This Privacy Policy explains how we collect, use, disclose, and protect personal data when you use the Tonnexis platform, website tonnexis.com, and related services (the “Services”). We process personal data in accordance with UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the “PDPL”) and its Executive Regulations, and other applicable laws.
1. Who this applies to
The Services are provided to businesses (steel fabricators and their teams). This policy covers personal data of: (a) users of the platform (your account holders and their staff), and (b) visitors to our website. Where we process data on behalf of a customer (e.g. the contents of uploaded drawings that contain personal data), we act as a processor and the customer is the controller — see our Data Processing Agreement.
2. Data we collect
a. Account & identity data — name, work email, password (hashed), organisation, role.
b. Usage data — log-ins, actions in the app, device/browser info, IP address, timestamps, correlation/request IDs, and error diagnostics.
c. Customer content — files you upload (structural drawings, Excel schedules) and the takeoffs, weights, and quotes we generate. These may incidentally contain personal data (e.g. an engineer’s name in a title block). We treat customer content as confidential.
d. Communications — messages, support requests, and feedback you send us.
e. Billing data — billing contact and transaction records (card data is handled by our payment processor, not stored by us).
We do not intentionally collect special-category/sensitive personal data, and ask that you not upload it.
3. How we use data (and our lawful basis)
| Purpose | Lawful basis (PDPL) |
|---|---|
| Provide and operate the Services (run the pipeline, generate takeoffs/quotes) | Performance of a contract |
| Authenticate users, secure accounts, prevent abuse | Contract / legitimate interests |
| Support and respond to requests | Contract / legitimate interests |
| Improve reliability and accuracy (debugging, aggregated metrics) | Legitimate interests |
| Billing and record-keeping | Contract / legal obligation |
| Product/service emails you can opt out of | Legitimate interests / consent |
We do not sell personal data, and we do not use your customer content to train our own or third parties’ AI models (see §5).
4. How the platform processes your files
Tonnexis converts uploaded drawings into takeoffs using a multi-stage pipeline that includes AI vision models. To do this, the relevant pages/text of your files are transmitted to our AI sub-processors (§5) for extraction. Files are stored encrypted at rest and processed only to provide the Services. You control your content and can request deletion (§7, §9).
5. Sub-processors and third parties
We use trusted third-party providers to deliver the Services, including AI vision/extraction providers and cloud hosting/infrastructure providers. These providers process content only to the extent needed to run the Services and, under our agreements with them, do not use your content to train their models.
A current, named list of sub-processors is set out in our Data Processing Agreement (DPA) and is available to customers on request at info@tonnexis.com. We will notify customers of material changes to this list per the DPA.
6. International data transfers
We are established in the UAE. Some sub-processors are located outside the UAE (primarily the United States). Where we transfer personal data outside the UAE, we do so in accordance with the cross-border transfer provisions of the PDPL (Articles 22–23) — i.e. to jurisdictions with an adequate level of protection, or subject to appropriate safeguards or a permitted exception. Details of the mechanism relied on are available on request.
7. Retention
We retain personal data for as long as your account is active and as needed to provide the Services, then for a limited period required for legal, accounting, or dispute-resolution purposes. Uploaded files and generated outputs are retained per your organisation’s settings and our standard retention period of 24 months from the date of the relevant job, after which they may be deleted, unless you delete them sooner or law requires otherwise. Backups cycle out on a rolling basis.
8. Security
We use industry-standard measures including encryption in transit (TLS) and at rest, hashed passwords, access controls, session security, rate limiting, and audit logging. File integrity is verified (SHA-256) on ingestion. No system is perfectly secure, but we work to protect your data and will notify affected parties and the UAE Data Office of a qualifying personal-data breach as required by the PDPL.
9. Your rights
Subject to the PDPL, you may have the right to: access your personal data; correct it; delete it; restrict or object to processing; data portability; and withdraw consent. Where we process data on behalf of a customer (controller), please direct requests to that customer; we will assist them as their processor. To exercise rights for data we control, contact info@tonnexis.com. You may also lodge a complaint with the UAE Data Office.
10. Cookies
Our website and app use strictly necessary cookies required for core functionality, such as maintaining your login session and protecting against cross-site request forgery. We do not currently use advertising or third-party tracking cookies. If we introduce analytics cookies in the future, we will update this section and, where required, seek your consent.
11. Children
The Services are for business use and not directed to individuals under 18.
12. Changes
We may update this policy; we will post the new version with a revised effective date and, for material changes, take reasonable steps to notify you.
13. Contact
Data protection contact: info@tonnexis.com
General: info@tonnexis.com · Smart Station, First Floor, Incubator Building, Masdar City, Abu Dhabi, United Arab Emirates