Privacy Policy

This policy explains, in plain language, how Savvy handles your information. It should be read alongside our Terms of Service and Data Residency statement.

1. Who we are

Savvy, a product operated by Tropika Labs F.Z.E, a Free Zone Establishment registered in the Ajman Free Zone under Registration No. 56207. Registered address: Office B.C. 1307823, C1 Building, Ajman Free Zone, P.O. Box 932, Ajman, UAE

We operate the credit-intelligence platform at besavvysure.com, helping UAE residents understand and protect their credit standing by decoding the official credit report they choose to upload.

Our role. We are the controller of your account data (the details you give us to create and secure your account). For the credit report you upload, we act on your instruction: you obtain your own report from the Al Etihad Credit Bureau (AECB) in exercise of your right of access and data portability, and you choose to share it with us so we can generate your insights. We do not obtain your credit data from the bureau or any lender, and we do not distribute it to anyone.

2. The information we collect

We collect only what we need to provide the service:

• Account information — your name, email address, and password (stored only as a secure hash), plus optional profile details (phone, emirate, avatar).
• The credit report you upload — the official credit report or statement you choose to share. We do not store the uploaded file itself; only the information extracted from it (scores, facilities, balances) is saved to your account.
• Product data you add — cards, BNPL accounts, and disputes you choose to track.
• Year of birth (optional) — if you provide it, we use it only to place you in a five-year age band for comparisons. We never ask for your full date of birth.
• Usage & device data — first-party analytics about how the service is used, sign-in sessions, and IP/user-agent for security.
• Consent records — a timestamped record of each consent you give, including the version of the wording you agreed to. See §7 and §8.
• Cookies — an essential session cookie, a consent-choice cookie, and, only with your consent, analytics cookies. See §9.

We never connect to your bank accounts, and we never ask for your banking login credentials. We have no automated or programmatic connection to the AECB portal of any kind.

3. How we use your information

• To decode your credit report and show you your score, the factors behind it, and the accounts on your file.
• To provide features you choose to use, such as the Score Simulator and Dispute Assist.
• To operate, secure, support and improve the service.
• To communicate with you about your account and, where you have opted in, product updates.
• To show you how you compare with other users — but only if you separately opt in. See §4.

We do not sell your personal data, and we do not use it for advertising profiling. Your documents are never used to train any AI model.

4. Legal basis

We process your personal data in line with the UAE's Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the UAE PDPL) and applicable regulations.

• Your credit report — processed on the basis of your explicit consent under Art. 9(1)(a), which we collect separately at the moment of each upload, combined with your exercise of the right to data portability under Art. 12.
• Your account — processed to perform our contract with you (sign-in, security, transactional email such as verification and password reset).
• Product improvement — first-party, aggregate analytics, on the basis of our legitimate interest in running a reliable service.
• Analytics & support cookies — only where you have accepted them.
• Comparisons with other users — on the basis of a separate, optional consent you can give or withdraw at any time in Settings → Privacy & Data. If you contribute, your figures are added to group statistics that record only how many people fall into each range — never your actual numbers, and never anything that identifies you. A comparison is shown only once a group is large enough that no individual can be singled out from it. You do not have to contribute in order to see how you compare, and if you withdraw, nothing of yours remains in the statistics after the next monthly recalculation.

You can withdraw your consent to process uploaded documents at any time in Settings → Privacy & Data, without deleting your account. Withdrawal does not affect processing already carried out.

5. How we protect and store your data

• The uploaded file is never stored. Your report is held in memory only for as long as it takes to read it, and is never written to disk, logged, or retained on our systems.
• Data is encrypted in transit (TLS 1.2+) and at rest (AES-256).
• Personal identifiers are stripped before any report content reaches our analysis engine.
• Access is role-based, logged, and limited on a least-privilege basis.

Full details are on our Security and Data Residency pages.

6. Sharing your information

We do not sell your personal data and we do not share it for advertising. We use a small number of trusted service providers who process personal data only on our instructions under data-processing agreements. Some of these providers process data outside the UAE (principally in the United States or the EU) under appropriate contractual safeguards, such as Standard Contractual Clauses. See Data Residency for how this works.

We may also disclose data where required by law, or to protect the rights, safety, and security of Savvy and our users.

7. Your rights

Under the UAE PDPL you have the right to:

• Access & export everything we hold about you — Settings → Privacy & Data → Download my data.
• Withdraw your consent to process uploaded documents — Settings → Privacy & Data.
• Correct your profile details in your Profile.
• Delete your account and all associated data — Settings → Privacy & Data → Delete my account.
• Object to or restrict certain processing.

To exercise any right, email hello@besavvysure.com. We respond in line with applicable UAE law.

Right to complain to the regulator. Under Art. 20 of the UAE PDPL you also have the right to lodge a complaint with the UAE Data Office if you believe your data has been handled improperly. You can reach the UAE Data Office at uaedataoffice.ae. You do not need to contact us first, though we would like the chance to put things right.

8. Data retention

• Uploaded files — never stored; processed in memory and discarded immediately.
• Extracted report data and account data — kept while your account is active, and deleted when you delete your account.
• Consent records — retained as an auditable record of the consent you gave, as required by the PDPL. These are kept after account deletion but are detached from your identity, so they no longer identify you.
• Analytics events — retained in anonymised form after account deletion.

9. Cookies

We use an essential cookie to keep you signed in and a small cookie to remember your consent choice. With your consent, we also use analytics cookies to understand usage. You can accept or reject non-essential cookies in the banner, and change your choice any time in Settings → Privacy & Data → Cookie preferences.

10. Children

Savvy is intended for users aged 18 and over. We do not knowingly collect data from anyone under 18.

11. Changes to this policy

We may update this policy from time to time. We will post the updated version here and revise the “Last updated” date above. Where a change affects how we process your uploads, you will be asked to consent again.

12. Contact us

Email hello@besavvysure.com for anything — privacy requests, support, or general questions. You can also visit our Contact page.

Tropika Labs F.Z.E, Office B.C. 1307823, C1 Building, Ajman Free Zone, P.O. Box 932, Ajman, UAE