Privacy Policy
1. Company and scope
This Privacy Policy describes how BBK AI FOR COMPUTER SYSTEMS & COMMUNICATION EQUIPMENT SOFTWARE DESIGN, trading as BBK AI ("BBK AI", "we", "us" or "our"), processes personal data in connection with AllAI. AllAI is a commercial AI software-as-a-service platform available through allai.ae, uae.allai.ae, and related applications, extensions, integrations and services (the "Platform"). BBK AI is located in Dubai, United Arab Emirates.
This Policy applies when a person visits our websites, creates or uses an account, uses a Platform feature, connects a third-party account, purchases a subscription, contacts us, or otherwise interacts with AllAI.
2. The AllAI Platform
Depending on the plan, entitlement, location, device, account type, provider availability and configuration, AllAI may provide AI chat using multiple AI providers, multi-model comparison, AI Council, Deep Research, web search, image generation and understanding, file and document processing, speech-to-text, text-to-speech, realtime voice, a browser extension, an external chatbot, social-media tools, WordPress and other integrations, team features, subscriptions and usage credits. Feature availability is not uniform across all accounts.
3. Personal data we collect
Depending on the features used, we may collect:
- account, profile, organization, contact and authentication details;
- security events, preferences, consent records and support communications;
- prompts, conversation context, uploaded files and documents, images, audio, selected webpage text and other content submitted by a user;
- AI-generated text, images, audio and other outputs and related settings;
- web-search queries, relevant context and results used to answer a request;
- device, browser, network, log, diagnostic, usage and fraud-prevention information;
- subscription, plan, credit, invoice and transaction-status information; and
- information received from connected platforms, as described in Section 10.
Payment providers generally handle full payment-card details. Users should not submit information they are not authorized to process.
4. Sources of data
We receive data directly from users; automatically when the Platform is visited or used; from organization administrators; from AI, hosting, security, communications, support and payment providers; and from third-party platforms a user intentionally connects and authorizes.
5. Purposes of processing
We process personal data to provide requested features; create and administer accounts; authenticate users; generate and deliver AI outputs; process subscriptions and usage entitlements; maintain settings and conversation continuity; operate, secure, troubleshoot and support the Platform; communicate about accounts and requests; measure performance and usage; improve AllAI; prevent fraud and abuse; comply with law; and establish or defend legal claims.
Connected-platform data is subject to the narrower purposes and controls in Section 10. Specific provider terms and the applicable feature notice may impose additional limits.
6. Lawful grounds
Depending on the circumstances and applicable law, we may rely on performance of a contract, consent, compliance with a legal obligation, or legitimate interests that are not overridden by applicable rights. Where consent is required, users may withdraw it, although withdrawal does not affect earlier lawful processing and may prevent a feature from operating.
7. AI processing and providers
To provide a requested AI feature, AllAI may transmit the minimum content reasonably necessary, such as prompts, relevant context, files, images, audio, selected webpage text, search context or authorized connected-platform excerpts, to an AI or infrastructure provider selected by the user or configured for the feature. Providers may process that material under their own terms and under contractual or other safeguards applicable to their role.
BBK AI does not sell user prompts or outputs and does not use them for advertising targeting. Users remain responsible for reviewing outputs and deciding what information to submit.
8. Files, images, audio, voice and web search
File, document and image features may process uploaded content and related metadata. Voice features may process recordings, transcriptions, synthesized speech and technical data. Web-search and research features may send queries or relevant context to search or AI providers and return third-party material. Processing depends on the feature selected and the request made by the user.
9. Browser extension
The browser extension may detect text intentionally selected by the user on the active webpage and process that text and follow-up questions through AllAI and the selected AI provider. It does not intentionally collect complete browsing history, passwords, full payment-card data or private credentials. Limited local browser data may be used for sessions, authentication, preferences and operation.
10. Connected Platforms and Platform Data
"Platform Data" means information received through a third-party platform's authorized application programming interfaces or connection mechanisms, including connection credentials or tokens and information derived from authorized data. AllAI accesses Platform Data only after the user authorizes the connection and only according to the permissions granted and the enabled feature. The Google and Meta subsections below control their respective data and prevail over any conflicting or broader general language in this Policy.
Google and Gmail
"Google User Data" means Gmail message content, Gmail metadata, OAuth credentials and access or refresh tokens, and information derived from those items. Access occurs only after Google OAuth authorization. The Gmail Connector uses read-only Gmail access to search, retrieve, display, summarize or analyze relevant email only when explicitly requested by the user. It does not allow AllAI to send, modify, delete, archive or otherwise manage messages.
AllAI uses Google User Data only to provide or improve the prominent, user-facing Gmail Connector functionality requested by the user. Only the minimum relevant Gmail content may be transmitted to the configured or selected AI provider, solely to provide the requested response. Google User Data is not used for general analytics, advertising, retargeting, profiling, credit decisions, unrelated research, unrelated product development, improvement of unrelated features, data brokerage, sale, resale or generalized AI model training.
Human access is limited to specific user permission, security or abuse investigation, or legal compulsion, and must remain limited to the permitted purpose. Users may revoke authorization through their Google Account permissions and may request deletion through support@allai.ae. Revocation prevents future authorized access but is not by itself a deletion request. Connecting Gmail does not transfer ownership of emails or account data to AllAI. Google User Data may remain only as permitted for the requested function, backups, security or legal obligations, and may be processed by providers or internationally only as necessary for that function and subject to applicable safeguards. Exact retention and deletion outcomes depend on the applicable workflow and law.
AllAI’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Meta - Facebook and Instagram
"Meta Platform Data" means information received through authorized Facebook or Instagram APIs. Depending on the permissions approved by Meta, the account type and the feature enabled by the user, it may include Facebook or Instagram identifiers; business-profile information; Facebook Pages; Instagram professional accounts; posts, media and captions; comments and replies; messages only where an approved and enabled feature supports them; engagement statistics and insights; access tokens; granted permissions; connection status; and data derived from authorized Meta Platform Data. AllAI does not necessarily access every category.
Meta Platform Data may be used only to provide features requested by the user, such as connecting an authorized Page or professional account; displaying or managing permitted content; creating suggested posts, captions or replies; supporting comments or messages where enabled and authorized; scheduling or publishing content where enabled; and displaying authorized insights. Only the minimum relevant Meta Platform Data may be sent to an AI provider when necessary to perform the requested feature.
Meta Platform Data is not sold or rented, used for unrelated advertising or profiling, used for credit decisions, used for unrelated product development, used to train generalized AI models, or combined with unrelated data for data brokerage. Access is based on user authorization and approved permissions. Tokens and connection information may be retained only as reasonably necessary to maintain the authorized feature and subject to applicable safeguards.
Users may revoke authorization through Facebook or Instagram settings, disconnect through AllAI where that control is available, and request deletion through support@allai.ae. After revocation, AllAI will not use the authorization to access new Meta Platform Data, although limited records may remain for backups, security, legal obligations or a permitted support purpose. Human access is restricted to people or providers who need it to operate the requested feature, support the user, maintain security, investigate abuse or comply with law. Provider and international processing is limited to what is necessary for the requested feature and subject to applicable safeguards.
Users retain ownership and control of their Facebook or Instagram accounts, Pages, professional accounts, posts, messages, media, comments and other content. Connecting them does not transfer ownership to AllAI.
Other connected services
AllAI may support WordPress and other business or content integrations selected by a user. The available data and actions depend on the service, permissions and enabled feature. We use Other Platform Data only as reasonably necessary to provide the requested connection and according to the applicable provider terms. Users may revoke access through the provider and may use an AllAI disconnection control where available. No general analytics, product-development or User Content licence grants unlimited rights over Platform Data.
11. External chatbots, WordPress, teams and social tools
External chatbot, WordPress, team and social-media features may process configuration data, authorized content, visitor or audience interactions, publishing instructions and technical records needed for the selected feature. Users are responsible for having authority to connect accounts, providing required notices and obtaining permissions for personal data collected through their chatbot, website, team or managed social presence.
12. Subscriptions and payments
Payment providers may process billing and payment information under their own privacy notices. AllAI may receive transaction status, plan, invoice, entitlement and credit information needed to administer subscriptions, usage and refunds.
13. Cookies and similar technologies
AllAI may use essential cookies and, where lawfully enabled, preference or measurement technologies. The Cookie Policy describes the categories, purposes and controls that apply to cookies and similar technologies. Connected-platform data is not used for unrelated cookie analytics or advertising.
14. Service providers and subprocessors
We may use AI, cloud, hosting, storage, search, speech, image, security, communications, support, analytics and payment providers. A provider may process personal data on our behalf or may act independently under its own notice, depending on the service and relationship. The Subprocessors List identifies providers where applicable. We may also disclose data at a user's direction, to respond to lawful authority, protect users and the Platform, or support a corporate transaction subject to applicable law.
15. International processing
AllAI and its providers may process personal data outside the user's country where necessary to provide the Platform. Where required, we use appropriate contractual or other safeguards. Connected-platform transfers remain limited by Section 10.
16. Retention
We retain personal data for as long as reasonably necessary for the relevant feature, account administration, security, dispute handling and legal obligations. Retention may differ for account records, conversations, uploads, connector data, support records and backups. Data may remain in backups until those backups rotate through ordinary operations or retention is required by law.
17. Security
We use reasonable administrative, technical and organizational safeguards designed to protect personal data and limit access according to operational need. No system or transmission method is completely secure. Connected-platform access, token handling and provider transfers are subject to the restrictions in Section 10 and applicable safeguards.
18. Privacy rights
Subject to applicable law, individuals may have rights to access or correct personal data, request deletion or restriction, object to certain processing, withdraw consent and complain to a competent authority. We may verify identity and retain limited information where law permits or requires it. Requests may be sent to support@allai.ae.
19. Children and eligibility
AllAI is intended for users who are at least 18 years old and legally capable of entering a contract. We do not knowingly invite children to provide personal data in breach of applicable law. If you believe a child has provided data, contact us at support@allai.ae.
20. Automated processing
AI features use automated processing to generate user-requested outputs. AllAI does not represent that outputs are decisions by qualified professionals and does not use connected-platform data for unrelated profiling or credit decisions.
21. Account closure, revocation and deletion
Closing an AllAI account, cancelling a subscription and revoking a connected-platform authorization are separate actions unless the Platform expressly states otherwise. The Account and Data Deletion Instructions explain available request routes. Revoking Google, Facebook or Instagram authorization does not automatically delete the AllAI account. Deletion is subject to identity checks, applicable law, transaction records, security records and backup rotation.
22. Third-party links and services
The Platform may link to or depend on third-party websites, applications, AI models, payment services, search services and connected platforms. Their terms and privacy notices apply to their own processing. AllAI is not responsible for practices outside its control.
23. Policy updates
We may update this Policy to reflect legal, technical or service changes and will identify the revised date. Material changes will be communicated where required by law. A material expansion of connected-platform access or purposes may require updated notice or authorization.
24. Company details
Legal company: BBK AI FOR COMPUTER SYSTEMS & COMMUNICATION EQUIPMENT SOFTWARE DESIGN
Trade name: BBK AI
Product: AllAI
Location: Dubai, United Arab Emirates
25. Contact
Privacy questions, rights requests, deletion requests and connected-platform assistance may be sent to support@allai.ae.