system is certified to ISO/IEC 27001:2022 (Certificate No. AE260925010, issued by LMS Assessments Limited, valid to 24 September 2029 subject to annual surveillance). The certified scope covers the design, development and sale of software and information technology solutions and data preparation, processing and management services.

No system is perfectly secure. If a personal data breach is likely to put your rights at risk, we will notify the competent authority and the people affected as the law requires.

To report a security vulnerability, use the security address at the end of this page.

We are established in the United Arab Emirates. Some of our providers process data in other countries, including the United States.

When we transfer personal data out of the UAE, we send it to countries the UAE considers adequate or rely on safeguards the UAE PDPL recognises, such as binding contractual commitments.

For personal data from the European Economic Area, the United Kingdom or Switzerland sent to a country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (with the UK addendum where needed) or on the EU-U.S. Data Privacy Framework where the recipient is certified.

You can ask us for a copy of the safeguards that apply to a specific transfer.

We use cookies and similar browser storage in two groups. Essential ones are always on. Analytics ones run only after you opt in. They stay off while your browser sends a Global Privacy Control or Do Not Track signal, even after an opt-in.

Essential: mld_consent stores your cookie choice (v1:a1 when you accept analytics, v1:a0 when you decline). It is set on .ml-data.io so that the website and the dashboard share one choice. It lasts 180 days. A copy of the same choice is kept in your browser's local storage (mld_cookie_consent_v1).

Essential: Cloudflare Turnstile may use short-lived cookies or browser storage while it checks a contact-form submission. The dashboard uses session cookies to keep you signed in.

Analytics, only after consent: mld_vid is a random visitor ID. mld_attr records the landing page, referring site, utm campaign parameters plus gclid of your first and most recent visit. Both are set on .ml-data.io and are shared with the dashboard, which reads mld_attr once after sign-up to attribute your account to the visit that led to it.

Analytics tools: we measure the website with Google Analytics 4. It loads only after you accept analytics cookies. It then sets the cookies _ga and _ga_VNL3PS2HTB on .ml-data.io to tell visits apart. They last up to two years unless you delete them. If you withdraw consent, Google Analytics stops at once and we delete both cookies.

We also plan to use Umami, self-hosted on our own servers. It is not active today. Once live, it too will run only after you accept analytics cookies. We will update this policy before we add any other analytics tool.

We do not use advertising cookies or cross-site tracking.

You can change your choice at any time through Cookie settings in the footer. You can also block or delete cookies in your browser settings. Blocking essential cookies may stop parts of the website or dashboard from working.

We may update this policy from time to time. The date at the top of this page shows the latest version. The change log below lists every change with its date.

Material changes. We will tell paid customers about a material change to this policy by email to the account email address at least 30 days before it takes effect.

Other changes. Immaterial changes and changes the law requires take effect once posted here.

Change log. 2026-10-27: published; the draft label removed. Google Analytics 4 added as an analytics tool, only after consent, with its provider and cookies. 2026-10-26: second draft, after legal review. 2026-09-28: first draft.

Privacy requests and questions about this policy go to the privacy address in the box below. Security vulnerability reports go to the security address below it.

Account and billing questions go to support@ml-data.io. Legal notices go to legal@ml-data.io.

Controller: Matrixedlabs Technologies - FZCO, a free zone company with limited liability incorporated in Dubai Silicon Oasis, United Arab Emirates, registration no. 79739, licence no. 86491 issued by the Dubai Integrated Economic Zones Authority.

By post, including formal notices: Matrixedlabs Technologies - FZCO, Building A1, Dubai Digital Park, Dubai Silicon Oasis, Dubai, United Arab Emirates.