Privacy Policy

We are Veengu — software provider for digital wallets, e-money, and payment ecosystems. Our website address is https://veengu.com.

The data controller for the personal data described in this policy is Veengu - FZCO, a company incorporated in Dubai, United Arab Emirates (registration number DSO-FZCO-14255), Office 307-B, IFZA, Dubai Digital Park, Building A3, Dubai Silicon Oasis, Dubai, United Arab Emirates.

What personal information we collect about you

We may collect and use any of the following information about you: your name, your company and/or personal email address, your phone number, your company name, your job title, and other information you provide explicitly via the Veengu website, Veengu demo mobile apps downloaded from mobile app stores, and demo portals.

While using demo mobile apps and portals we kindly request users not to upload sensitive information except phone number, email, and name. Users should use placeholder data, not real personal information, where appropriate.

The following information is created and recorded automatically when you visit our website: IP address, country from which you access information, pages visited, browser, operating system and platform information, and information about your visit and behaviour.

The following information is created and recorded automatically when you use our demo mobile apps: IP address, country, operating system and device information, and information about your visit and behaviour within the demo apps. To demonstrate some features the demo app may request:

• Access to your contact book for demo P2P transfer by phone number.
• Access to photos and the camera for the demo onboarding scenario and demo P2P / P2M transfers using QR code.
• Access to push notifications for demo notifications about events affecting your demo profile (such as demo money transfers).
• Access to biometric authentication functions for the demo authentication scenario.

We use this information to operate and improve our website, our demo apps, and the demo portals, and to analyse the locations from which visitors access our pages.

We collect, use, and store the personal information listed above for the following reasons:

• To receive and respond to enquiries from you.
• To improve our website, demo apps, and demo portals.
• To analyse the locations from which visitors access our website.

We gather visitors' contact information only if visitors:

• Fill in a contact form on our website.
• Use our demo mobile app and/or portal and fill in its forms with requested data.

Separately from website and demo-app visitors, we process personal data about the people we deal with at our customers, prospective customers, partners and suppliers — for example directors, officers, employees and contractors acting as commercial, technical or finance contacts. We call this business contact data.

What we collect

Name, job title, employer, business email address, business phone number, and the correspondence and records generated in the course of our dealings — enquiries, meeting and call notes, project and support communications, contract documentation, and billing and payment records.

We obtain this data from the individual, from their employer, from our contract documentation, and from publicly available business sources.

Why we process it

• To negotiate, enter into, perform and administer agreements with the organization the individual represents.
• Account management, relationship management and customer communications.
• Delivering and supporting our software and services, including project delivery, acceptance and support requests.
• Invoicing, payment collection and credit control.
• Maintaining, updating and improving our client records.
• Internal management analysis and reporting.
• Statutory returns, crime prevention, and legal and regulatory compliance, including sanctions and anti-money-laundering screening where applicable.
• Establishing, exercising or defending legal rights.

Our legal bases

We rely on:

• Performance of a contract — where processing is necessary to perform or administer an agreement with the individual's organization, or to take steps at their request before entering into one.
• Compliance with a legal obligation — where a law applicable to us requires the processing.
• Establishing, exercising or defending legal rights.
• Our legitimate interests in operating, administering and developing our business, where those interests are not overridden by the individual's rights and interests.

How long we keep it

• Contract documentation and related correspondence: for the term of the agreement and thereafter for seven years from the end of the relevant tax period, as required under the UAE Corporate Tax Law or as updated by law, or longer where a live or anticipated legal claim requires it.
• Billing, payment and accounting records: for seven years from the end of the relevant tax period, as required under the UAE Corporate Tax Law or as updated by law.
• Enquiries and prospect contact data that do not lead to an agreement: for as long as we are pursuing or maintaining a business relationship with the individual or their organization, and in any case deleted sooner if the individual asks us to.
• Support and project communications: for the term of the agreement and for as long afterwards as they remain relevant to supporting, evidencing or accounting for the work carried out.

Where we send it

Business contact data is stored in our corporate systems, which are operated by Microsoft (email, chat and cloud storage), and may be accessed by Veengu personnel, subcontractors and affiliates. Any subcontractor access takes place within Veengu's own tools and online services; we do not copy or transfer this data into any additional third-party tools. Where personal data is transferred out of the United Arab Emirates, we do so only where a transfer condition permitted under the PDPL applies — for example, transfer to a country recognised as providing an adequate level of protection, or under appropriate contractual safeguards binding the recipient.

Form submissions on /contact-us/, /request-demo/, and /jobs/ are processed by a Vercel Function that we operate. The function delivers your message by email to our team via Twilio SendGrid; a structured log entry containing submission metadata (form name, submitted fields, timestamp, IP, country, user-agent, delivery status) is retained in the Vercel function-log store for operational follow-up. Email content (including any CV attachment uploaded to the careers form) is retained according to Twilio SendGrid's retention policy and the recipient inbox's own retention.

We do not pass form data to any third-party CRM without notifying you first.

If you upload images to the website, you should avoid uploading images with embedded location data (EXIF GPS).

If you upload images to a demo app, please avoid uploading real photos or scans of real documents — use non-sensitive demo images instead. Veengu team members may have access to this data when reviewing activity in the demo environment. Uploaded media in the demo environment is not automatically purged on a schedule; it is removed on request. To have your uploads deleted, email support@veengu.com with demo data in the subject line; removal is completed within five working days.

The site uses cookies in two categories. Analytics cookies require your consent and are off by default — a banner on your first visit lets you accept, reject, or pick per-category settings. You can change your decision at any time via the Cookie settings link in the footer.

Strictly necessary (always on, no consent required)

• Cloudflare Turnstile — set only on form pages to verify that submissions come from a human. Short-lived; set by Cloudflare on its own challenge domain. Cloudflare's bot-protection product is used independently of where the site is hosted.

Our hosting provider (Vercel) does not set tracking cookies on regular page requests. If it sets a transient cookie to mitigate abusive traffic, that cookie is short-lived and not used for analytics.

Analytics — Google Analytics 4

• Google Analytics 4 — _ga, _ga_*. Aggregate page-view and traffic-source measurement. Retention typically up to 2 years. Set by Google LLC. In the EEA, the UK and Switzerland these cookies are set only after you opt in via the consent banner. In other regions they are set by default and you can opt out at any time via the Cookie settings link. See Analytics below.

Cookieless traffic measurement — we also use Vercel Web Analytics and Cloudflare Web Analytics. These store no cookies and no personal data on your device; they report only aggregate, anonymous page-view counts, and therefore run for all visitors without requiring consent.

We do not set cookies for advertising, retargeting, or cross-site tracking. If your browser sends a Global Privacy Control signal we treat it as a standing opt-out from Google Analytics — in every region — and do not show the consent banner.

We use the following analytics services:

• Google Analytics 4 (GA4) — cookie-based; consent-gated as described under Cookies above. See policies.google.com/technologies/cookies for its cookie policies.
• Vercel Web Analytics — cookieless, aggregate page-view measurement with no personal data. See vercel.com/legal/privacy-policy.
• Cloudflare Web Analytics — cookieless, aggregate page-view measurement with no personal data. See cloudflare.com/privacypolicy.
• Google Search Console — read-only crawl analytics. See policies.google.com for the global Google privacy policy.

Form submissions are protected by Cloudflare Turnstile. See cloudflare.com/privacypolicy for Cloudflare's privacy policy.

The Veengu demo apps allow prospective customers to evaluate the platform without integration. They are published on the Apple App Store and Google Play under Veengu accounts. Inside the demo app:

• Profile data (phone number, email, name) is stored in the demo environment for the lifetime of the demo session.
• Demo-environment data, including any media you upload, is not purged on a schedule. It is retained until you request deletion (see What rights you have over your data below).
• Demo environment administrators can see data provided by you within the demo apps and portals.
• Please use placeholder data, not real personal information, in the demo.

We do not share personal data with third parties. The technical service providers listed below process form data only as needed to deliver the function described:

• Vercel Inc. — hosts the website, runs the form-submission function, and provides cookieless Web Analytics. See vercel.com/legal/privacy-policy.
• Twilio Inc. (SendGrid) — delivers form-submission emails. See twilio.com/en-us/legal/privacy.
• Cloudflare, Inc. — operates the Turnstile bot-protection widget on form pages and provides cookieless Web Analytics. See cloudflare.com/privacypolicy.
• Google LLC — Google Analytics 4 and Search Console; see the Analytics section above. GA4 is loaded only after consent in the EEA, the UK and Switzerland, and by default (with opt-out) in other regions.

These providers are bound by their own privacy policies and we do not pass data to them beyond what is necessary for the function described.

When a customer uses the Veengu platform, personal data about that customer's own end users is processed by us on the customer's behalf and on its instructions. For that data the customer is the controller and we act as processor. This policy does not govern that processing — it is governed by the agreement between us and that customer, including its data-processing terms, which set out the purposes and means of processing, our security obligations, the subprocessors we use, and how deletion and return of data are handled at the end of the agreement.

If you are an end user of a service built on the Veengu platform and you want to exercise your rights over your data, please contact the provider of that service. If you contact us instead, we will refer your request to them.

• Form-submission metadata is retained as structured log entries in our Vercel function-log store (typically 30 days, depending on plan).
• Form-submission emails (including any CV attached to the careers form) follow Twilio SendGrid's retention and the recipient inbox's own retention.
• Demo-app data is retained until you request deletion (email support@veengu.com with demo data in the subject; removal within five working days). It is not purged on a schedule.
• Google Analytics 4 data follows GA4's retention policy. Cookieless Web Analytics (Vercel, Cloudflare) stores only aggregate counts with no personal data.

If you have submitted a form, used the demo app, or otherwise provided personal information, you have the following rights under the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021), the EU and UK GDPR, the California CPRA, Brazil LGPD, India DPDP, and similar regimes:

• Access — request an exported copy of the personal data we hold about you.
• Rectification — ask us to correct data that is inaccurate or incomplete.
• Erasure — ask us to delete personal data we hold about you, except data we are obliged to keep for legal or security reasons.
• Restriction — ask us to limit the way we process your data while a question about it is being resolved.
• Portability — receive your data in a machine-readable format.
• Objection — object to processing based on legitimate interests, including marketing.
• Right to know how your data is processed — request information about the purposes, categories, recipients and retention of your data.
• Withdraw consent for cookies and analytics at any time via the Cookie settings link in the footer.
• Complain to a supervisory authority (in the UAE, the UAE Data Office; in the EU, your local data-protection authority; in the UK, the Information Commissioner's Office).

Email support@veengu.com with the request and the email address (or other identifier) you used. We aim to respond within 30 days. For removal of demo-environment data, please mention demo data in the subject line — it will be deleted within five working days.

Form submissions are processed by Vercel Functions (the platform routes to the nearest available region); email is delivered via Twilio SendGrid. Analytics data is processed by Google (Google Analytics 4, Search Console) and, on a cookieless basis, by Vercel and Cloudflare (Web Analytics). Demo-app data is stored in the Veengu demo environment.

Veengu - FZCO is established in the United Arab Emirates and primarily serves customers in the Middle East, Africa, and other non-EU/UK markets. We do not actively offer goods or services to data subjects in the European Union or the United Kingdom, nor do we monitor their behaviour.

On the basis of this posture we have not appointed a representative under Article 27 of the EU GDPR or the equivalent Article 27 of the UK GDPR. If you believe this assessment no longer holds — for example, if you are an EU or UK resident whose personal data we process — please contact us at support@veengu.com so we can review the position. We will update this statement when material circumstances change.

For privacy-related questions, data-subject requests, or anything else covered by this policy, please email support@veengu.com. You can also reach us via the form on /contact-us/.

Postal address: Veengu - FZCO, Office 307-B, IFZA, Dubai Digital Park, Building A3, Dubai Silicon Oasis, Dubai, United Arab Emirates.

If you are a Veengu customer, the privacy terms that apply to our agreement with you — including our obligations as processor and the subprocessors we use — are set out in that agreement and its data-processing schedule. This policy does not vary those terms.