Privacy policy

1. Who we are

The controller of your personal data is H.H.A Advisory (operator of BADEE). The technology behind BADEE is built and run by BRev Digital for H.H.A Advisory.

Registered legal name: TODO registered legal name from the trade licence
Address: TODO registered office address
Trade licence: TODO licence number and issuing authority
Privacy contact: TODO contact email not set yet

We apply the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the PDPL). TODO confirm the company is licensed onshore. A DIFC or ADGM licence means a different data-protection law applies and this section must change.

2. What we collect

BADEE is not sold to the public. The BADEE team sets up each business and its logins; there is no sign-up.

Data	Whose	What it is
Login details	Staff of a client business, and the BADEE team	Name, job title, email address and role. Your password is stored only as a hash by our sign-in provider.
Brand manual	The client business	Logo, colours, fonts, tone of voice, brand key, target audiences and proof points.
Image, Video and Audio Banks	Anyone the business chooses to show or record	Photos, videos and audio files the business or the BADEE team uploads. They may show a person's face or carry their voice.
Campaign briefs	The client business	Objectives, audience description, look and feel, chosen messages and formats.
AI suggestions and their log	The client business	The copy and layouts the AI suggested, and a record of each AI request (which model, success or error, size of the request).
Approved posts and schedule	The client business	The final images, captions and hashtags the client approved, the dates they are scheduled for, and the exported files.
Results	The client business	Numbers the business types in, such as bookings. These are counts, not customer records.
Edit requests	The client business	What the client asked the BADEE team to change in a photo or video.
Technical data	Anyone using BADEE	A sign-in session cookie, and the IP address and request logs our hosting providers keep to run and secure the service.

We do not use advertising trackers or analytics cookies. We do not buy personal data, and we do not sell or rent it to anyone.

3. Why we use it, and on what basis

To provide BADEE to the business that subscribed. This covers setting up the brand, running the campaign brief, suggesting copy, composing visuals, scheduling approved posts and showing results. The basis is our contract with that business.
To let staff sign in and keep each business's data separate. The basis is the same contract, and keeping the service secure.
To meet legal duties, such as keeping records the law requires or answering a lawful request from an authority.
Where we ask for it, your consent. You can withdraw consent at any time. Withdrawing does not undo what was done before.

People shown or heard in a business's files. The business decides which photos, videos and recordings it gives us and is responsible for having the consent of every person in them, including for use in social media posts. We use those files only to make that business's campaigns.

4. How BADEE uses AI

BADEE uses Anthropic's Claude models to suggest key messages, headlines, captions, hashtags and key-visual layouts. For each suggestion we send Anthropic the business's brand-manual text and campaign brief. When it suggests key visuals, we also send up to six photos the client chose for that campaign.

We do not send video or audio files to the AI.
The AI only suggests. A person at the business chooses, edits and approves everything before it is scheduled.
Anthropic's published policy is to delete API inputs and outputs within 30 days, with exceptions such as legal requirements and enforcement of its usage policy (Anthropic privacy centre, read 12 October 2026).
TODO confirm the Anthropic commercial terms and data processing addendum that cover BADEE's account, including whether inputs may be used for training.

BADEE does not make decisions about people by automated means. It does not use AI to create images of real people.

5. Who we share it with, and transfers outside the UAE

We use these service providers to run BADEE. Each one processes data only to provide its service to us.

Provider	What it does	Where
Supabase	Database, sign-in and file storage (brand manuals, photos, video, audio, approved posts).	India (Mumbai region)
Anthropic	Writes copy suggestions. Receives brief text, brand-manual text and selected photos for a single request.	United States
Vercel	Hosts and runs the BADEE web app.	TODO Vercel region
Google Fonts	Serves the typefaces the pages use. Your browser requests them directly, which shares your IP address with Google.	Google's global network

This means your data is stored and processed outside the UAE, in India and in the United States, and possibly in other countries where these providers operate. The PDPL allows this where the destination gives adequate protection, under a contract that protects the data, or with your explicit consent. TODO confirm which safeguard applies to each provider (data processing agreements with Supabase, Vercel and Anthropic).

We may also disclose data where the law requires it, or to a buyer of the business if BADEE is sold, under the same protections.

7. How long we keep it

Logins: while the person has access. When the business asks us to remove a login, we delete it.
Brand manual, banks, briefs, approved posts and results: for as long as the business uses BADEE. TODO set how long after the subscription ends this is deleted (a proposed default is 90 days).
Files in the banks: a business can ask us to remove any file at any time. Clients cannot delete files themselves, because a file may already be in a scheduled campaign.
AI request log: kept with the campaign it belongs to and deleted with it. Anthropic's own retention is described in section 4.
Backups: TODO confirm the Supabase backup retention on BADEE's plan. Deleted data leaves backups only when they expire.

8. Your rights

Under the PDPL you can ask us to:

tell you what personal data we hold about you and give you a copy;
correct data that is wrong or incomplete;
delete your data (see how to request deletion);
restrict or stop processing, or object to it;
withdraw consent you gave.

Write to TODO contact email not set yet. We may need to confirm who you are first. If your data is in a business's files (for example a photo of you), we will tell that business and work with them on your request. You can also complain to the UAE Data Office.

9. Children and health information

BADEE is a tool for businesses and is not meant for anyone under 18. We do not knowingly collect children's data from children. A business may upload photos that show a child, such as a teenage orthodontic patient. It must have the consent of a parent or guardian before doing so.

Photos from a clinic can reveal health information, such as a treatment result. Businesses must have the person's explicit consent before uploading such photos, and must not put patient names, records or other health details into a brief.

10. Security and cookies

Each business can see only its own data. This is enforced in the database, not just in the app.
Files are stored privately and opened through links that expire after an hour.
Data travels encrypted (HTTPS).
BADEE sets only the cookies needed to keep you signed in. It sets no advertising or analytics cookies.

If a breach puts your data at risk, we will tell the affected businesses and the authorities as the law requires.

11. Changes and contact

When this policy changes we will update the date at the top. If a change is significant, such as connecting social media accounts, we will tell the businesses that use BADEE before it takes effect.

Questions or requests: TODO contact email not set yet.

How BADEE handles your data