Data processing

For account, billing and website data, AIRINDUCT TECH - FZCO (92951, Dtec, Dubai Silicon Oasis, Dubai, United Arab Emirates) acts as controller, as described in our privacy policy.

Where an organisation (for example a university or company) gives its people access to AirInduct Sim and decides how their data is used, we act as that organisation’s processor and process the data only on its documented instructions.

• Account data: name, email, organisation, hashed password.
• Customer content: simulation inputs, results and exports. Treated as confidential and never sold or used for advertising.
• Billing data: plan, invoices and payment status (card details stay with Stripe).
• Technical data: IP address, device and browser information, and server logs.

• Providing and supporting the service.
• Billing and keeping legally required records.
• Security, abuse prevention and fixing faults.
• Improving the service using aggregated, de-identified information.

• Railway: application hosting and database (United States / EU).
• Stripe: payment processing and billing (United States / EU).
• Resend: transactional email (sign-in, verification, receipts) (United States).
• Calendly: booking consultation calls (United States).

The in-app AI assistant will use a third-party AI model provider, which we will add to the sub-processors listbefore the assistant is generally available. Organisations with a data processing agreement get 30 days’ notice of new sub-processors and can object.

We are based in the United Arab Emirates, and our sub-processors may process data in the United States and the European Union. We use contractual safeguards for these transfers, in line with UAE Federal Decree-Law No. 45 of 2021 and, where it applies, the GDPR (Standard Contractual Clauses).

• Encryption in transit (HTTPS) for all traffic.
• Passwords stored only as hashes.
• Access to production data limited to staff who need it.
• Backups, and deletion from them within 90 days of account deletion.

We will notify affected customers without undue delay if we become aware of a personal data breach that affects them.

We keep data while an account is active. After an account is deleted, we remove it from live systems within 30 days and from backups within 90 days, except records we must keep under UAE tax and commercial law. Organisations can ask us to delete or return their data at the end of their agreement.

Organisations that need a data processing agreement, a security questionnaire or more detail can contact info@airinductsim.com. Individuals can exercise their rights through the same address, as set out in our privacy policy.