This Privacy Policy explains how Surfbase Tech L.L.C-FZ, Meydan Free Zone, Dubai, United Arab Emirates (“OryxGate”, “we”) processes personal data in connection with our website, dashboard and AI gateway (the “Services”). It is designed to meet the requirements of the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (“PDPL”) and, where applicable, the EU and UK General Data Protection Regulation (“GDPR”). Organizations based in the DIFC should also refer to our Data Processing Addendum, which addresses DIFC Data Protection Law No. 5 of 2020.
1. Our roles
- Controller for account, billing, security and website data described in section 2(a)–(c).
- Processor on behalf of our customers for personal data contained in prompts and other content they send through the gateway (“Customer Content”). Our customers decide what they submit; requests about that data should be directed to the customer concerned.
2. Data we process
- (a) Account data: name, business email, company, role, hashed password, organization settings.
- (b) Billing data: company legal name, address, tax registration number, invoice and payment records. Card details are collected and processed by Stripe; we never see or store full card numbers.
- (b2) Provider credentials (BYOK): API keys or AWS credentials you connect for your own model-provider accounts, encrypted with AES-256-GCM, never displayed again, never logged, and used only to submit your organization's requests.
- (c) Technical and usage data: API key identifiers (we store only a hash of each key), request metadata (time, model, route and region, token counts, cost, latency, status, number of redactions), IP addresses in security logs, and essential cookies.
- (d) Customer Content: relayed in memory to the selected Model Provider and back. We do not store prompt or completion content in our databases or logs.
3. Purposes and legal bases
- Providing and securing the Services, authentication and fraud prevention: performance of contract; legitimate interests.
- Billing, invoicing, tax and accounting records: performance of contract; legal obligation.
- Spend alerts and service communications: performance of contract.
- Improving reliability and capacity planning using aggregated metadata: legitimate interests.
- Marketing emails to business contacts: consent or legitimate interests, with an opt-out in every message.
We do not sell personal data and we do not use Customer Content to train models.
4. Sub-processors and recipients
- Amazon Web Services: hosting and Amazon Bedrock model inference (regions selected per API key, e.g. me-central-1 UAE, eu-central-1 Germany).
- Anthropic and OpenAI: model inference on the Managed Enterprise Cloud where routing settings permit.
- Your own Model Provider accounts (BYOK): when you connect them, requests are sent to your accounts, and the provider processes the content as your processor under your agreement with it.
- Stripe: card payments and subscription billing.
- Email delivery and infrastructure providers under written data-processing terms.
Each Model Provider processes Customer Content under its own commercial and data-handling terms for API customers.
5. International transfers
Depending on the route selected, Customer Content may be processed outside the UAE or the EU (for example, where AWS serves a model through its global inference endpoint, or where a request fails over to a direct provider API). Customers can restrict this with strict residency mode. Transfers are made under the PDPL’s transfer provisions and, for GDPR data, Standard Contractual Clauses or another valid mechanism.
6. Retention
- Customer Content: not retained by OryxGate beyond the lifetime of the request.
- Request metadata: up to 24 months for billing analytics and dispute resolution.
- Financial ledger, invoices and tax records: as required by UAE law (generally at least 5 years).
- Account data: for the life of the account and up to 12 months after closure, unless a longer period is required by law.
- Provider credentials: until you remove them or close your account; deleted immediately on removal.
7. Security
TLS encryption in transit, hashed API keys and passwords, least-privilege access, client-identifying network headers stripped before forwarding, optional secret redaction, an append-only financial ledger and audit logging of administrative actions.
8. Your rights
Subject to applicable law, you may request access to, correction, deletion, restriction or portability of your personal data, object to processing, and withdraw consent. Contact support@oryxgate.ai. We respond within the time limits required by law. You may lodge a complaint with the UAE Data Office, the DIFC Commissioner of Data Protection, or your local EU/UK supervisory authority.
9. Cookies
We use only essential cookies: session authentication, organization selection and display-currency preference. No advertising or cross-site tracking cookies are used.
10. Changes
We will post updates on this page and notify account owners of material changes.