Privacy Policy

1. Who we are#

Island AI is the website islnd.ai and the Island AI app for iPhone. It is run by Island AI Limited, licence no. 07010832, Office A, RAK DAO Business Centre, RAK BANK ROC Office, Ground Floor, Al Rifaa, Sheikh Mohammed Bin Zayed Road, Ras Al Khaimah, United Arab Emirates ("Island AI", "we").

Island AI decides what personal data is collected and why. In the words of the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021, the "PDPL") we are the controller. Contact for anything about your data: hello@islnd.ai. We have not appointed a data protection officer.

This policy covers the website and the app. The Island Awards privacy notice adds the details for Island Awards. The Cookie Policy lists the website's cookies.

2. The short version#

• We collect what you give us (your account, profile, listings, questions) and what the service needs to run (sign-in security, device tokens for push, crash reports).
• Your profile, your published listings and pages, who you follow and endorse, and your Island Awards results are public. Your email, phone, date of birth, gender, country and time zone are not.
• We don't sell personal data, show ads, or track you across other apps and sites.
• AI features send what you type, upload or ask to Anthropic (Claude) in the United States. We ask you before the first time. Your email, phone and account details never go with it.
• You can delete your account in the app or on the website. Most data goes at once; some is kept without your identity, and the Island Awards record stays.
• Our providers are Google (Firebase), Apple, Anthropic, Resend, Telegram (our team's alerts) and Hostinger (our web host). Data is stored in the European Union, the United States and with Apple.

3. What we collect#

3.1 Account and sign-in

• Email address and password if you sign up with email. The password is stored only as a hash by our sign-in provider, Firebase Authentication (Google).
• Sign in with Apple: the name and email you choose to share. With "Hide My Email" we receive Apple's relay address.
• Sign in with Google: your name and email address. We don't take your Google profile picture; you choose your own photo.
• Your account ID, @handle, sign-up date, the client you signed up with, your role (member, or a team role) and your plan.
• Sign-in security: whether your email is verified; for members of our team, a two-step sign-in with an authenticator app (the secret stays with Firebase Authentication). Firebase records the time of your last sign-in; Google also logs IP addresses and browsers at sign-in for abuse prevention and keeps them for a few weeks.
• Last seen: the app and the website tell our server that you are active at most every 5 minutes, and whether it was the website or the app.

3.2 Your profile (public)

Display name, @handle, profile photo, cover, About text, your business roles, who you follow and who follows you, what you endorse, how long you have been a member, and the badges you earned in Island Awards. Anyone can see this, with or without an account, and find you by typing part of your name or handle. You can hide the follow and endorsement lists in the app in Settings › Privacy.

3.3 Personal info (private, optional)

Contact email, phone number, country, time zone, gender, date of birth and preferred language, if you fill them in. Your onboarding answers ("Who are you?", your goals). Only you and our team can see these.

3.4 What you do on Island AI

• Follows, endorsements, saved items and blocks.
• Reports you send: what you reported, the reason, and the words you wrote.
• Taps on a listing's contact buttons (WhatsApp, call, email, booking): we record that your account tapped, which listing, which channel and when. The business doesn't see who tapped; our team sees the totals and, in its tools, which accounts did.
• Requests to our team ("Ask for more"): your request and our answer.
• Forms you fill in on the website: your answers with your account email and name.
• Your choices: notification settings, privacy settings, cookie choices, and the versions of the AI consents and listing agreement you accepted.

3.5 Listings, business pages and projects

When you add a place, a service, a business page or a project, we store what you type: name, description, category, photos, prices, opening hours, contact details (phone, email, WhatsApp, website, social links) and the location on the map. Once published, all of this is public, on the website, in the app, on the 3D island map and through our public data interface. We also store who added or changed it, the review notes of our team, and a copy of the listing at each team decision.

Your account email is stored with your listing for our team; it is never shown publicly. Photos are resized for display; the resized versions carry no camera metadata. The original file you upload is kept in private storage that only our systems can read.

Business pages have members with roles. Members see who the other members are; the public page shows only how many. Claims of a listing store the proof you give us (a business email, a contact channel, a note). Ownership transfers store the offer, the message and the email addresses involved.

Projects store the developer's contact block (sales team, showroom, phones, emails), which is public, and the verification documents and registration numbers, which only our team and the publishing page's owner or admin can see.

3.6 Island Awards

Nominations (including any contact details you add for the nominee), your votes and a fraud-check log of each vote with a one-way hash of your IP address and browser, your recommendation answers, and, if you are nominated as a person, your consent, your confirmation that you are 18 or older and your display choices. The Island Awards privacy notice has the full list.

3.7 AI features

What you give an AI feature: the links, text, files, voice notes and answers for Fill it in with AI; your messages and voice messages for Isle. For a project, the documents our team gives Fill it in with AI (brochures, price lists, permits), which can hold a developer's contact details. If we add Ask about a listing, your question about a listing. Section 6 explains what is sent where and what we keep.

3.8 Device and app data

• Push notifications (app): if you allow notifications, a Firebase Cloud Messaging token for your device, your app version, build and language, and your notification settings.
• Crash and performance reports (app): Firebase Crashlytics sends crash reports with the device model, OS version, app version, the state of the app at the crash and your account ID. Google keeps them for 90 days.
• Usage analytics (app): Firebase Analytics records screen views and a small number of key events (for example a sign-in or a listing published) with an app-instance ID and the Firebase installation ID, not your name, email or account ID. We use this to see which parts of the app are used. There is no advertising identifier (IDFA) and no tracking. Crash and usage reporting is on in the App Store build and has no switch in the app.
• App integrity: Firebase App Check with Apple's App Attest and DeviceCheck proves that requests come from the genuine app. On the website the same job is done by Google reCAPTCHA v3, which runs on every page and sets a Google cookie.
• Technical data our providers' software sends to work: IP address, app and OS version, language, time zone, request logs. Cloud Run logs the IP address of every call to our functions; our web server logs requests. Both logs are kept for 30 days.
• Your country, from your IP address: the country of the IP address a request comes from decides which AI features we show you (Isle, Fill it in with AI and, if we add it, Ask about a listing are available only in the countries our AI provider serves). We look the country up in a database on our own servers; the address is not sent anywhere for this and we keep only the yes or no for that request. IP geolocation by DB-IP, licensed under CC BY 4.0.

3.9 Website cookies

Explained in the Cookie Policy. In short: a sign-in cookie, your theme, your cookie choice, Google reCAPTCHA for security, Google Maps on listing pages, and Google Analytics only if you turn it on.

3.10 When you write to us

Your email address and the content of your message, when you write to hello@islnd.ai or send a form.

3.11 What we don't collect

Your precise location (the app never asks for it; maps show where a business is). Your contacts. Your photo library (you pick a photo or take one; we receive only that photo). Health, financial or government-ID data. Payment details (Island AI is free; there are no payments). We don't knowingly collect data from anyone under 18.

4. Why we use your data, and the legal basis#

We don't use your data for advertising, we don't sell it, and we don't make decisions about you based only on automated processing. Moderation decisions are made by people; only pictures rated as adult or violent are stopped automatically, and a person will look again if you ask. Vote fraud checks are decided by people.

Pictures are checked automatically. Before a profile photo, a cover, a listing photo or a business page's picture can be seen by others, Google Cloud Vision, a Google service that works for us, rates it for adult content and violence. A picture rated as adult or violent is not published. A picture it is unsure about is published, and a person on our team looks at it afterwards; we take it down if it breaks our Community guidelines. If you think a picture was stopped by mistake, write to hello@islnd.ai and a person will look at it. We keep the ratings only for pictures that were stopped or flagged.

5. Who receives your data#

We share personal data only with the providers below, each processing it for us under a contract that requires them to protect it, with other members and the public where this policy says something is public, and with authorities when UAE law requires it.

Other people see what you make public: your profile, follows, endorsements, published listings, pages and projects, Awards results. A business doesn't see who tapped its contact button; our team does. Our team sees your account email and sign-up date when it reviews a claim, a report or a team request.

We may disclose data when UAE law requires it, to protect Island AI or its members, or in a sale or merger of Island AI (we would tell you first).

6. AI features: what the model sees, what we keep#

Island AI uses the Claude models of Anthropic, PBC for its AI features, and Google Cloud Speech-to-Text for voice notes. We ask you before the first use of each feature: the app shows what is sent and to whom, and nothing is sent until you tap Allow. If we change what we send or who we send it to, we ask again. You can always type things yourself instead.

You can take your permission back at any time in the app: Profile › Settings › Isle › AI permission › Withdraw AI permission, or write to hello@islnd.ai. It covers Isle and Fill it in with AI; the next time you use either, we ask again.

What goes to Anthropic.

• Fill it in with AI (listings): the links you give, the text you type, the files you add (photos, screenshots, PDFs), your answers to up to three follow-up questions, the name you typed for the listing and the island. Anthropic's tools then read public web pages: the pages you linked and pages found by searching your business's name. Instagram is never read; an Instagram link becomes your listing's contact.
• Fill it in with AI (projects, used by our team): the project's documents (brochures, price lists, permits) and what our team wrote about the project.
• Isle: your message, the last 24 messages of the chat, and the results of searches in Island AI's public listings and in Island Awards, plus a web search.
• Ask about a listing, when we add it: your question and the listing's public information. Not the owner's account, coordinates or anything private.
• Not sent: your email, phone, account ID, handle, date of birth, gender, follows or anything else that identifies your account. Isle can be told a little about you so its answers fit: your first name, whether you are a visitor, a resident or a business, your language, country and time zone, never more. If you don't want that, email hello@islnd.ai and we switch it off for your account.

Voice notes. A recording of up to two minutes is sent to Google Cloud Speech-to-Text in the European Union, which turns it into text. We delete the recording as soon as the text is ready or the attempt fails (our storage provider keeps a recovery copy for 7 days). Google does not log the audio or the text by default. You see the text and can change it before anything is sent to Anthropic.

What Anthropic does with it. Anthropic processes the data to give us the answer, on its US infrastructure. Under Anthropic's commercial terms it does not train its models on our data. Anthropic deletes inputs and outputs within 30 days, longer only to enforce its usage policy or when the law requires it.

What we keep.

• The record of each fill (links, text, file names, answers, questions, a summary): the links, text, file names and answers are removed after 30 days; the rest stays while your account exists. Files are deleted once read, or after one day if a fill never starts. The AI's research notes (facts with their sources) are deleted after 30 days. What the AI filled into your draft stays in the draft, with a note of where each value came from. Nothing is published until you check it and our team approves it.
• For a project, the documents a developer provides stay with the project, and the AI's reading of them (the values it filled in, with the document each came from) stays with the project too.
• Isle chats stay until you delete them (one chat or your whole history) or delete your account. If you rate or report an answer, we keep the rating, your note and Isle's answer. Questions Isle couldn't answer are kept for 90 days without your account, to improve the help pages.
• If we add Ask about a listing: your questions about a listing and the answers, up to 30 per listing, visible only to you; a record of the topics you asked about (never the text), to improve answers; anonymous counts of questions per listing.
• A usage record for each call: feature, model, tokens and cost, with your account ID but no content. After you delete your account it keeps an anonymous code instead.
• Daily counters for the limits (5 fills and 20 voice notes for listings, 20 Isle messages and 20 Isle voice messages a day), deleted after the day ends.

Opting out. Don't allow a feature, or stop using it. Delete Isle chats in the app. Deleting your account deletes everything above except the anonymous usage records.

7. How long we keep data#

8. Deleting your account#

In the app: Profile › Settings › Sign-in & security › Delete account. On the website: Settings › Privacy & Security › Delete account. You see what will be deleted and confirm; we may ask you to sign in again first. Deletion happens at once and can't be undone.

Deleted: your sign-in account, profile, handle, photos, personal info and onboarding answers; follows (both ways), endorsements, saved items, blocks; your listings in every state with their photos, endorsements and pending transfers; your notices and push devices; your AI fills, research notes, files, counters and Isle chats; your memberships of business pages; your Awards votes, recommendations, picks and email log; your settings and consents.

Kept without your identity: reports you sent, forms you submitted (the answers), AI usage records, Isle ratings, the Awards vote journal and nominations (your account ID becomes an anonymous code; your IP and browser hashes and the nominee's contact details are erased); the record that a business page was created by you.

Kept: results, nominees, finalists, winners and badges of Island Awards, with your name and photo as shown at the time; reports other people made about you; our team's audit trail, contact-button taps, team requests and claims, for up to 24 months (section 7). A business page of which you were the only owner is suspended until our team appoints a new owner or deletes it.

If you signed in with Apple, the app asks Apple to disconnect Island AI from your Apple ID as part of deletion. If you signed in with Google, we sign you out of Google in the app; you can also remove Island AI in your Google account's third-party connections.

9. Your rights#

Under the PDPL you can ask us to:

• tell you what personal data we hold and how we use it (Article 13);
• give you a copy in a machine-readable form (Article 14);
• correct or complete it (Article 15);
• delete it (Article 15), subject to the exceptions above;
• restrict or stop processing, including for direct marketing (Articles 16–17);
• not be subject to decisions based only on automated processing (Article 18);
• withdraw a consent you gave, at any time, without affecting what was done before (Article 6).

How: edit your profile and personal info in the app at any time; change notification, privacy and cookie settings; unsubscribe from Awards emails with the link in any email; withdraw your AI permission in the app under Settings › Isle (section 6); delete your account as above; for anything else, including a copy of your data, email hello@islnd.ai from the address on your account. We answer within 30 days. You can also complain to the UAE Data Office.

10. Children#

Island AI is for adults. You must be 18 or older to create an account. We don't knowingly collect personal data from anyone under 18. If you think a child has an account, email hello@islnd.ai and we will delete it.

11. Where your data goes (international transfers)#

Our providers store and process data outside the UAE: in the European Union (our database and server code, voice transcription, our web server in Germany), in the United States (sign-in service, files, email, AI processing, crash and analytics reports) and on Apple's servers. We transfer data only as the PDPL allows: to countries with adequate protection, or under contracts that oblige the recipient to protect it to the PDPL's standard (Articles 22–23), and for the AI features with your consent (Article 23(1)(b)).

12. Security#

Data is encrypted in transit and at rest. Access to our systems is limited to our team, who must use two-step sign-in. Requests to our servers are checked with App Attest, DeviceCheck or reCAPTCHA. Passwords are never stored in clear text. We hash IP addresses before storing them. We log who on our team changed what. No service is perfectly secure; if a breach affects you, we tell you and the UAE Data Office as the law requires (Article 9).

13. Changes#

We post updates here with a new effective date. If a change is significant, we tell you in the app or by email before it takes effect.

14. Contact#

hello@islnd.ai

Island AI Limited, licence no. 07010832, Office A, RAK DAO Business Centre, RAK BANK ROC Office, Ground Floor, Al Rifaa, Sheikh Mohammed Bin Zayed Road, Ras Al Khaimah, United Arab Emirates.