Last updated: 26 October 2026
This Privacy Policy explains what personal data Al Mouallem Corporations ("we", "us") collects through almouallem.com, why we collect it, who we share it with and what choices you have. We collect only what we need to answer you, deliver our services and keep the website secure. We do not sell your personal data.
1. Who is responsible for your data
Al Mouallem Corporations, an IT consulting company based in the United Arab Emirates, is responsible (the "controller") for the personal data described in this policy. For any privacy question or request, email [email protected].
We follow the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021). Where other laws apply to you, for example the EU/UK GDPR or the data protection laws of Qatar or Saudi Arabia, we respect the rights they give you as well.
2. What we collect and where it comes from
Information you give us
- Contact and inquiry forms ("Get in touch", "Inquire our Services", "Customize my Request" and the "Ask a question" pop-up): your name, company, email address, phone number, the services you are interested in, team size, the best time to reach you, and your message. If you use the package builder, your chosen package options are filled into the inquiry form.
- Orders: billing name, company, address, email address and phone number, the products and services you order, discount codes used, and order notes.
- Project progress: for the work you order, when it started, who in our team is assigned to it, its target date and stage, the progress updates we show you on your order page, and any request for additional work we send you, with whether you accepted, declined or paid it.
- Requests and quotes: when you ask us for work through a form on our website, the "Ask a question" pop-up, the website chat, or by phone, WhatsApp or email, we keep your request (your name, company, email, phone and what you asked for) so it is answered, and the quotes we send you with what happened to them (viewed, questions, accepted, declined, paid, and any payment plan you accepted).
- Newsletter: your email address, your first name if you give it, the date, time and IP address of your sign-up and of your confirmation, and the personal welcome code we send you.
- Accounts and the Client Portal: your username, email address and password (stored only in encrypted, hashed form), the contact details in your profile, and the documents, quotes and invoices we share with you there.
- Website assistant ("Ask us"): the questions you type into the chat. If the assistant can't answer, we keep the question for 30 days (with email addresses and phone numbers masked) so we can add it to our FAQ. If you send your question to our team from the chat, we receive your name, email address, your message and, if you tick the box, the chat so far.
- Telegram order updates (optional): if you link Telegram from My Account or your order confirmation page, your Telegram chat ID and the name on your Telegram profile, and any message you send our bot. If you tap "Share my phone number" in the bot, we compare that number with the phone number on your account and keep only whether it matched, not the number itself.
- Correspondence: emails and messages you send us, and our replies.
Information collected automatically
- Technical data: IP address, browser and device type, pages visited and the date and time of your visit, recorded in our hosting provider's server logs and by Cloudflare, which delivers and protects the website. Cloudflare Web Analytics also counts page views and loading times, without cookies and without identifying you.
- Security data: sign-in attempts to accounts (to block password-guessing attacks), the result of the Cloudflare Turnstile check on our forms, the Google reCAPTCHA score and check result when you pay at checkout, and a short-lived counter by IP address that limits how many messages can be sent per hour.
- Order source: when you place an order, WooCommerce records how you reached the store (for example a search engine, a link or a direct visit).
- Cookies: see section 8.
Information from others
- PayPal confirms your payment and may give us your name, email and billing or shipping address. We never receive your full card number.
- Your own systems: when you hire us to work on your systems (for example email, user directories, cloud accounts or devices), we may see personal data that you hold about your staff or customers. We handle that data only on your instructions, as your processor (see section 10).
3. Why we use your data and our legal basis
| Purpose | Data | Legal basis |
|---|---|---|
| Answering your questions and inquiries, preparing quotes and Proposals | Form and correspondence data | Steps taken at your request before a contract; our legitimate interest in replying to business inquiries |
| Processing orders, delivering services, issuing licences and providing support | Order, account and correspondence data | Performance of our contract with you |
| Invoicing, VAT and accounting records | Order and billing data | Legal obligation |
| Running your Client Portal account | Account data | Performance of our contract with you |
| Sending you order updates on Telegram, if you link it | Telegram chat ID, order number, amount and status | Your consent. You can withdraw it at any time by sending /stop to our bot or choosing "Unlink Telegram" in My Account |
| Keeping the website and our forms secure, and preventing spam and fraud | Technical and security data | Our legitimate interest in protecting the website and our clients |
| Understanding which channels bring us customers | Order source data | Our legitimate interest in improving our business |
| Sending news and offers about our services | Email address | Your consent, which you can withdraw at any time. We send marketing only if you have agreed to it, and every message has an unsubscribe link |
| Meeting legal requests and defending legal claims | Any relevant data | Legal obligation; our legitimate interests |
We do not use automated decision-making or profiling that has legal or similarly significant effects on you.
4. Who we share your data with
We share personal data only with the service providers we need to run the website and our business, and only for the purposes above. Each of them may use it only to provide its service to us.
| Provider | What they do for us |
|---|---|
| Hostinger | Hosts the website and its database, and keeps server logs |
| PayPal | Processes payments by PayPal account and by card. Its scripts load only on product, cart, checkout and account pages, where you can pay, and help PayPal prevent fraud |
| SMTP2GO | Delivers emails from the website (form notifications, order and account emails, newsletter welcome codes) |
| Automattic (MailPoet) | Keeps our newsletter list on our website and delivers newsletters and subscription confirmation emails through the MailPoet Sending Service |
| Cloudflare | Delivers the whole website through its network and protects it from attacks, so it handles every visit (IP address, browser details and the pages requested). It also provides Turnstile, which checks that form and sign-in submissions come from people, not bots, and Web Analytics, which counts visits without cookies |
| Google (reCAPTCHA) | Checks at checkout that a payment comes from a person, not a bot testing stolen cards. Google receives your IP address, browser details and how you interact with the page, under the Google Privacy Policy and Terms of Service |
| Automattic (WooCommerce Tax) | Calculates tax from your billing address |
| Google Fonts | Supplies the website's fonts. Your browser connects to Google's servers, which receive your IP address |
| eM Client s.r.o. | Issues and registers the eM Client licences you buy (licence holder name, company and email) |
| Cloud and software vendors (for example Microsoft, AWS, Oracle, Google, domain registrars) | Set up the accounts, subscriptions and domains that you ask us to arrange for you |
| Email providers (Hostinger, Google Workspace, Microsoft Exchange Online) | When you order business email setup, host the mailboxes we create for you. They receive the names and email addresses of the users you give us, and the email itself once you use the mailboxes |
| Public domain registries (RDAP) | When you check a domain name on our website, our server asks the domain registries whether it is already registered. Only the domain name is sent, not your name, email address or IP address |
| Telegram | Delivers order updates to customers who link their Telegram, and our team's new-order alerts. It receives your Telegram chat ID and the text of each message: the order number, amount, status and project progress (work started, target date, ready for review) for your updates, and for our internal alerts also your name and what you ordered. See the Telegram Privacy Policy |
| Our own notification server (ntfy) | Sends our team a phone notification for each new paid order, with your name, the amount and what you ordered. It runs on equipment we operate ourselves, reached over an encrypted Cloudflare connection |
| Our team members (staff and contractors) | Carry out the work you order. Each sees only the work assigned to them: your name, company and contact details, the services and options you ordered, and the target date, never the amounts you paid. They keep it confidential and use it only for that work |
| Professional advisers | Our accountants, auditors and lawyers, under a duty of confidentiality |
| Our own AI server (Open WebUI with an open-source language model) | Writes short answers for the website assistant. It runs on equipment we operate ourselves, reached over an encrypted Cloudflare connection, and is not a third-party AI service. It receives only the text of your question and the matching passages from our website, not your name, email address or IP address. It does not keep the conversation, and your questions are not used to train AI models |
We may also disclose data when the law requires it, to protect our rights or the safety of others, or to a company that takes over our business, in which case this policy continues to apply to your data.
5. International transfers
Some of our providers store or process data outside the country where you live, including in the European Union and the United States. When data leaves the UAE (or the EU/UK, if you are there), we rely on safeguards the law recognises, such as the destination country's adequate level of protection, the provider's standard contractual clauses, or a transfer that is needed to perform our contract with you.
6. How long we keep your data
| Data | How long |
|---|---|
| Inquiries and correspondence that do not lead to an order | Up to 2 years after our last contact |
| Requests and quotes | 3 years after the last activity on them; a paid quote is kept as long as the order record |
| Orders, invoices and accounting records | At least 5 years, as UAE tax law requires |
| Accounts and Client Portal data | As long as your account is open, then deleted or anonymised within 90 days of closing it, except for records we must keep by law |
| Project documents, project progress records and client communications | For the length of our relationship and up to 5 years after it ends, to support you and defend legal claims |
| Security and server logs | Usually up to 90 days |
| Questions the website assistant could not answer | 30 days |
| Your Telegram link | Until you unlink it or close your account. Messages already sent stay in your Telegram chat until you delete them |
| Marketing consent | Until you withdraw it |
7. Your rights
Depending on the law that applies to you, you have the right to:
- ask for a copy of the personal data we hold about you;
- ask us to correct data that is wrong or incomplete;
- ask us to delete your data, unless we must keep it by law (for example invoices);
- ask us to restrict how we use your data, or object to our use of it, including any marketing;
- receive the data you gave us in a commonly used, machine-readable format; and
- withdraw your consent at any time, without affecting what we did before you withdrew it.
To use any of these rights, use the form below (also in My account) or email [email protected]. We first email you a link to confirm that the request is yours, and we reply within 30 days. When we delete your data, we keep only what section 6 says we must keep (for example invoices for 5 years, or data needed for an active plan or open order until it ends), and we tell you what we kept. You can also update most account details yourself in My account or the Client Portal.
If you are not happy with our answer, you can complain to the data protection authority where you live or work, for example the UAE Data Office or, in the EU, your local supervisory authority. We would appreciate the chance to resolve your concern first.
8. Cookies
Cookies are small files that a website stores in your browser. We use only the cookies and similar browser storage the website needs to work. We do not use advertising or cross-site tracking cookies, and our visitor statistics (Cloudflare Web Analytics) work without cookies.
| Used by | Examples | What for | How long |
|---|---|---|---|
| WooCommerce (shop) | woocommerce_cart_hash, woocommerce_items_in_cart, wp_woocommerce_session_* | Keep the items in your cart and your checkout session | Session, up to 2 days |
| WooCommerce (order source) | sbjs_* | Record how you reached the store, saved with your order | Session, up to 6 months |
| WordPress (accounts) | wordpress_logged_in_*, wordpress_sec_*, wordpress_test_cookie | Keep you signed in to My account and the Client Portal | Session, or 14 days if you choose "Remember me" |
| Wishlist | yith_wcwl_session_* | Remember products you save to your wishlist | Up to 30 days |
| Cookie banner (Complianz) | cmplz_* | Remember your cookie choices | Up to 1 year |
| Currency display | am_fx cookie; am-fx-cur and am-fx-rates (browser storage) | Remember the currency prices are shown in, so checkout and your order can show it too. It is picked from your device's time zone and browser language, or chosen by you. Your time zone and language are read in your browser and are not sent to us. | Cookie 6 months; am-fx-cur until cleared; am-fx-rates for the browser session |
| Cloudflare Turnstile | Browser storage inside Cloudflare's check frame (no cookies on our domain) | Tell people from bots when you submit a form or sign in | Session |
| Google reCAPTCHA (checkout only) | _grecaptcha (browser storage on our domain) and Google's _GRECAPTCHA cookie | Tell people from bots when you pay, to prevent card fraud | Browser storage until cleared; Google's cookie up to 6 months |
| PayPal (product, cart and checkout pages only) | ts, ts_c, __paypal_storage__ and other PayPal cookies and storage | Process payments securely and prevent fraud | Set by PayPal, see its policy |
| Page cache (LiteSpeed) | _lscache_vary | Show you the right cached version of a page, for example after you add something to the cart | Up to 2 days |
| Website features | am-intro-seen, am-cart-count, am-ck-min, wc_cart_hash_*, wc_fragments_*, litespeed_docref (browser storage, no cookies) | Show the intro video only once, show the number of items in your cart, remember that you minimised the cookie banner, and keep pages fast | Browser session, or until cleared |
| Website assistant ("Ask us") | am-ai, am-ai-idx, am-ai-me (browser storage, no cookies) | Keep your chat and the website's answers while you browse, and fill in your name and email if you send a question to our team | Browser session (cleared when you close the tab) |
You can change your choices at any time through "Manage consent" in the cookie banner, and you can block or delete cookies in your browser settings. If you block the cookies listed above, the cart, checkout and sign-in may not work. If we start using other cookies, for example for statistics, we will update this table and ask for your consent first where the law requires it.
9. Security
We protect your data with encrypted connections (HTTPS), hashed passwords, limits on sign-in attempts, bot protection on our forms, regular updates, and access limited to the people who need it. Card payments are handled entirely by PayPal. No system is completely secure, so please use a strong, unique password and tell us straight away if you think your account has been compromised.
10. When we work on your systems
When our services give us access to personal data that you control, you remain the controller and we act as your processor. We process that data only to deliver the agreed services, keep it confidential, protect it with appropriate security measures, and delete or return it when the work ends, unless the law requires us to keep it. We will sign a data processing agreement with you on request.
11. Children
Our website and services are intended for businesses and adults. We do not knowingly collect personal data from anyone under 18. If you think a child has given us personal data, please contact us and we will delete it.
12. Changes to this policy
We may update this policy when our services, our providers or the law change. The date at the top shows when it was last updated. If we make significant changes, we will tell clients by email or with a notice on the website.
13. Contact us
Al Mouallem Corporations
Privacy and legal requests: [email protected]
General enquiries: [email protected]
