1. Who is responsible for your data

EYO Consulting LLC-FZ trading as OpenEng of 6th Floor Meydan Grandstand, Meydan Road, Nad Al Sheba, Dubai, UAE is the controller / responsible party for personal data processed through OpenEngReview. Privacy contact: info@openeng.co. In South Africa our Information Officer is Duncan Pascoe (info@openeng.co) (registered with the Information Regulator).

2. What we collect

• Account data: your name, email address, and the identifier from your Google or Microsoft sign-in.
• Submissions: the files you upload and the metadata you add (governing code, project reference, discipline/structure type, description).
• Review data: the findings, completeness results, status changes, and any comments/feedback you submit.
• Consent records: the time you accepted the Terms, the version accepted, your identifier, your IP address and browser, and whether you opted in to improvement use — kept as proof of consent.
• Technical data: log, device and usage data needed to run and secure the service.

3. How we use your data and our lawful basis

Under the UAE PDPL, POPIA and the GDPR you can withdraw consent at any time; withdrawing does not affect processing already carried out.

• To provide the service, store your reviews, and manage your account — performance of our contract with you.
• To run the AI review on your uploaded document — performance of our contract / your explicit consent.
• To improve the tool using a de-identified version of uploaded content — ONLY with your separate, optional consent, which you can decline or withdraw without losing access to the core service.
• To keep the service secure, prevent misuse, and meet legal obligations — our legitimate interests and legal obligations.

4. Using uploads to improve the tool (optional)

Improvement use is optional and off by default. You confirm at upload that your file contains no confidential, personal or export-controlled information. Only where you tick the optional box do we use a de-identified version of uploaded content (and your feedback) to improve the tool. You can withdraw this at any time by contacting info@openeng.co; declining never affects your access to reviews.

5. Who we share data with (processors)

We do not sell your data. We share it only with service providers who process it on our behalf under data-processing agreements:

• Hosting & database: Vercel (application hosting) and Supabase (database, file storage and authentication; data hosted in the EU — Ireland).
• AI review: Anthropic (the Claude API), which processes the document solely to generate the advisory review. Anthropic does not use your API submissions to train its models.
• Payments: Stripe (subscriptions and credit purchases).
• Sign-in: Google and/or Microsoft, when you choose to sign in with them.

6. International data transfers

Your data is hosted in the EU (Ireland) and the AI review provider may process data in the United States. Where data is transferred across borders we rely on an appropriate safeguard — adequacy, standard contractual clauses, or your consent — as required by the GDPR, the UAE PDPL and POPIA.

7. How long we keep your data

We keep your account, uploads and reviews while your account is active and for 12 months after your last activity, unless you ask us to delete them sooner or we must keep them longer to meet a legal obligation. When you request deletion, files and records are removed from active systems within 30 days and purged from encrypted backups within 90 days, after which they cannot be recovered.

8. How we protect your data

No system is perfectly secure; if a data breach occurs that is likely to harm you, we will notify you and the relevant regulator as required by law.

• Encryption in transit, and storage in a private bucket that is not publicly accessible.
• Per-user isolation enforced at the database layer (row-level security), so each user can access only their own reviews.
• Access controls and least-privilege access for our systems and staff.

9. Your rights

Subject to local law, you may: access your data; correct it; delete it; object to or restrict processing; withdraw consent; and receive a copy in a portable format. To exercise a right, contact info@openeng.co. In South Africa these rights also extend to juristic persons (companies). You may also complain to your regulator:

• EU/EEA: your national Data Protection Authority. UK: the Information Commissioner’s Office (ICO).
• UAE: the UAE Data Office (and the DIFC or ADGM authorities if applicable).
• South Africa: the Information Regulator.

10. Cookies

We use only the cookies necessary to keep you signed in and to operate the service securely. We do not use advertising cookies.

11. Children

The service is for professional use and is not directed at, or to be used by, anyone under 18. We do not knowingly collect data from minors.

12. Changes and contact

We may update this policy; the effective date and version will change and material changes will be notified. Questions or requests: info@openeng.co · 6th Floor Meydan Grandstand, Meydan Road, Nad Al Sheba, Dubai, UAE.