Privacy Policy

1. Who we are

RoundBorders LLC is a company registered in the United Arab Emirates, at Al Messaned, Al Mutsannid Suburb, Sharjah 500001. We are the controller of the personal information described in this policy, which means we decide how and why it is used.

This policy does not cover personal information stored on the websites we work on for our clients. Section 10 explains how we handle that information.

2. Information we collect

Information you give us

• Contact details: your name and email address, when you contact us, describe a project or create an account.
• Project information: the description of what you need, your website address, the urgency and budget you choose, the files you upload, the messages you send in your project or by email, and any feedback, rating or reason for cancelling that you give us.
• Access details: logins to your website, hosting or other systems, when you share them so that we can do the work.
• Profile information: your name and, if you add one, a profile picture.
• Referral information: if you introduce a client to us, your name and email address, and your client's name, email address and what they need. By introducing a client, you confirm that they know you are doing so.
• Partner information: if you work with us as a partner, the details we need to pay a reward to you or to a charity you choose.

Information we receive from others

• Google: if you choose to sign in with Google, Google shares your basic profile information with us, including your name and email address.
• Stripe: when you pay, Stripe tells us whether the payment succeeded, the amount, and the references of the payment, invoice and receipt. We never receive your full card number or security code.
• Partners: if someone introduces you to us, or if an agency hires us to work on your website, we receive your details from them.

Information collected automatically

• Technical information: when you send a form on our website, your IP address and the approximate location derived from it (city, region and country). When you sign in or post a message in the client portal, your IP address and browser type, and the time zone your browser reports. Our hosting providers also keep standard server logs (IP address, browser and pages requested) for security and to keep the Sites running.
• What you type in the box where you describe what you need: as you type, and before you send anything, the text is analysed to suggest the right service and a few questions. Section 3 explains how.
• Website checks: if you use our free site check, the address of the website you check, the publicly available information we fetch from it, and your email address if you ask for the report by email.
• Usage information: the pages you view and how you arrived at the Sites, collected through analytics and advertising cookies if you agree to them. If you do not agree, Google's tags still send Google limited information without cookies. Our Cookie Policy explains both.

3. How we use your information

We use personal information for the purposes below. Where the law requires a legal basis for using it, the basis for each purpose is shown.

If we want to use your information for a new purpose that is not compatible with these, we will tell you first and, where the law requires it, ask for your consent.

We do not send newsletters or marketing emails. The emails we send are about your enquiries, your account, your projects and your payments.

Suggestions from what you type

When you type in the box where you describe what you need, the text (up to 600 characters) may be sent, before you send your request, to an AI model run by Cloudflare on our behalf. The model suggests the service that fits, a few questions that help us price the work, and a short title. The suggestions do not decide anything about you, and we review every request ourselves before we reply. Cloudflare states that it does not use this text to train its models. We keep a log of these requests at Cloudflare to check that the suggestions work well (see section 6).

We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects for you.

4. How we share your information

We do not sell your personal information. We share it only as described below.

Service providers

We use the following providers, or categories of providers, to run the Sites and our services. Most of them process personal information only on our behalf and on our instructions. Where a provider also uses it for its own purposes, as Stripe, Google and Automattic do, its own privacy policy applies to that use.

• Cloudflare, Inc.: hosting and delivery of our website, protection of our forms and sign-in, the AI model described in section 3, and storage of the files you upload.
• Stripe: processing payments, invoices and subscriptions, and providing the billing portal. Stripe also uses some payment information as an independent controller, for example to prevent fraud, as described in Stripe's Privacy Policy.
• Google: analytics and advert measurement (see our Cookie Policy), sign-in with Google, whose button and prompt load on the client portal's sign-in pages, and speed and safety checks of the websites checked with our free site check. See Google's Privacy Policy.
• Gravatar, a service of Automattic: for accounts without an uploaded profile picture, a coded form (hash) of your email address is sent to Gravatar to show the picture linked to it, if there is one. See Automattic's Privacy Policy.
• Our hosting provider for the client portal, which stores your account, projects and messages.
• Our email delivery provider, which sends and receives the emails of the Sites, including sign-in codes, notifications and the replies you send by email.
• Content delivery networks that serve parts of our pages, such as icons, which receive your IP address when a page loads.
• Our email and office software providers, so that we can read and answer the emails you send us.

Partners

• If a partner introduced you to us, we tell them how your project is progressing (for example, that an estimate was sent or approved), at the level of detail they chose, and the amounts you paid us, which we use to calculate their reward. You can ask us at any time to stop sharing progress with them.
• If an agency hired us to work on your website under its own name, we share our work and the information about your project with that agency.

Legal requirements and advisers

We may disclose personal information where the law, a regulation, a court order or other legal process requires it; to enforce our agreements; or to protect the rights, property or safety of RoundBorders, our clients or others. We may also share it with our professional advisers, such as lawyers and accountants, who are bound by duties of confidentiality.

Business transfers

If RoundBorders is merged, acquired or sells all or part of its business, personal information may be transferred to the new owner, which will be bound by this policy for the information it receives.

5. International transfers

We are based in the United Arab Emirates, and several of our service providers are based in, or process information in, other countries, including the United States. When we transfer personal information to another country, we take the steps required by the data protection laws that apply, such as relying on standard contractual clauses or equivalent safeguards offered by the provider.

6. How long we keep your information

• Your account, projects, messages and files: for as long as your account is open, so that you can return to past work. When your account is deleted, we delete them, except the records described below.
• Payment records and invoices: for as long as tax and accounting laws require, currently seven years in the United Arab Emirates.
• Requests you do not confirm: a request sent from the box where you describe what you need, and any files attached to it, is deleted within about two days if it is never confirmed with the code we email to you.
• Sign-in records: the email address and IP address used for a sign-in code are deleted within about two days after the code is used or expires.
• Text sent for suggestions: kept in Cloudflare's log for up to 30 days, and the suggestions made from it for up to a day.
• Emails sent through the forms on our website: for as long as we need them to deal with your enquiry and any work that follows.
• Analytics data: for the retention period set in our Google Analytics account, which is no longer than 14 months.
• Partner records: for as long as the partnership lasts, and afterwards for as long as we need them to pay rewards, keep business records and honour our agreements.

When we no longer need personal information, we delete it or make it anonymous. Copies may remain in backups and caches for a limited time before they are removed. We may keep anonymous or aggregated information that does not identify you.

7. Your rights

Depending on where you live, you may have the right to:

• ask for a copy of the personal information we hold about you;
• ask us to correct information that is wrong or incomplete;
• ask us to delete your personal information;
• ask us to restrict how we use it, or object to our use of it, including where we rely on our legitimate interests;
• receive the information you gave us in a structured, commonly used format, or ask us to send it to another organisation; and
• withdraw your consent at any time, where we rely on it. This does not affect anything we did before you withdrew it.

You can delete your account yourself from the Profile page when you are signed in. We email you a code to confirm it, and the account is deleted seven days later unless you cancel before then.

To make any other request, including a request to correct your information, email us at [email protected]. We may need to confirm your identity before we act on a request, and we respond within 30 days.

You also have the right to complain to a data protection authority, in particular in the country where you live or work. We would appreciate the chance to deal with your concern first, so please contact us.

8. Cookies

We use cookies and similar technologies on the Sites. Analytics and advertising cookies are used only if you agree to them. Our Cookie Policy lists the cookies we use and explains how to change your choice.

9. Security

We use appropriate technical and organisational measures to protect personal information, including encrypted connections, sign-in with one-time codes, restricting access to client information to our team, and protection of our forms against spam and abuse. Files you upload are stored at unlisted addresses that cannot be guessed; anyone who has a file's address can open it, so share those addresses with care.

We treat the website and hosting logins you share with us as confidential and use them only for the work you ask for. Please do not paste logins into project messages, because messages are also sent by email to everyone following the project; we will tell you how to share them securely. As our Terms of Service require, logins shared with us should be changed or removed when the work is done.

No method of transmitting or storing information is completely secure, so we cannot guarantee absolute security. If a breach affects your personal information, we will notify you and the relevant authorities where the law requires us to.

10. Information on websites we work on

When we work on your website, we may have access to personal information stored on it, such as your customers' orders or your users' accounts. We process that information only on your instructions and only to do the work you ask for, and we do not use it for any other purpose. You remain responsible for that information as its controller.

If you need a data processing agreement with us, for example because the data protection law of the European Union or the United Kingdom applies to your website, please contact us.

11. Children

Our services are intended for adults and businesses. They are not directed at anyone under 18, and we do not knowingly collect personal information from children. If you believe a child has given us personal information, please contact us and we will delete it.

12. Links to other websites

The Sites contain links to websites we do not operate. This policy does not cover those websites, and we are not responsible for their content or their privacy practices. We recommend that you read the privacy policy of every website you visit.

13. Changes to this policy

We may update this policy from time to time. The date at the top of this page shows when it was last updated. If we make a significant change, we will tell account holders by email before it takes effect.

14. Contact us

If you have any questions about this policy or your personal information, or want to exercise your rights, please contact us: