Fairlyst Software Systems LLC ("Fairlyst", "we", "us"), a company registered in Abu Dhabi, United Arab Emirates, is the data controller for personal data processed through the Certly website and application (the "Service"). This policy explains what we collect, why, and the rights you have under the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021, "PDPL").
Your email address, submitted through the form on certly.ae and processed by our form provider, Formspree, Inc.
Usage limits. To keep the supplier check free and prevent misuse, each company can run 3 checks and each email address 2 checks in any 12-month period. To apply these limits we keep, for 12 months from each check:
We do not keep supplier names or results in these records. Each check date is deleted 12 months after the check, and a record is deleted once it has no dates left. These records are kept separately from the details above, so they are not removed when we delete those after 30 days.
To check that an email domain can receive email, we look up its mail records through Cloudflare's DNS service; only the domain is sent, never your address.
Results come from the Ministry of Industry and Advanced Technology (MoIAT) National ICV open data. They are an estimate only. Certly is not affiliated with or endorsed by MoIAT.
We do not knowingly collect special categories of personal data (e.g. health, religion) through the Service, and the Service is not directed at individual consumers or children.
| Purpose | Legal basis (PDPL) |
|---|---|
| Operating your account and the Service you requested | Performance of a contract with you |
| Calculating ICV estimates and scenarios from data you enter | Performance of a contract with you |
| Reading supplier ICV certificates you upload, so you can review and confirm the values | Performance of a contract with you |
| Contacting waitlist and trial sign-ups about access | Consent (given when you submit the form) |
| Emailing you the Supplier ICV check results you asked for | Your request (performance of a service you asked for) |
| Sending occasional Certly updates after a Supplier ICV check | Consent (only if you tick the box) |
| Preventing misuse of the free Supplier ICV check, including its usage limits | Legitimate interest |
| Running free trials (reminder emails, one trial per company) and keeping plan and billing records | Performance of a contract with you, and legitimate interest |
| Keeping the Service secure and fixing problems | Legitimate interest |
| Complying with legal obligations | Legal obligation |
The Service is currently hosted on Supabase, which runs on AWS infrastructure located in Mumbai, India (there is currently no UAE region available for this infrastructure). This means personal data and company data you submit is processed and stored outside the UAE. We apply encryption in transit and at rest, and access controls limiting who can view your data.
When you upload a supplier's ICV certificate, the file is stored in your organization's private storage with Supabase in the Mumbai, India region. Only members of your organization can access it. To read the certificate, we send its contents, together with the supplier name, trade licence number and TRN you have on file, to Anthropic, PBC (United States) through the Claude API. Anthropic acts as our sub-processor. The request is sent by a Supabase Edge Function, which may run in a region other than Mumbai.
Anthropic processes this data only to return the extracted values. Under its commercial terms it does not use it to train its models, and it keeps it only for the limited period set out in its data processing terms. The extracted values are not saved, and do not change any score, until a user in your organization has reviewed and confirmed them.
For clients with a requirement that data stay within the UAE, please contact us — we can discuss options, including a UAE-hosted environment.
Transactional email (such as password reset emails) is sent via Resend. Supplier ICV check results and updates are also sent via Resend. Our waitlist and trial form is processed via Formspree, Inc. Cloudflare Turnstile checks that visitors to the Supplier ICV check are human; it processes your IP address and browser signals. These providers may process data outside the UAE as part of providing their service to us. Together with Anthropic's processing in the United States, this means some data is transferred to India and the United States; we rely on our providers' contractual data protection commitments for these transfers.
We do not sell personal data. We share data only with:
We never share one customer's company or supplier data with another customer.
Waitlist emails are kept until you ask us to delete them or until we launch general availability and reach out, whichever comes first. Account and company data is kept for as long as your account is active, and for a reasonable period after closure to allow data export, after which it is deleted or anonymized, unless we are required to keep it longer by law.
Supplier ICV check data: if you didn't tick the updates box, it is deleted 30 days after your check. If you did, it is kept until you unsubscribe, then deleted within 30 days. The scrambled email and IP fingerprints used for daily limits are deleted after 2 days. The usage-limit records (your company domain and a coded version of your email, with check dates) are kept for 12 months from each check, as described in section 2.
Free trials. When a free trial ends without a paid plan, you can still sign in to download your supplier list for 30 days. We email the organization's owners 7 days before deletion. After 30 days (and at least 7 days after that email) we permanently delete the organization's data: financial years, spend lines, scores, scenarios, supplier certificates and their files, and the user accounts that belong only to that organization. We keep the company's email domain (for example, example.ae) and the deletion date, so that each company gets one free trial. We also keep a record of plan changes (plan, dates and who made the change) for billing and audit.
Uploaded supplier certificates are kept until your organization deletes them or closes its account. If you cancel an upload before confirming it, or a file is not attached to a saved certificate, it is deleted automatically within 25 hours.
Under the PDPL, you can ask us to:
To exercise any of these rights, email certly@fairlyst.com. You may also lodge a complaint with the UAE Data Office if you believe your rights have been infringed.
We use industry-standard measures including encrypted connections (HTTPS), encrypted storage, row-level access controls on company data, and restricted internal access. No system is completely secure, and we encourage you to use a strong, unique password for your account.
certly.ae and app.certly.ae use only the cookies or local storage needed for the site and app to function (such as keeping you signed in). We do not use advertising or cross-site tracking cookies. Our waitlist form provider, Formspree, may use its own cookies as described in its privacy policy.
We may update this policy as the Service develops, particularly as we move from early access to general availability. We'll post changes here with an updated date, and tell active users directly about material changes.
Fairlyst Software Systems LLC, Abu Dhabi, United Arab Emirates. For any privacy question or request, email certly@fairlyst.com.
This policy covers only the Certly software (certly.ae and app.certly.ae), operated by Fairlyst Software Systems LLC. If you separately engage Ricardo Nesmith for one-on-one ICV advisory services under the trade name Certly for Management Consulting (a sole establishment licensed for administrative consultancy and economic feasibility studies), any personal data shared as part of that engagement is handled under the terms of that separate engagement, not this policy.