YOUR DATA.
YOUR RIGHTS.
OUR DUTY.

TFSF Ventures FZ-LLC ("TFSF", "we", "us") is a Free Zone Limited Liability Company registered in Ras Al Khaimah Economic Zone under License No. 47013955. TFSF operates Labarna. Labarna is the service and product umbrella; it is not a separate legal entity.

This Policy covers personal data processed through Labarna websites, interfaces, conversations, APIs, software, products, support, commercial relationships, and commissioned services. A separate SOW, client notice, or data-processing addendum may provide more specific terms. Mandatory applicable law controls where it differs from this Policy.

Depending on how you interact with Labarna, we may process:

• Identity and contact data: name, business email, telephone number, company, job title, country, and preferred language.
• Conversation and enquiry data: questions submitted to RAI, project objectives, conversation transcript, requested follow-up, and information you choose to provide.
• Commercial and service data: proposals, SOWs, account contacts, support records, instructions, approvals, billing records, and service history.
• Technical, analytics, and security data: IP address and one-way network hash, approximate location supplied by hosting infrastructure, browser and device information, landing source and campaign parameters, pages and sections viewed, interface elements clicked, scroll depth, active and elapsed time, exits and drop-off points, performance timings, request timestamps, access and diagnostic logs, security events, and consent or preference records.
• Client deployment data: account, integration, system, user, workflow, and operational data processed only where relevant to an authorized Labarna service.
• Transaction-related metadata: only where a contracted deployment or protocol use case requires it. This website does not ask visitors to submit payment-card details through RAI.

Do not submit sensitive identity documents, financial records, health information, children's data, passwords, private keys, or other regulated or confidential data through the public conversation interface.

We obtain data directly from you or your organization; from your use of the website and services; from systems, integrations, users, or representatives authorized by a Client; from our service providers; and, where lawful and relevant, from public business or regulatory sources. If another organization provides your data, that organization is responsible for having authority to do so and for giving required notices.

We process personal data to:

• operate, secure, localize, diagnose, support, and improve the Labarna website and services;
• answer questions, provide requested information, qualify and respond to enquiries, and create a human follow-up when requested;
• prepare, administer, perform, and enforce contracts, SOWs, accounts, support, billing, delivery, and client instructions;
• authenticate users, manage permissions, prevent misuse, investigate incidents, and protect Labarna, Clients, users, and third parties;
• comply with applicable law, lawful requests, sanctions and financial-crime controls, recordkeeping, and dispute or legal-claim requirements;
• measure entry sources, journeys, engagement, conversion, RAI usage, drop-off, performance, and errors; improve the website and services; and create aggregated or de-identified operational analysis;
• send marketing or product communications only with consent or where otherwise permitted by applicable law, with an available opt-out.

Where the UAE Personal Data Protection Law applies, we process personal data with consent or under another condition permitted by that Law, including where processing is necessary to perform or enter a contract, comply with legal obligations, protect rights and legal claims, protect public interests, or respond to a person's request, as applicable to the circumstances.

Consent requests will be clear, accessible, and capable of proof. You may withdraw consent through the relevant control or by contacting us. Withdrawal does not affect processing already lawfully completed and may limit a service that cannot operate without the data.

RAI is Labarna's website intelligence interface. When you submit a question, RAI processes the text and current conversation context to return an answer. The public interface does not automatically send the full conversation to sales. A transcript and the contact details you provide are sent for human follow-up only if you request more information and submit the follow-up form.

Commissioned Labarna systems may process different data, use different models, or connect to Client systems as documented in the applicable SOW. Client-controlled deployments and consequential workflows must use the human review, permissions, escalation, and governance controls stated in their applicable agreement and law.

Where applicable law grants a right concerning a materially consequential automated decision, you may request information, correction of relevant inputs, human review, or contest the outcome by contacting us.

TFSF acts as controller for website operation, its own business relationships, enquiries, security, and legal administration. For Client Data processed solely on a Client's documented instructions to deliver a contracted service, TFSF may act as a processor or service provider and the Client generally determines the purpose and means of processing. The SOW or data-processing addendum defines the parties' roles and instructions for that service.

Clients are responsible for the lawfulness, accuracy, notices, permissions, connected systems, retention choices, and instructions concerning Client Data. TFSF will not use Client Data to train a third-party foundation model without the Client's express written consent.

We disclose personal data only as needed for the purposes in this Policy, including to infrastructure and hosting providers; communications providers such as the service used to deliver requested follow-up emails; authorized personnel and subcontractors; professional advisers, auditors, insurers, and financing providers; competent authorities where lawfully required; and a purchaser or successor in a genuine corporate transaction subject to appropriate confidentiality and legal controls.

Service providers receive only the access reasonably required for their role and are bound by contractual or legal duties. We do not sell or rent personal data.

Labarna may use infrastructure, personnel, or service providers outside the country where data originated. Where the UAE Personal Data Protection Law applies, transfers are made to a jurisdiction recognized as providing adequate protection, under appropriate contractual or organizational safeguards, or under another lawful exception permitted by Articles 22 and 23 of that Law. A Client SOW may impose additional location or transfer controls.

We retain personal data only for as long as reasonably required for the purpose collected, an active enquiry or service, security and continuity, applicable contract, legal or regulatory recordkeeping, billing, limitation periods, dispute preservation, or a lawful instruction. Retention depends on the data, relationship, risk, and applicable law rather than one universal period.

When data is no longer required, we delete, anonymize, or securely isolate it, subject to lawful backups, technical constraints, legal holds, and Client-controlled systems. Cookie-specific durations are listed in the Cookie Policy.

We use administrative, technical, and organizational measures proportionate to the data and service, which may include role-based access, authentication, encryption in transit, logging, environment separation, secure development, vendor controls, backup, monitoring, incident response, and data-minimization measures. No internet or software system can be guaranteed completely secure.

If we confirm an incident materially affecting personal data, we will investigate, contain, document, and give legally required notifications to the relevant party, authority, or affected person without undue delay.

Subject to applicable law and its exceptions, you may request information about processing and sharing; access or a copy of your data; correction of inaccurate data; deletion; restriction or suspension of processing; portability where legally available and technically feasible; withdrawal of consent; objection to direct marketing or certain automated processing; and human review of a qualifying automated decision.

Send a request to support@labarna.ai. Describe the request and the Labarna interaction involved. We may verify your identity and authority, ask for clarification, preserve data we must lawfully retain, or decline a request where an applicable exception permits. Authorized agents must show valid authority.

If you believe processing violates applicable UAE data-protection law, you may contact us first and may submit a complaint to the competent UAE Data Office or other competent authority where the law permits.

Labarna is designed for organizations and adult business users. The public website and RAI interface are not directed to children and should not be used to submit children's personal data. If you believe a child has provided personal data without valid authorization, contact us so we can assess and take appropriate action.

We may update this Policy for legal, security, operational, or product changes. The effective date will change when a revision becomes effective. If a change materially affects how we use data or requires new consent, we will provide an appropriate notice or consent request.