Privacy Policy

BYAFT (“BYAFT”, “we”, “us” or “our”) operates the website byaft.com and the free, browser-based tools available on it (the “Service”). This Privacy Policy explains how we handle personal data when you use the Service.

We are committed to protecting your privacy in line with the United Arab Emirates Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the “PDPL”) and its implementing regulations, as overseen by the UAE Data Office. By using the Service, you acknowledge the practices described in this policy.

BYAFT is built to collect as little personal data as possible. All of our tools — including the CV Builder, Invoice Generator, PDF Tools, QR Code Generator, Business Calculators and Text Tools — run entirely inside your web browser. The documents, files, text and other content you create or open in a tool are processed on your own device and are never transmitted to, stored on, or seen by our servers.

We collect personal data in two limited ways:

• Information you choose to provide. The Service does not require an account, sign-up or login. If you contact us directly (for example, by email), we receive the information you include in that message, such as your name and email address.
• Information collected automatically. When you visit the Service, we use analytics technology that collects limited technical information about your visit — such as your device and browser type, approximate (city-level) location, the pages you view, the referring website, and your IP address (which is processed by our analytics provider and not stored by us in an identifiable form). See “Cookies and analytics” below.

We do not knowingly collect sensitive personal data (such as data revealing health, religious or political beliefs). Please do not enter such data into our tools where it is not needed.

We use the limited personal data we collect to:

• operate, maintain and secure the Service;
• understand how the Service is used so we can improve it;
• respond to your enquiries; and
• comply with our legal obligations.

Legal basis. Under the PDPL, we rely on your consent for non-essential analytics, and on the necessity of operating and securing the Service for the basic technical processing required to deliver it to you. You may withdraw your consent to analytics at any time (see “Cookies and analytics” and “Your rights”).

We use Google Analytics, a service provided by Google, to understand aggregate usage of the Service. Google Analytics can set cookies and similar identifiers on your device and process data such as your IP address and usage events on our behalf. We use this information only in aggregate to measure traffic and improve the Service.

Your choice comes first. When you first visit, analytics run in a consent-aware mode (using Google Consent Mode) that does not store analytics cookies until you agree. We ask for your choice through a cookie banner, and no analytics cookies are set unless you select “Accept”. You can change or withdraw your consent at any time using the “Cookie settings” link in the footer.

You can also control or block cookies through your browser settings, and you can opt out of Google Analytics across all websites by installing the Google Analytics Opt-out Browser Add-on. For more on how Google handles data, see Google’s Privacy Policy.

Some tools (such as the CV Builder and Invoice Generator) save your drafts in your browser’s local storage so your work is still there when you return. This data stays on your device, is not transmitted to us, and is not accessible to us. You can delete it at any time by clearing your browser’s site data for byaft.com, or by using the relevant tool’s delete or clear option.

We do not sell your personal data. We share limited personal data only with the service providers that help us run the Service, namely:

• Google (Google Analytics) — analytics processing, as described above; and
• Cloudflare — hosting and delivery of the website.

These providers act as our processors and may use the data only to provide their services to us. We may also disclose personal data where required to comply with applicable law or a lawful request from a competent authority.

Because the Service relies on global providers such as Google and Cloudflare, limited personal data (such as analytics data) may be processed on servers located outside the United Arab Emirates. Where personal data is transferred outside the UAE, we take steps to ensure it is handled in line with the cross-border transfer requirements of the PDPL and that an adequate level of protection is maintained.

Content you create in our tools is retained only in your own browser, for as long as you keep it. Analytics data is retained by our analytics provider for a limited period in accordance with our analytics configuration and Google’s retention controls, after which it is deleted or anonymised. If you contact us, we keep your message only as long as needed to handle your request.

The Service is served over encrypted HTTPS connections, and because tool content is processed locally on your device it is not exposed to our servers. While no method of transmission or storage is completely secure, we apply appropriate technical and organisational measures to protect the limited personal data we handle.

Subject to the conditions and exceptions in the PDPL, you have the right to:

• be informed about how your personal data is processed, and to access it;
• request the correction of inaccurate or incomplete personal data;
• request the deletion of your personal data;
• request that we restrict or stop the processing of your personal data;
• request the transfer of your personal data (data portability);
• object to processing carried out by automated means; and
• withdraw your consent to processing at any time, without affecting processing carried out before the withdrawal.

To exercise any of these rights, contact us using the details in “Contact us” below. We will respond in accordance with the PDPL.

The Service is intended for general audiences and is not directed at children under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will take appropriate steps to delete it.

If you have concerns about how your personal data is handled, we encourage you to contact us first so we can help. You also have the right to lodge a complaint with the UAE Data Office, the federal authority responsible for personal data protection in the United Arab Emirates.

We may update this Privacy Policy from time to time to reflect changes in our practices or the law. When we do, we will revise the “Last updated” date at the top of this page. We encourage you to review this page periodically.

If you have any questions about this Privacy Policy or wish to exercise your rights, you can reach us at:

Email: [email protected]

You can also find BYAFT on TikTok, Instagram and X.