Privacy Policy.

Effective date: 21 September 2026  ·  Last updated: 6 October 2026

1. Who we are

This website and the products described on it are operated by TBS Group FZE LLC (“TBS Group”, “we”, “us”, “our”), a free zone company registered with Ajman NuVentures Centre Free Zone, Government of Ajman, United Arab Emirates, under trade licence number 2627013747888, with its registered office at Office BC-891261, 26th Floor, Amber Gem Tower, Sheikh Khalifa Street, Ajman NuVentures Centre Free Zone, Ajman, United Arab Emirates.

For questions about this policy or about how your data is handled, contact us at hello@thetbsgroup.com.

2. Two different roles

It matters which role we are in, because it changes who decides what happens to the data.

As controller. When you visit this website, send us an enquiry, or sign up for one of our products directly, we decide why and how your personal data is used. This policy governs that.

As processor. When a client uses our software to run their own business — an ERP holding their customer records, a WhatsApp inbox holding their conversations, an e-invoicing system holding their invoices — that client decides what happens to the data. We only act on their instructions, under a separate agreement. If your data sits in a system a company operates using our software, contact that company first; their privacy policy governs, not ours.

3. What we collect

3.1 Website visitors

• Information you give us — name, email address, phone number, company name, and whatever you write in a contact or demo request form.
• Technical information collected automatically — IP address, browser type and version, device type, operating system, pages viewed, referring page, and date and time of the visit. This is written to standard web server logs.
• Website assistant (“Ask by voice”) — your browser turns speech into text (Chrome uses Google for this); we do not record or store your voice. The text of your question is sent to our assistant service. Questions and answers are saved without your name or IP address so we can improve the answers.
• Free tools — your answers and uploaded files stay in your browser. We only receive your contact details and summary score if you ask for the full report.

3.2 Product and platform users

• Account data — name, work email, phone number, company, role, and authentication credentials. Passwords are stored only as salted cryptographic hashes; we cannot read them.
• Usage data — log-in times, actions taken, features used, and error and diagnostic logs.
• Billing data — company billing details and invoice records. Card details are handled by our payment provider and are not stored on our systems.

3.3 Data processed on behalf of clients

Depending on which products a client uses, our systems may process:

• Smart AI Platform (WhatsApp AI) — message content, sender phone numbers, timestamps, and any attachments sent to a client’s connected business number, together with the AI-generated replies.
• Smart Mail AI — the content, headers, attachments and metadata of email in the mailboxes a client connects.
• ERP Suite and hosted ERP — a client’s business records, which may include their customers, suppliers, employees, transactions and documents.
• Tax AI and E-Invoicing — invoice data, tax registration numbers, buyer and seller identifiers, amounts, and the structured invoice files themselves.

We do not use client data to train AI models, we do not sell it, and we do not use it for our own marketing.

4. Artificial intelligence

Several of our products use AI models to read, classify, summarise or draft content. Some of these models are operated by third-party providers, which means the relevant content is transmitted to that provider for processing.

Where this happens, we use providers under agreements that prohibit using the content to train their models, and we limit what is sent to what the feature actually needs. Clients are told which providers are involved before a feature is enabled.

Website assistant. Questions that our website assistant cannot answer from its prepared answers are sent, together with relevant text from this website, to Groq (United States) to generate a short answer. Do not include personal or confidential information in your questions. The spoken voice is generated on our own servers.

AI output can be wrong. It is intended to assist a human, not to replace one, and it must not be relied on as legal, tax or financial advice.

5. Social media integrations

Where a client authorises it, our software connects to their own social media or business accounts — currently including LinkedIn Pages — in order to publish content that the client has reviewed and approved.

When such a connection is authorised:

• We store an access token and a refresh token, encrypted, so that publishing can continue without re-authorising daily.
• We store the organisation identifier of the page being published to, and the content, images and status of posts created through our software.
• We retrieve engagement statistics for those posts — impressions, reactions, comments and follower counts — to report on performance.
• Nothing is published without approval. Every post is reviewed and approved by an authorised user before it goes out.
• We do not read private messages, we do not access connection or contact lists, and we do not act on any account other than the one authorised.

Authorisation can be withdrawn at any time, from within our software or from the settings of the connected platform. On withdrawal, we delete the stored tokens.

6. Why we use your data

• To respond to enquiries and provide quotations.
• To provide, operate, secure and support our products and services.
• To authenticate users and prevent unauthorised access.
• To invoice, and to keep the accounting and tax records the law requires.
• To diagnose faults and improve reliability.
• To send service notices about outages, changes and security matters. These are operational, not marketing, and cannot be opted out of while an account is active.
• To send marketing communications — only where you have consented, and you can withdraw that consent at any time.
• To comply with legal obligations in the UAE and, where relevant, other jurisdictions in which we operate.

7. Legal basis

We process personal data on the basis of your consent, the performance of a contract with you, compliance with a legal obligation, or our legitimate interests in operating and securing our business — balanced against your rights. Our processing is governed by UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data and its implementing regulations.

8. Sharing

We do not sell personal data. We share it only with:

• Infrastructure and service providers who host, secure, back up or support our systems, under written agreements.
• AI model providers, as described in section 4.
• Accredited service providers and tax authorities, where an e-invoicing product transmits an invoice as the law requires.
• Payment providers, to process payments.
• Professional advisers — auditors, lawyers, accountants — under a duty of confidentiality.
• Authorities, where we are legally required to disclose.

A current list of sub-processors is available to clients on request.

9. Where data is stored

We host client systems in the location agreed with each client. Where a service is subject to a data residency requirement — including UAE e-invoicing records, which must be retained inside the United Arab Emirates — that data is stored in the required jurisdiction.

Some infrastructure and AI providers operate outside the UAE. Where personal data is transferred outside the UAE, we do so only where the receiving jurisdiction provides an adequate level of protection, or under appropriate contractual safeguards.

10. How long we keep it

• Website enquiries — up to 24 months from the last contact, unless a business relationship begins.
• Server logs — typically up to 90 days.
• Website assistant questions — deleted automatically after 90 days.
• Account data — for the life of the account, then up to 90 days after closure to allow for recovery and final billing.
• Accounting and tax records — for the period required by UAE law.
• E-invoicing records — a minimum of 10 years, as the UAE e-invoicing framework requires.
• Client data under a processing agreement — for as long as that agreement specifies, then deleted or returned on the client’s instruction.

11. Security

We apply technical and organisational measures appropriate to the risk, including encryption in transit, encrypted storage of credentials and tokens, access control on a least-privilege basis, network isolation between tenants, logging and monitoring, regular patching, and tested backups.

No system is perfectly secure. If a personal data breach occurs that is likely to result in a risk to affected individuals, we will notify the relevant authority and affected parties as the law requires.

12. Your rights

Subject to the conditions and exceptions in UAE law, you have the right to request access to your personal data, correction of inaccurate data, deletion, restriction of processing, a copy of your data in a portable format, withdrawal of consent, and to object to processing.

To exercise any of these, write to hello@thetbsgroup.com. We will respond within the period required by law. We may need to verify your identity first.

If your data is held in a system operated by one of our clients, we will refer your request to that client, who is the controller.

13. Cookies

This website uses only the cookies necessary for it to function and to keep it secure. Where we use any analytics or non-essential cookie, we will ask for consent first. Your browser can block or delete cookies; blocking essential cookies may stop parts of the site working.

14. Children

Our website and products are intended for businesses. We do not knowingly collect personal data from anyone under 18. If you believe we have, contact us and we will delete it.

15. Third-party sites

This site links to third-party websites and services. We are not responsible for their content or their privacy practices. Read their policies before providing them with personal data.

16. Changes

We may update this policy. The effective date at the top will change, and material changes will be notified to account holders by email or in the product. Continuing to use our website or services after an update means you accept the revised policy.

17. Contact

TBS Group FZE LLC
Office BC-891261, 26th Floor, Amber Gem Tower,
Sheikh Khalifa Street, Ajman NuVentures Centre Free Zone,
Ajman, United Arab Emirates
Email: hello@thetbsgroup.com
Website: thetbsgroup.com