PRIVACY POLICY

Legal

Last updated: July 13, 2026

1. Who We Are

This Privacy Policy applies to the Yalla.Tax website and related services (the “Service”) operated by BlinkEdge LLC (“Yalla.Tax,” “we,” “us,” or “our”).

We are an independent information and productivity platform. We are not an official government site and are not affiliated with, endorsed by, or connected to the UAE Federal Tax Authority (FTA) or any other government authority.

2. Scope of This Policy

This Policy explains how we handle personal data when you:

• Visit our website at https://yalla.tax
• Create and use an account on the Platform
• Use AI search, chat, and document tools
• Use the VAT Module to upload, manage, and process business and tax-related data
• Download, install, and use our mobile point-of-sale application for Android (the “POS App”)
• Record sales, expenses, or other transactions through messaging channels such as WhatsApp
• Subscribe to our Managed Service, under which VAT returns are prepared and filed on your behalf via partner tax agents
• Subscribe to a paid plan or free trial
• Contact us by email or through support channels

3. Information We Collect

3.1 Information You Provide Directly

• Account information: Name, email address, password, and basic profile information.
• Billing information: Payment-related details (e.g., card information) are collected and processed by our payment providers such as Stripe. We do not store your full card number on our own servers.
• Support and communication: Information you provide when you contact us for help, such as your email, screenshots, or descriptions of issues.
• Content you submit: Prompts, questions, text you type into the AI chat, and any other content you submit while using the Service.
• Business and tax data: Information you upload or input into the VAT Module, including company details, Tax Registration Numbers (TRN), filing periods, invoices, expenses, receipts, and supporting documents
• Messaging data: Where you record sales, expenses, or documents through WhatsApp or other messaging channels, we process the content of those messages (including text, images, and attachments such as receipts), your phone number, and related metadata in order to log transactions and provide the Service. WhatsApp itself is operated by Meta and governed by its own privacy policy.
• Mobile number: Your mobile number is used as your identifier and login credential for the POS App and for WhatsApp-based features. We send one-time verification codes to that number via WhatsApp to confirm your identity when you sign in, create an account, reset your Admin PIN, or request account deletion.
• POS App data: Sales and transaction records (items, amounts, VAT, tips, payment method, timestamp), your product and service catalogue, and the employee to whom each sale is attributed.
• Employee and staff information: The names of employees and other staff you add to your business account so that sales and tips can be attributed to them, together with their mobile numbers where you choose to give them access. See Section 6B.
• Admin PIN: A four-digit PIN you choose to restrict access to certain screens on a shared device. We store the PIN only in hashed form; we never store or transmit the PIN itself in a readable form.
• Support requests: The subject and description you submit through the in-app support form, sent to us together with your name, mobile number, business name, and app and device version so we can help you.

3.2 Information Collected Automatically

When you use the Service, we automatically collect certain information, including:

• Usage data: Pages viewed, search queries, AI interactions, timestamps, clicked buttons, and other activity within the platform.
• Device and log data: IP address, browser type, operating system, language settings, and approximate geographic region derived from your IP.
• Cookies and similar technologies: We may use cookies, local storage, and similar technologies to remember your session, keep you logged in, and understand how you use the Service.
• Mobile app data: Where you use the POS App, we may collect the app version, device model and manufacturer, operating system version, and error and diagnostic information, in order to provide support and diagnose faults.

3.3 Information from Third Parties

We may receive limited information about you from:

• Payment providers: Transaction confirmation, subscription status, and partial card information (e.g., last 4 digits, expiry month/year) for reconciliation purposes.
• Email service providers: Information about email delivery, opens, and clicks on important account-related messages.

4. How We Use Your Information

We use your information to:

• Create and manage your account and subscriptions
• Authenticate your identity, including email verification codes and one-time codes sent to your mobile number via WhatsApp
• Provide the POS App, including recording sales, applying VAT, attributing sales to employees, and generating sales reports
• Provide AI search, chat, and document tools
• Improve the accuracy, performance, and usability of the Service
• Respond to your questions, support requests, and technical issues
• Send important service communications (e.g., account security, billing, changes to terms or policies)
• Analyse aggregated usage patterns to understand how the Service is used and to make product improvements
• Provide VAT-related tools, including processing, organizing, and summarizing business and transactional data within the VAT Module
• Detect, prevent, and address fraud, abuse, or security incidents
• Comply with legal obligations and enforce our Terms of Service

5. How We Use AI & Your Content

Yalla.Tax uses AI models to generate responses, summaries, and suggestions based on your inputs and relevant documents.

• Your prompts and interactions may be processed by our AI providers to generate outputs in real time.
• Process and analyse Business Data within the VAT Module to generate summaries, classifications, and VAT-related outputs.
• We may log and review certain prompts and outputs to debug issues, monitor for abuse, and improve quality.
• We do not sell your prompts or your personal data to advertisers.

You should never input highly sensitive personal data (such as passwords, full card numbers, or unrelated sensitive medical/personal details) into the AI chat or any other text fields unless strictly necessary and appropriate.

6. VAT Module & Business Data

The VAT Module allows you to upload, input, and manage business and tax-related data (“Business Data”), including company information, TRNs, filing periods, invoices, expenses, and supporting documents.

We store and process this data to provide the functionality of the VAT Module, including organization, summarization, and calculation features.

You remain fully responsible for the accuracy and completeness of all Business Data submitted. Yalla.Tax does not independently verify this data against FTA systems.

6A. The POS App & Device Data

Our point-of-sale application for Android (the “POS App”) collects and processes the following, in addition to the information described above:

• Camera: The POS App requests access to your device camera so that you can photograph a price list to create your catalogue, and photograph receipts and invoices for expense capture. Images you capture are sent to our servers and to our AI/OCR provider to extract the relevant text. We do not access your camera in the background, and we do not access your photo library other than the specific images you choose.
• Local storage on your device: The POS App stores your catalogue, your recent sales, your session token, and a hashed copy of your Admin PIN on the device itself, so that the app continues to work when the device is offline. This data is removed from the device when you sign out or uninstall the app.
• Diagnostics: App version, device model, and operating system version, used to provide support and diagnose faults.

The POS App does not collect your device location, your contacts, your call or SMS history, your microphone input, or a list of other apps installed on your device.

The POS App is distributed through the Google Play Store. Google may collect information about your download and installation of the app in accordance with its own privacy policy; that collection is outside our control.

6B. Employee & Staff Data

The Service allows you to record the names of your employees and other staff, to attribute sales and tips to them, and to generate reports about their activity.

Where you enter information about your employees into the Service, you determine what is collected and why, and we process that information on your behalf and on your instructions. You are responsible for informing your staff that their information is recorded in the Service and for having a lawful basis for that processing, as set out in our Terms of Service.

We use employee information solely to provide the Service to you — to attribute sales, to produce reports, and, where you grant a staff member access, to authenticate them. We do not use it for any other purpose, and we do not sell it.

If you are an employee of a business that uses Yalla.Tax and you wish to access, correct, or delete information held about you, please contact your employer in the first instance, as they control that information. You may also contact us at support@yalla.tax and we will assist them in responding to you.

7. Legal Basis for Processing

Depending on your jurisdiction, we may rely on one or more of the following legal bases to process your personal data:

• Contractual necessity: To provide the Service you have requested, including account creation, subscription, and support.
• Legitimate interests: To maintain and improve the Service, protect the security of our systems, and understand user behaviour (while respecting your privacy rights).
• Legal obligations: To comply with applicable laws, regulations, and accounting or tax requirements.
• Consent: Where required (for example, certain cookies or marketing communications), we may rely on your consent, which you can withdraw at any time.

8. How We Share Your Information

We do not sell your personal data. We may share your information with:

• Service providers: Third parties who provide infrastructure, hosting, analytics, email delivery, payment processing, and similar services.
• AI providers: Trusted partners who process text inputs and, where applicable, Business Data to generate AI outputs for the Service.
• Payment processors: Stripe and any other payment provider, to process subscriptions, manage billing, and prevent fraud. Your payment card details are handled directly by Stripe.
• Partner tax agents: Where you use the Managed Service, we share your Business Data and relevant account details with the independent FTA-approved registered tax agent(s) who prepare and submit filings on your behalf. This sharing is necessary to provide the Managed Service and is done on your authorization.
• Messaging providers: WhatsApp/Meta and related communication providers, to enable transaction recording, identity verification codes, and messaging features.
• Email delivery providers: Third-party providers (such as SendGrid) used to deliver account, support, and verification emails on our behalf.
• App distribution platforms: Google Play, in connection with distribution, installation, and updates of the POS App.
• Professional advisors: Lawyers, accountants, or auditors as needed for business operations or legal compliance.
• Authorities or law enforcement: When required by law or to protect our rights, users, or the public.
• Business transfers: In the context of a merger, acquisition, or sale of assets, where personal data may be transferred as part of the transaction (subject to appropriate confidentiality protections).

9. International Transfers

Our infrastructure and service providers may be located in multiple countries. As a result, your personal data may be transferred to and processed in jurisdictions outside your country of residence, which may have different data protection laws.

We take appropriate steps to protect your information, such as using contractual safeguards and only working with reputable service providers.

10. Data Retention

We retain personal data for as long as reasonably necessary to:

• Provide the Service and maintain your account
• Comply with legal, tax, or accounting obligations
• Resolve disputes and enforce our agreements
• Maintain business and security records
• Retain records of filings prepared or submitted under the Managed Service, where required for legal, tax, or audit purposes (including any minimum record-keeping periods required under UAE tax law)

When data is no longer required for these purposes, we will delete or anonymise it in a commercially reasonable manner.

Statutory tax records. Yalla.Tax operates in a regulated area. UAE tax legislation requires taxable persons to retain accounting records, tax invoices, and other tax records for a minimum statutory period. Where transactional records have been created for VAT purposes, we therefore retain those records for the period required by law even after you delete your account — but we remove or de-identify the personal identifiers attached to them wherever it is possible to do so without defeating the legal record-keeping obligation. Retained records are not used to provide the Service and are deleted once the statutory retention period has expired. See Section 13A.

11. Security

We use technical and organizational measures designed to protect your personal data, such as:

• Encryption in transit (HTTPS)
• Access controls and authentication mechanisms
• Segregation of environments and regular updates

However, no system can be fully secure. You are responsible for keeping your login details confidential and immediately notifying us of any suspected unauthorized access to your account.

12. Cookies & Similar Technologies

We use cookies and similar technologies to:

• Keep you logged in between sessions
• Remember your preferences and settings
• Measure how the Service is used so we can improve performance and usability

You may be able to control cookies through your browser settings. Disabling certain cookies may affect your ability to use parts of the Service.

13. Your Rights

Depending on your jurisdiction, you may have some or all of the following rights in relation to your personal data:

• Right to access your personal data
• Right to request correction of inaccurate data
• Right to request deletion of your data (subject to legal limits)
• Right to object to or restrict certain processing
• Right to withdraw consent where we rely on consent
• Right to data portability (in some cases)

To exercise any of these rights, please contact us at support@yalla.tax. We may need to verify your identity before responding to your request.

13A. Deleting Your Account & Your Data

You can request permanent deletion of your account and its associated data at any time, without contacting support, at:

https://yalla.tax/delete_account.html

This page is reachable from within the POS App and directly from any web browser, including if you have already uninstalled the app. To protect your business against unauthorised deletion, we verify your identity by sending a one-time code to the mobile number registered on the account before carrying out any deletion.

What is deleted

• Your business account and every user login associated with it
• Names, mobile numbers, and email addresses of the account holder and of users you added
• Your product and service catalogue
• Your employee list
• Documents, receipts, and invoice images you uploaded
• Your Admin PIN
• Any active subscription, which is cancelled with our payment processor

What is retained, and why

As described in Section 10, UAE tax law requires records created for VAT purposes to be kept for a minimum statutory period. Where such records exist, we retain the underlying transactional and tax records for that period and remove the personal identifiers attached to them wherever we can do so without defeating that legal obligation. We also retain a minimal record of the deletion itself, and any records we are required to keep to comply with law, prevent fraud, or resolve a dispute. Nothing retained is used to continue providing the Service to you.

Timing

Deletion is carried out promptly once your identity is verified, and normally takes effect immediately. Residual copies may persist in encrypted backups for a limited period before being overwritten in the ordinary course.

Uninstalling the POS App does not delete your account — it only removes the local copy of your data from that device. To delete your account you must use the link above.

If you would prefer us to handle the request for you, or if you have difficulty using the deletion page, contact us at support@yalla.tax.

14. Children’s Privacy

The Service is intended for professional and business users and is not directed to children. We do not knowingly collect personal data from children under the age where parental consent is required under local law. If you believe a child has provided us with personal data, please contact us and we will take appropriate steps to delete it.

15. FTA Filing & Your Responsibilities

The way filings work depends on the plan you use:

• Self-serve plans: Yalla.Tax does not connect to your official FTA account and does not submit returns, refund claims, objections, or other filings on your behalf. The reference, search, AI, and VAT Module features are tools to help you prepare your own filings, which you submit yourself.
• Managed Service: Where you subscribe to the Managed Service and provide the necessary authorization, VAT returns and related filings are prepared and submitted on your behalf by independent FTA-approved registered tax agents we partner with, as described in our Terms of Service. Even then, you remain responsible for the accuracy of the underlying data and for paying any tax, penalties, or interest due.

In all cases, you are responsible for ensuring that information submitted to the FTA is accurate and complete, for meeting deadlines where filing depends on data you supply, and for paying amounts owed to the FTA. Yalla.Tax does not assume your tax liabilities.

Corporate Tax is available as a separately priced add-on service, delivered through our FTA-approved partner agents; where you subscribe to it, your Business Data may be shared with those agents for that purpose in the same way as for VAT filings. Excise Tax and other non-VAT matters are not included unless separately agreed in writing. Any general information about such taxes provided through the Service is for information only.

Any information generated by Yalla.Tax (including AI chat responses and VAT Module outputs) should be verified directly with the FTA or a qualified tax advisor.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will change the “Last updated” date at the top of this page. In some cases, we may provide additional notice (for example by email or in-app notification).

Your continued use of the Service after changes become effective indicates your acceptance of the updated Privacy Policy.

17. Contact Us

If you have any questions or concerns about this Privacy Policy or our data practices, you can contact us at:

Yalla.Tax / BlinkEdge LLC
Email: support@yalla.tax
Website: https://yalla.tax