Privacy notice

This notice explains what personal data DUNEFORMA ("we") handles when agencies use the DUNEFORMA portal, and the rights people have under the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL). Contact: decastrojohn001@duneforma.com.

What we collect

• Account data: your work email address, company name and, optionally, your name.
• Shoot data: property name and address, notes and comments you write, and the photos you upload.
• Photos may contain personal data (for example a person, a family photo on a wall or a car number plate). We remove temporary people and clutter during retouching, but the originals you upload still contain them.
• Teaching and feedback data: hand-edited photo pairs, technique notes and files you upload on the Teach page, answers to questionnaires, and feedback you send (the text, the page you were on, your device type and an optional screenshot).
• Learning data: measurements taken from your approved and hand-edited work (for example typical brightness and colour), used inside your company to tune the quality checks and the suggested AI. You can switch learning off in Settings.
• AI keys: if you add your own AI key it is stored encrypted and used only to run your retouches.
• Technical data: sign-in times and basic logs needed to keep the service secure.

Why we use it

• To provide the service you asked for (contract): storing, retouching and delivering photos, signing you in.
• To keep the service secure and prevent abuse (legitimate interest).
• To keep the business records the law requires.

We do not sell personal data or use your photos for advertising, and we do not train AI models on them. DUNEFORMA staff who run the service can open photos and shoots to support you.

Who processes it for us

We use a small number of trusted service providers, under contract, for cloud hosting and storage, sign-in and email, and AI image editing. They process data only to provide the service to us, and each AI provider's own terms apply to the photos sent to it (check the provider for its training and retention policy, especially if you use your own key). Some of them process data outside the UAE; where the PDPL requires it, we rely on appropriate safeguards in our agreements with them. A list of providers is available to clients on request.

How long we keep it

• Original photos you upload: deleted 90 days after the shoot is settled (every photo delivered or approved, and nothing changed since). Hand-edit pairs, technique files and feedback screenshots are kept until you or the studio remove them.
• Retouched photos delivered to you: kept in the portal while your account is open, and deleted when you ask or when the account closes.
• Working copies on the studio's own computers (kept so we can make revisions): deleted when you ask.
• Account and shoot records (without photos): while your account is open, then up to 12 months.
• Business records the law requires us to keep: for the period the law sets.

Your rights

You can ask to access, correct or delete your personal data, to restrict or object to processing, and to receive a copy of data you provided. Companies can delete their own shoots in the portal at any time before work starts; for anything else email decastrojohn001@duneforma.com and we will reply within 30 days.

Security

Each company can only see its own shoots and photos. Files are private and shared only through links that expire after one hour. Access is by emailed sign-in link. No system is perfectly secure; tell us at once if you suspect misuse of your account.

Changes

We will update this notice when our practices change and show the date above.