Privacy Policy

EXO NODES is operated by EXO LOGICS LLC, a company based in Sharjah, United Arab Emirates (“EXO LOGICS”, “we”, “us”, “our”). EXO NODES is multi-tenant cloud business software that includes point of sale, back office, accounting, inventory and AI assistants.

This policy explains how we handle personal data when you visit our website, contact us, or use EXO NODES. It is written with reference to UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the “PDPL”). If you are located elsewhere in the GCC or beyond, local data protection laws (for example, the Personal Data Protection Law of the Kingdom of Saudi Arabia) may also apply to you, and we will honour the rights those laws give you.

We handle personal data in two different capacities.

• As controller. For our website, our sales and support conversations, and the account and billing information of the businesses that subscribe to EXO NODES, we decide why and how the data is used, so we are responsible for it as controller.
• As processor. When a business (our “customer”) uses EXO NODES to run its operations, the data it enters or generates — for example its own customers, employees, suppliers, sales, invoices and stock — belongs to that business. We process that data on the customer’s behalf and on its instructions, under our Terms of Service and any data processing terms agreed with the customer.

If you are, for example, a diner, shopper or employee of a business that uses EXO NODES, that business is the controller of your data. Please direct requests about that data to the business first; we will assist it in responding.

Website visitors

• Information you give us through forms, chat or email — such as your name, business name, email address, phone or WhatsApp number, country, and the content of your message or request.
• Usage and device information — such as pages visited, referring page, approximate location derived from IP address, browser and device type. Where analytics is enabled, this is collected through Google Analytics using cookies (see Cookies and similar technologies).
• Campaign information — if you arrive from an advertisement or link, the campaign parameters in that link, so we can understand which channels bring enquiries.

Customers and users of EXO NODES

• Account data — names, email addresses, phone numbers, roles and login credentials of the people who use the platform. Passwords and PINs are stored only in hashed form.
• Business and billing data — legal name, trade licence and tax registration details (such as a TRN), addresses, subscription plan and payment records.
• Customer content — the data a business processes through EXO NODES, including transactions, invoices, products, stock, and records about its own customers, staff and suppliers. We process this as processor (see section 2).
• Usage, security and audit data — sign-in events, device and terminal identifiers, IP addresses, actions taken in the platform, and audit-trail records of changes to financial and other regulated records.
• Support data — the content of support requests and our replies.

We use personal data for the following purposes:

• To provide EXO NODES — creating and securing accounts, running the features a customer uses, and providing support. Basis: performance of our contract with the customer, and the customer’s instructions for data we process on its behalf.
• To bill and administer subscriptions. Basis: performance of contract and compliance with legal obligations.
• To meet legal and regulatory obligations — for example tax, e-invoicing, accounting and record-keeping requirements, and responding to lawful requests from authorities. Basis: legal obligation.
• To keep the platform secure — detecting and preventing fraud, abuse and unauthorised access, and maintaining audit trails. Basis: legal obligation and our legitimate interest in protecting our customers and our service.
• To respond to enquiries and send information you asked for, such as a demo, brochure or quotation. Basis: your request and, where required, your consent.
• To improve our website and service, including through website analytics. Basis: your consent where the law requires it, otherwise our legitimate interest.
• To send marketing communications. Basis: your consent, which you can withdraw at any time using the unsubscribe option in the message or by contacting us.

We do not sell personal data, and we do not use customer content for advertising.

EXO NODES includes AI assistants that help with tasks such as drafting documents, reading supplier bills and answering questions about a business’s own records. To provide these features:

• AI features process customer data, including personal data within it, only to provide the service the customer has requested.
• We may use third-party AI model providers to run these features. They act as our processors and receive only the data needed to complete the request.
• AI usage is metered and subject to usage caps, so it cannot run beyond the limits set for the account.
• AI assistants propose actions; actions that change a business’s records require approval by an authorised person before they take effect.
• We do not use your business data to train third-party foundation models.

We share personal data only where needed for the purposes above, with:

• Service providers acting as our processors, under contracts that require them to protect the data and use it only on our instructions. These include providers of cloud hosting and infrastructure, email delivery, payment processing, AI models, and website analytics.
• Integrations a customer chooses to connect, such as a payment terminal, accounting system or messaging channel. The customer decides to enable these, and the third party’s own terms and privacy policy apply to it.
• Authorities and regulators, where we are required by law — for example, tax and e-invoicing submissions a customer instructs us to make, or a lawful order.
• Professional advisers and successors — our lawyers, auditors and insurers under confidentiality, and any buyer or successor in a merger, acquisition or reorganisation, subject to this policy.

You can ask us for the current list of the processors we use by contacting us (see section 14).

Some of our service providers may process data outside the United Arab Emirates. Where personal data is transferred across borders, we take steps required by applicable law to protect it — for example, transferring to jurisdictions with an adequate level of protection or relying on contractual safeguards with the recipient — and we limit the data transferred to what is necessary.

We keep personal data only for as long as we need it for the purposes described in this policy:

• Enquiries and marketing contacts are kept while we are in contact with you, and deleted or anonymised when they are no longer needed or you ask us to stop.
• Account and customer content is kept for the duration of the subscription and for a limited period afterwards to allow data export, then deleted, except as set out below.
• Tax, accounting and audit records — such as invoices, payments and the audit trail of changes to them — are retained for the periods required by applicable tax and commercial law, even if an account is closed or erasure is requested. Where we must keep such a record but no longer need the personal details in it, we may anonymise those details instead of deleting the record.

We use technical and organisational measures designed to protect personal data, including:

• encryption of data in transit;
• logical separation of each customer’s data, and role-based access controls within each account;
• hashed storage of passwords and PINs;
• audit trails that record changes to financial and other regulated records;
• restricting staff access to personal data to those who need it.

No system connected to the internet can be guaranteed to be completely secure. If we become aware of a personal data breach that affects you, we will notify you and the relevant authorities as required by law.

Subject to the conditions and exceptions in applicable law, you have the right to:

• access the personal data we hold about you;
• have inaccurate or incomplete data corrected;
• have your data deleted, subject to records we must keep by law (see section 8);
• object to, or ask us to restrict, certain processing;
• receive your data in a structured, commonly used format, or have it transferred to another provider (portability);
• withdraw your consent at any time, where we rely on consent — this does not affect processing that took place before you withdrew it.

To exercise a right, contact us using the details in section 14. We may need to verify your identity before acting on a request. If your request concerns data a business processes using EXO NODES, we will refer it to that business or help it respond.

If you are not satisfied with our response, you may lodge a complaint with the data protection authority in your jurisdiction — in the UAE, the UAE Data Office.

EXO NODES is a business service and our website is intended for business users. We do not knowingly collect personal data from children through our website. If you believe a child has provided us with personal data, please contact us and we will delete it. Data about individuals that a business processes using EXO NODES is the responsibility of that business as controller.

Our website uses:

• Essential storage — needed for the site to work and to remember preferences you set, such as your country and light or dark display.
• Campaign attribution — when you arrive from a campaign link, the campaign parameters are kept in your browser’s storage so that an enquiry you submit later can be attributed to it.
• Analytics cookies — when enabled, Google Analytics sets cookies to help us understand how visitors use the site. IP anonymisation is requested.

We do not use advertising cookies on our website. You can block or delete cookies and site data through your browser settings; the site will continue to work, although some preferences may not be remembered. The EXO NODES application uses the storage it needs to keep you signed in and secure.

We may update this policy from time to time. The “Last updated” date at the top shows when it was last changed. If we make material changes, we will take reasonable steps to let customers know, for example by email or a notice in the platform.

For privacy questions or to exercise your rights, contact:

• EXO LOGICS LLC, United Arab Emirates
• Email: enquiry@exologics.com
• Phone: +971 50 262 3267
• WhatsApp: +971 50 800 2905

Please include “Privacy” in the subject of your message so it reaches the right person.