Last updated: 7 November 2026.
This notice explains how Drivix collects and uses personal information when you visit our website, chat with our website assistant, use our free tools, contact us, book a call, apply for a job, join our partner programme, buy from us or use our client portal.
The controller is Drivix FZ-LLC, RAKEZ licence 17004735, FDCW2101, Compass Building, Al Shohada Road, Al Hamra Industrial Zone-FZ, Ras Al Khaimah, United Arab Emirates. It serves visitors and clients in the UAE and worldwide.
Contact for anything in this notice: info@drivix.io.
2. What we collect
WhenWhat
You send a message or fill in a formName, work email, phone, company, website, billing country, what you need, your budget range, your message, and whether you agreed to marketing emails
You send an enquiry or ask for a tool reportAlso: the page you sent it from; the address of the page you came to our site from, kept as its site and path only (for example www.google.com/search), never its query string or the part after #, so search terms and ad click IDs in that address are not kept; the campaign tags in the link you arrived on (utm_source, utm_medium, utm_campaign, utm_term, utm_content); and your browser's user agent (its name, version and operating system). A booking keeps the same address you came from and campaign tags, without the user agent. An enquiry left in the website chat keeps the page you started the chat on, the same address you came from and campaign tags as an enquiry form, and your browser's user agent You chat with Hala, our website assistantThe messages you type, the page you started on, the language you write in, and a random ID kept in your browser so the chat continues if you move to another page. If you choose to leave your details in the chat, we also keep your name, email, phone, company, country and what you need
You use a free tool, such as the website checker, competitor keywords, ads budget, local rank or AI visibility checksWhat you enter (for example a website address, business name, area, keywords or country) and the result. If you ask us to send you the report, or a check needs your details first: your name, email, country and, if you give them, company, website and phone, and whether you agreed to marketing emails, which we keep as an enquiry
You subscribe to the Rank TrackerName, email, company, country, the businesses and keywords you track, the scan results and your subscription details. Card payments are handled by Stripe
You apply for a jobName, email, phone, location, links you share, your cover note, your CV, and our notes, interview records and scorecards about your application. If you accept a job offer online: the name you type, the time and a one-way coded version of your IP address
You apply to our partner (referral) programme, or a partner introduces youPartners: name, email, phone, company, website, country, how you would introduce clients, the bank account details you give for payouts (account name, bank name and IBAN), your commissions and payouts. If you arrive through a partner's link: the page you landed on, the website you came from (its name only, such as google.com) and a one-way coded version of your IP address, to count the click once an hour. If a partner introduces you: the name, email, phone, company, website, country, service and note the partner gives us
You book a callName, email, phone, company and country, the notes you add, the kind of call and the time you chose. The booking is also kept as an enquiry. Your browser shows the times in its own time zone; the time zone is not sent to us
You buy an audit or accept a proposalName, email, company, billing country, whether you buy as a business or individual, VAT or tax number, and the order details. Card payments are handled by Stripe; we never see or store your full card number
You accept a proposal in the client portalAs the record of your acceptance: the name you type, the options you chose, your comment, the time, and the IP address and browser user agent you accepted from, stored as they are (not coded) and printed on the acceptance record (a PDF kept with your account)
You reply to an email our team sent you, or email our reply addressYour email as you sent it: the sender and recipient addresses, the name shown with your address, the subject, the text (an email written in HTML is turned into plain text; the HTML itself is not kept), the message identifiers mail apps use to group replies, whether your address passed the standard sender checks (SPF, DKIM and DMARC), and attachments of safe types (PDF, images, Office documents, CSV and text, up to 10 MB each). Other attachments are not kept; we keep only their names and why they were not kept
You use the client portalYour login email, the people on your team, messages, files, approvals, comments and activity in your account
You visit the websiteTechnical data such as pages viewed, device, browser and approximate location. Analytics and marketing tracking only run if you agree (see section 8)
You arrive from one of our adsOnly if you accept marketing cookies: the ad click ID in the link (Google's gclid, Meta's fbclid) and Meta's browser cookies (_fbc, _fbp), kept with an enquiry form, tool request, booking or chat enquiry you send in the same visit. Without marketing cookies they are not stored
You send an enquiry through one of our ad forms on Google, Facebook or InstagramWhat you entered in the form, which Google or Meta passes to us, the ad and campaign it came from, and, for Facebook and Instagram forms, whether you ticked a box agreeing to marketing
You choose WhatsApp updates, or message us on WhatsAppYour WhatsApp number, the messages we send you (such as confirmations and call reminders) and their delivery status, and the messages you send us. Reply STOP at any time to end updates
Bot protection and abuse limitsCloudflare Turnstile checks that a form or chat is started by a person, not an automated script. To enforce daily limits on forms, chats, bookings and tools we keep a one-way coded version of your IP address, never the address itself. To protect sign-in (wrong passwords, codes and reset emails) we keep one-way coded versions of the email and of your network (the first three parts of an IPv4 address, or the first three groups of an IPv6 address), never the address itself. The one exception where the IP address itself is kept is accepting a proposal (above)
We do not ask for sensitive information such as health details, card numbers or identity document numbers, and we ask you not to send them to us. In the website chat, these are replaced with "[removed]" before the message is saved or sent to the AI service, and in the assistant's replies:
- payment card numbers: 13 to 19 digits (12 for a Maestro card written all together) that pass the card check digit test and start like a card from Visa, Mastercard, American Express, Discover, Diners Club, JCB, UnionPay, Maestro, RuPay or Mir, written all together, in groups of four, as 4-6-5 or 4-6-4, or one digit at a time, with spaces, dots, hyphens, slashes, commas, underscores, brackets or emoji between the groups, in any digits (for example Arabic or Devanagari), and also when written straight after a card word such as "visa", "cardnumber", "mycard" or "cardholder" or before "cvv";
- Emirates ID numbers: 784-YYYY-NNNNNNN-N (or 784-YY-NNNNNNN-N), with or without the separators;
- passport numbers: up to two letters and 6 to 9 digits, or 6 to 9 letters and digits with at least 5 digits, after the word "passport" (or "passeport", "pasaporte", "passaporto", "Reisepass", "جواز" or "PP" in capitals, as in "PP no"): within 80 characters of the word if the number has letters, within 25 characters if it is digits only, and not when a word such as "booking", "ref", "order", "invoice", "budget" or "price" comes in between.
Phone numbers, tax registration numbers and other numbers are not removed: a number starting with + or 00 (up to 15 digits, the longest a phone number can be) is kept whole as a phone number, country code and national number, unless it is a card number as described above that is longer than phone numbers in that country (a card typed after + or 00, or after the country code, is still removed and the country code is kept), and so are local phone numbers, UAE tax registration numbers, IBANs, UK sort codes and bank account numbers, prices and dates. Please do not type anything else you want kept private.
3. Why we use it
PurposeLegal basis (UK and EU)
Replying to your enquiry and arranging callsOur legitimate interest in answering people who contact us, or steps before a contract at your request
Answering your questions in the website chatOur legitimate interest in helping visitors find the right service, or steps before a contract at your request
Running the free tools you ask for and emailing you the reportSteps you ask us to take, and our legitimate interest in offering useful tools
Providing services, the portal, the Rank Tracker, invoices and supportPerforming our contract with you
Considering your job applicationSteps before a possible employment contract at your request, and our legitimate interest in hiring
Running the partner programme: crediting referrals, showing partners their referrals and paying commissionsPerforming our contract with the partner, and our legitimate interest in crediting the partner who introduced a client
Keeping accounting and tax recordsLegal obligation
Keeping the site and portal secure and preventing spam, abuse and fraudLegitimate interests
Sending occasional marketing emailsYour consent, which you can withdraw at any time
Analytics, session analytics and advertising measurement on the websiteYour consent, given in the cookie choices
Telling Google and Meta which of our ads led to an enquiry or a client, and showing our ads to people who agreed to marketing from us (section 4)Your consent: marketing cookies for ad click IDs and Meta's browser cookies; your agreement to marketing for your email and phone in coded form and for the ad audience lists. For enquiries sent through our ad forms on Google or Meta, our legitimate interest in measuring the ads that brought them
Sending WhatsApp updates you asked forYour consent, which you can withdraw by replying STOP
Improving our servicesLegitimate interests
We process personal data in line with the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021), relying on your consent where it is needed and on the other grounds that law allows, such as performing a contract and meeting legal obligations.
We do not sell personal information. We do not make decisions about you based only on automated processing: the AI never decides on an enquiry, a client or a job application. Drafts and summaries the AI writes inside our admin are checked by a person before anything is sent or saved. Two AI texts reach you without a person checking them first: the website assistant's replies (section 5), and the strategy section of the competitor report, which the AI writes only from the figures in that report and which the report labels as written by AI. Both can contain mistakes, so a person at Drivix confirms any detail before you rely on it.
4. Who we share it with
We share personal information only with providers who help us run the business, under contracts that require them to protect it:
ProviderWhat they do
SupabaseDatabase and file storage for the website, the client portal and job applications (including CVs), hosted in its London region
VercelWebsite hosting
StripeCard payments, subscriptions and payment records
ResendSending emails such as confirmations, reports and notifications, and receiving your replies to the emails our team sends you (Resend receives them, then passes them to our platform)
Google (Gemini API), or OpenAIAI processing. We use Google's Gemini API; our settings also let us switch to OpenAI's API instead, and if we do, the same information goes to OpenAI and we will name it here as the provider in use. The AI writes the website assistant's replies from the chat messages, and the strategy section of the competitor report from the report's findings (both shown to you without a person checking them first, see section 3). Inside our admin it drafts replies and summaries for our team from enquiry, client, project and job applicant details (including cover notes and our interview notes, but not CVs), drafts job posts and monthly report commentary, reads receipts and suggests bank categories. A person checks every admin draft before anything is sent or saved
DataForSEOSearch and maps data for the free tools and the Rank Tracker. It receives what you enter in those tools, such as business names, website addresses, keywords, areas and map locations. The AI visibility check asks AI search services questions about your business through DataForSEO
GoogleCalendar and Google Meet for booked calls; PageSpeed Insights for the website checker (it receives the website address you enter); Google Maps Static API for the map behind the local rank grid, in the free local rank check and its report and in the Rank Tracker: your browser loads the map image straight from Google, so Google receives your IP address, your browser's details and the map area (its centre and zoom), but not the page you are on; Google Tag Manager, Analytics and Ads measurement in your browser only with your cookie consent. When our Google Ads account is connected: the enquiries you send through our lead forms on Google; for an enquiry that came from one of our Google ads (a website enquiry keeps the ad click ID only with marketing cookies; an enquiry through our Google lead form carries it from Google), our server tells Google Ads about the enquiry and its later stages (qualified, became a client, with the value), and, only if you agreed to marketing, adds your email and phone in one-way coded (hashed) form so Google can match it; and, once we have accepted Google's Customer Match terms, the same coded email lists as for Meta below
Meta (Facebook, Instagram, WhatsApp)Only when our Meta accounts are connected. The enquiries you send through our ad forms on Facebook or Instagram. Conversions API: for an enquiry that came from one of our Meta ads (through a Meta ad form, or a website visit with marketing cookies accepted), our server tells Meta about the enquiry and its later stages (qualified, became a client, with the value), with the ad click ID and Meta's browser cookies when we have them, your browser's user agent, and, only if you agreed to marketing, your email and phone in one-way coded (hashed) form. Custom Audiences: coded emails of our clients, so our ads are not shown to them, and of lost enquiries and past clients, to show them our ads, only for people who agreed to marketing from us and have not unsubscribed. WhatsApp Business: the messages we send you and you send us on WhatsApp
MicrosoftMicrosoft Clarity session analytics, only with your consent (see section 8)
Partners in our referral programmeIf you came to us through a partner's link or a partner introduced you, that partner sees, in their private partner page, your company name (or your name if you gave no company), when you were referred and whether you are in progress, became a client or a paying client, or are not going ahead; and, once you are a paying client, your client name and the invoice amounts their commission was worked out from. Partners never see your contact details or messages
CloudflareTurnstile bot protection on forms and the website chat
ZohoZoho Books, for invoices and accounting records
We may also share information if the law requires it, or to protect our rights in a legal dispute. If we start using another provider for personal information, we will update this notice first.
5. AI and the website assistant
Hala, the assistant on our website, is an AI system, not a person. It answers only from our own website content and prices, and it can make mistakes, so our team confirms any detail before you rely on it. Your chat messages, and the earlier messages in the same chat, are sent to the AI service to write each reply: Google's Gemini API, or OpenAI's API if we switch provider (section 4). The chat does not save your contact details unless you choose to leave them and tick the box. Please do not type card, bank or identity document numbers into the chat.
6. International transfers
Our main database is in London, United Kingdom, and some providers, including Google, Meta, Microsoft, OpenAI (if we switch to it) and DataForSEO, process data in other countries, including the United States.
- From the UK, we transfer data only where an adequacy decision applies or with safeguards approved under UK law, such as the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.
- From the UAE, we transfer data in line with the cross-border rules of the UAE Personal Data Protection Law, including contractual safeguards.
7. How long we keep it
InformationHow long
Enquiries that do not become clients24 months after our last contact, then deleted automatically
A business introduced to us by a partner, or an enquiry through a partner's linkThe partner's record of it (the name and company as typed) is deleted with the enquiry; the email typed is kept only until the enquiry is credited to the partner, and a record that is never credited is deleted after 24 months
Website chat messages24 months after the last message in the chat, then deleted automatically
Email conversations with our team (the emails we send you from our platform, your replies and their attachments)Kept with the enquiry or client record they belong to and deleted with it. For an enquiry that does not become a client, that is 24 months after our last contact (a reply from you counts as contact)
Emails to our reply address that we cannot match to an enquiry or client90 days after they arrive, then deleted automatically, unless we add them to the right record first
Free tool reports and the record of each check24 months after the check, then deleted automatically. The private report link stops working after 180 days
Saved tool results kept to avoid running the same paid check twiceDeleted automatically within a day of expiring
Job applications and CVs, if you are not hired12 months after the last activity on your application, then your CV is deleted and your name, contact details, cover note and our notes are removed automatically. While the role is still open and your application is in progress, we keep it until the process ends
Client records, contracts and invoicesAs long as tax and accounting laws require, currently 5 years in the UAE, then deleted
Client portal content after a contract endsRead-only for 12 months, then deleted unless we must keep it by law
Marketing consent recordsUntil you withdraw consent, plus 2 years to show we had it
Cookie choice6 months, then we ask again
Sign-in attempts (the coded email and network)30 days, then deleted automatically
8. Cookies
We use essential cookies to run the site and the portal. Analytics and marketing cookies load only after you agree: Google Tag Manager loads only after you accept analytics or marketing cookies, and the tags inside it, including Google Analytics, Google Ads measurement and Microsoft Clarity session analytics, load through it. Microsoft Clarity records how visitors use our pages, for example clicks and scrolling, to help us improve the site. Nothing used to measure our website or ads is kept in your browser before you choose: conversion events waiting to be sent and campaign tags are kept only after you accept analytics or marketing cookies, and ad click IDs only after you accept marketing cookies. Choosing "Essential only" deletes them. You can change your choice at any time from Cookie settings at the bottom of every page. Details, with every cookie and browser storage item we use, are in our cookie policy.
9. Your rights
Depending on where you are, you have the right to:
- ask for a copy of your information;
- ask us to correct it;
- ask us to delete it;
- ask us to limit or stop using it;
- object to how we use it, including stopping direct marketing at any time;
- receive it in a portable format;
- withdraw consent where we rely on it; and
- complain to a regulator.
To use any of these rights, email info@drivix.io. We reply within one month. We may need to confirm your identity first.
Complaints. We would like the chance to fix things first. You can also complain to the UAE Data Office, or to the data protection regulator where you live.
10. Keeping it safe
We use encryption in transit, access controls so each client sees only its own account, private file storage with time-limited links, and login protection, with two-step verification available for our team accounts. Only people who need information for their work can access it.
11. Children
Our website and services are for businesses and adults. We do not knowingly collect information from anyone under 18.
12. Changes
We will update this notice when our practices change and show the date at the top. If a change is significant, we will tell clients by email or in the portal.
