Controller and contact
Fidrel AB, identified in the company details below, is the controller for website enquiries, accounts, security and its own customer relationships. For project content that a customer controls, the customer is normally the controller and Fidrel acts as its processor under a data processing agreement; contact the project owner first about that content. Fidrel AB is established in Sweden. It processes personal data of people in the UAE in accordance with Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL) and its executive regulations as they take effect; because it is established in Sweden, its processing is also subject to the EU General Data Protection Regulation (GDPR). In the UAE, subscriptions are sold only to businesses and organisations, but this notice and the rights it describes apply to every individual whose personal data we process, including invited project members and the contacts of our business customers. Send any question or request directly to [email protected].
DIFC and ADGM
If your organisation is established in the Dubai International Financial Centre (DIFC) or Abu Dhabi Global Market (ADGM), its own processing of personal data is governed by the DIFC Data Protection Law 2020 (DIFC Law No. 5 of 2020) or the ADGM Data Protection Regulations 2021 rather than the PDPL. When Fidrel processes project content on behalf of such an organisation, it does so under the data processing agreement and the safeguards those rules require of the organisation.
Data and sources
You provide your name, email address, professional role, organisation, enquiries and quotation details. An administrator may invite you and assign your role. The service processes documents, versions, metadata, reviews, comments, activity, billing references and technical data such as IP addresses and error logs.
Grounds for processing
We process personal data where it is necessary to perform a contract with you or to take steps you ask for before a contract, such as creating and running your account, delivering the service and keeping it secure, and handling orders and payments; where it is necessary to comply with legal obligations, such as accounting and tax records; where it is necessary to establish, exercise or defend legal claims; and otherwise with your consent, for example for any optional cookies or marketing. Where you are invited by an organisation, that organisation decides what it puts into its projects and is responsible for its own basis for doing so. Do not upload sensitive personal data, such as health, biometric or criminal records data, to a project unless your organisation has a lawful basis for it.
Recipients
Authorised members access project content under the project’s rules. OVHcloud (servers in London, United Kingdom) and Cloudflare provide hosting and delivery; Supabase provides the database, authentication, document storage and authentication emails. Stripe processes payments when its checkout is used and may act as an independent controller for its own legal obligations. Authorities receive data where the law requires it. Resend sends the service’s email, such as invitations, notifications and invoices. Google provides reCAPTCHA on the website’s forms. Map images come from OpenFreeMap and Esri, and a project’s address is sent to Komoot’s address search (Photon) when the project is placed on the map. Fidrel AI is described in its own section.
Transfers outside the UAE
Fidrel is operated from Sweden and the service is hosted outside the UAE, so personal data of people in the UAE is transferred abroad. We do not promise UAE-only or EEA-only processing: providers’ operations and support may involve other countries, including the United States. Transfers rely on the grounds the PDPL permits for cross-border transfers, such as an adequate level of protection in the receiving country, contractual safeguards or, where the PDPL allows it, your express consent, and, where the DIFC or ADGM rules apply, on their equivalent transfer rules. You may ask us which recipients and safeguards apply. The database and documents are stored with Supabase in Stockholm, Sweden.
Retention
Account data is kept while the account is in use; project content and versions follow the agreed project and retention periods. The recycle bin is not immediate deletion. Enquiries are kept for as long as they need handling and for potential legal claims; accounting and tax records are kept for the periods the applicable law requires. Documents and folders in the recycle bin are deleted permanently after 30 days, as are schedules, unapproved estimates and supplier invoices in the bin; uploads that are never completed are moved there after one day. Fidrel AI conversations and drafts are deleted 180 days after they were last used, technical logs of AI calls after 30 days, and records of AI usage without content after 400 days. Invitations are valid for 7 days. Database backups are kept for 7 days and then overwritten.
Your rights
Under the PDPL you can ask for information about and access to your personal data, correction of inaccurate data, erasure, restriction of processing and a copy of your data in a structured, machine-readable form where applicable. You can ask us to stop processing, including at any time for direct marketing, and object to decisions based solely on automated processing that have legal or similarly significant effects. Withdrawing consent does not affect processing that took place before. We may need to verify your identity. We respond without undue delay and within any period set by the PDPL and its executive regulations; we aim to answer within one month.
Sign-in with Google, Microsoft or Facebook and deleting your data
If you sign in with Google, Microsoft or Facebook, we receive your name, email address and, where available, profile picture from that service. We use them only to create and recognise your account, never post anything on your behalf and do not read your contacts. You can disconnect the service under Settings in Fidrel or remove Fidrel in the service’s own app settings. To delete your account and personal data, choose Request account closure under Settings, or email [email protected] from your account’s address with the subject “Delete my data”. We confirm the request and delete the account data without undue delay, normally within one month, except what the law requires us to keep, such as accounting records. Content in a customer’s project is handled under that customer’s agreement.
Fidrel AI
When you use Fidrel AI, your question, earlier messages in the same conversation, the page you are on and the project information the assistant reads to answer are sent to OpenAI, which processes them as our subprocessor. The assistant reads only what you yourself have access to, and files or images you attach. Project information may include the names of people on the project. Your name and email address are not sent; OpenAI receives a code that cannot be linked to you without our records. OpenAI does not use the information to train its models and keeps it for up to 30 days to detect abuse. OpenAI may process the information in the United States, under the safeguards in our data processing agreement with OpenAI. Your conversations are stored in Fidrel, visible only to you, and deleted after 180 days without activity. The project’s administrator can turn Fidrel AI off for the project. Answers can contain mistakes: check what matters. If you ask Fidrel AI to read a supplier invoice, its contents are sent in the same way.
Marketing messages
We send marketing emails or messages only with your consent, identify Fidrel as the sender and include a free and simple way to opt out in every message, in line with the PDPL and the rules of the Telecommunications and Digital Government Regulatory Authority (TDRA) on unsolicited electronic communications. Service messages about your account, orders and security are not marketing.
Security and complaints
Access controls and encrypted connections protect the service, although no system can guarantee absolute security. Required account data enables sign-in, and administrators decide what goes into projects. The app does not make solely automated decisions with legal or similarly significant effects. Please raise any concern with us first at [email protected]. You may also complain to the UAE Data Office, the authority responsible under the PDPL. If the DIFC or ADGM rules apply, complaints go to the DIFC Commissioner of Data Protection or the ADGM Office of Data Protection.
Newsletters
Newsletters are planned. A subscription requires a separate, voluntary signup explaining email use and how to unsubscribe. Accepting cookies does not subscribe you.
Read the provider’s information
Contact and company details
- Company name
- Fidrel AB
- Registration number
- 559556-3593
- VAT number (EU)
- SE559556359301
- Postal address
- Paviljongvägen 2 132 40 Stockholm
- [email protected]