WeyQi Privacy Policy

1. Who we are

Indura Tech FZCO, operating WeyQi ("WeyQi," "we," "us" or "our"), is based at Dubai Silicon Oasis, Dubai, United Arab Emirates. We provide services for brands and agencies to administer campaigns, loyalty, advocacy, referrals, user-generated content (UGC), verification, moderation, scoring, reporting and rewards.

Our privacy contact is privacy@weyqi.com. You may also address correspondence to Indura Tech FZCO, operating WeyQi, at the address above.

2. Scope and definitions

"You" and "your" mean an individual whose personal data is covered by this Policy, including a visitor, business contact, creator, participant or person whose relevant social content we process. "Personal data" means information relating to an identified or identifiable person. A "Brand" is the organisation responsible for a program or content reuse; an "Agency" acts for a Brand. A "program" includes a campaign, activation, loyalty or referral initiative supported through WeyQi.

This Policy covers WeyQi websites displaying it, accounts, dashboards, program pages and microlinks, supported integrations, business communications and associated security and compliance activities. Program notices, customer privacy notices, our Data Processing Addendum (DPA) and Cookie Notice provide further information for their respective activities. This Policy does not itself grant content rights or constitute consent to optional marketing. Mandatory privacy protections and source-platform restrictions continue to apply.

3. Our privacy roles

WeyQi is a controller where it determines why and how personal data is processed, including its website, business relationships, account administration and necessary operational or compliance records. A role depends on the actual processing, not simply the description in a contract.

For customer-directed programs, WeyQi generally processes data on behalf of the responsible Brand, or an Agency acting for that Brand, under documented instructions and the DPA. The responsible customer determines the program purpose, rules, recipients and lawful retention requirements. We help identify that customer, route requests promptly and assist it, while fulfilling obligations that apply directly to WeyQi.

A limited independent purpose, such as a necessary legal claim or account-security record, requires its own lawful basis. It does not turn all customer data into WeyQi data for independent use. Meta data handled for a customer remains subject to the stricter client-purpose limits in Section 7.

4. People covered

This Policy covers visitors; customer and agency personnel; creators, participants, advocates, referrers and loyalty members; reward claimants; business partners; support contacts; and people appearing in relevant content. It also covers individuals whose public posts or interactions we collect for a disclosed purpose before they have registered or joined a program. Finding a post does not by itself enrol its author or grant promotional reuse permission.

5. Personal data we collect

The information depends on your interaction, the enabled feature and available permissions. We collect only the data needed for the relevant purpose.

We do not routinely request sensitive personal data, such as health information, government identifiers, precise location or biometric templates. Do not provide it unless an expressly identified, lawful workflow requires it. Content can incidentally reveal sensitive information about you or others; we restrict or remove unnecessary information. We do not use content similarity analysis to identify people biometrically or infer sensitive personal attributes.

6. Where personal data comes from

• Directly from you through forms, account connections, submitted post links, program entries, communications and privacy choices.
• Automatically through use of our websites and services, including cookies, usage events and system logs.
• From Brands, Agencies and other customers administering programs, and from supported referral workflows.
• From social platforms and their interfaces, public posts and profiles, and third-party collection or integration providers, within the access and uses permitted for the relevant source.
• From authentication, hosting, analytics, security, moderation, verification, communications and fulfilment providers, and from advisers or authorities where relevant.

Social collection may identify content through an account connection, supplied post link, program hashtag, mention or other supported discovery feature. We may receive relevant public content without its author connecting an account or joining a program. Public availability, a hashtag or a provider connection does not remove privacy rights or establish permission for unrestricted collection, personal profiling or reuse.

For indirectly obtained data, we provide any additional notice required by law within the applicable period, unless a lawful exception applies. You may ask us about the source of your data. Section 8 explains the purpose and legal basis of discovery before participation.

7. Social platform connections and content rights

Supported access including Instagram and Facebook

This Policy covers Instagram and Facebook where enabled, and other supported social platforms. Available data depends on the product, account configuration, permissions and approved use. The connection screen identifies requested access. Messaging, publishing, advertising or additional integrations operate only when separately enabled with the required permissions and disclosures.

Facebook and Instagram information may include permitted account or Page identifiers, profile details, account type, connected accounts, media, captions, source links, timestamps, mentions, hashtags, comments and engagement or performance metrics. We use it to maintain the connection, discover relevant content, verify disclosed participation requirements, manage content permissions and provide permitted program analysis and reporting. Account connections do not provide unrestricted access to other accounts or private conversations.

We receive social information directly and through collection or integration providers. Source restrictions apply to both routes. We do not bypass privacy settings, access restrictions or revoked permissions. A client instruction or provider service does not itself authorise a collection method or use.

Limits on Meta data

"Meta Platform Data" means information obtained directly or indirectly from Meta, through its platform or through the relevant app, within the meaning of Meta's Platform Terms. It includes applicable identifiers, credentials and data derived, aggregated or anonymised from that information. Changing a format or removing names does not by itself remove those restrictions.

When acting as a Meta Tech Provider, WeyQi processes a customer's Meta Platform Data only on that customer's behalf and instructions for the permitted service. We keep customers' data separate and do not reuse it for another customer, independent profiling, cross-client benchmarking or our own unrelated analytics. Disclosures are limited to that customer, necessary service providers, expressly directed and permitted customer-provider transfers, and legally required disclosures, as allowed by Meta's terms.

We do not sell, license or purchase Meta Platform Data, disclose it to data brokers, or use it for prohibited discrimination, surveillance or eligibility determinations. The latter include decisions about housing, employment, insurance, education, credit, government benefits and immigration. Program processing must also fall within Meta's permitted uses; the descriptions of scoring and rewards in this Policy do not create an exception to those limits.

We do not build or augment user profiles using Meta Platform Data without the valid user consent required by Meta, re-identify protected data, or use it to train general-purpose or generative AI models. Service providers cannot use it for their own training or other independent purposes. These restrictions apply throughout this Policy, including its references to analytics, security, improvement, recipients and retention.

Credentials and disconnection

Social authentication takes place through the relevant provider. We do not ask for or receive your Facebook or Instagram password. We protect tokens and app credentials, limit authorised access and exclude them from public outputs and client downloads. We stop using and promptly remove or disable credentials when access is revoked, the connection ends or they are no longer needed.

You can revoke access through the platform's connected-app, Apps and Websites or business-integration settings, or a WeyQi disconnection control where available. We stop future access through that connection and act on any resulting deletion obligation without requiring a duplicate email. Section 18 also provides a direct request route.

Permission for content reuse

WeyQi's social UGC workflow records permission for identified content and the responsible Brand. Before promotional reuse requiring permission, the rights request or opt-in specifies the intended scope. Records can include the creator's handle, asset and source IDs, program, permission text and version, acceptance time, permitted uses, channels, territory, duration and any withdrawal or expiry.

A copyright licence, a privacy-law basis and permission to access platform data address different rights. One does not replace the others. Promotional use remains limited by the actual licence, privacy law and source-platform conditions. A creator can grant only rights they hold or may authorise, including relevant rights in other people's images, music and voice. Where processing relies on privacy consent, withdrawal ends that consent-based use without affecting earlier lawful processing.

Deleted or unavailable source posts

When we learn that a source post has genuinely been deleted, we promptly disable further display, download, export and promotional reuse of the affected platform-sourced copy within WeyQi, and delete the copy and related data as required by the applicable platform terms. Prior UGC permission or the absence of a separate deletion email does not justify continued use contrary to those terms.

A failed link can reflect expiry, changed visibility or a temporary problem rather than deletion. We assess the source through permitted means and restrict affected use where appropriate while resolving its status. Platform notifications do not necessarily identify every deletion immediately. You can notify us with a post link or other locating details. Section 11 covers client copies; Sections 15 and 18 cover retention and requests.

8. Purposes and legal bases

Where WeyQi acts for a customer, that customer establishes the applicable lawful basis and WeyQi follows its documented instructions. For customer-directed discovery, the Brand deciding which program or subject to monitor is generally the controller; an Agency may act for it. If WeyQi independently determines a purpose, WeyQi is the controller for that processing. We can identify the responsible controller on request.

Where the UAE Federal Personal Data Protection Law applies, we use consent or a specific permitted exception. For initial public-content discovery, an exception may apply to information the individual has made publicly available, only within that exception's scope. A post's visibility does not establish consent from everyone depicted in it or permission under Meta's rules. Contractual necessity, legal duties and claims are used only where the relevant UAE exception applies. We do not treat the EEA or UK legitimate-interests ground as a universal legal basis.

We assess an identified legitimate interest against necessity, reasonable expectations and effects on individuals, and honour applicable objections. A contract with a Brand is not a contract with every person appearing in collected content. Later registration, a reward claim or a reuse opt-in does not retrospectively authorise earlier collection. Where a lawful basis or required platform permission is absent, the relevant processing must not proceed.

Required fields and the consequences of withholding them are explained in the relevant workflow. Missing necessary data can prevent connection, entry verification or reward fulfilment. Optional marketing choices remain separate.

9. Automated processing and scoring

WeyQi uses rules, statistical analysis and AI-assisted tools to classify content, calculate scores and rankings, identify duplication or manipulation, and support moderation and program decisions. Principal factors include program relevance, content quality and originality, publication timing, permitted engagement signals, participation limits and integrity or safety indicators. Weighting and applicable eligibility rules depend on the program.

Scores and rankings are generated automatically. Relevant activity and quality can increase a score; duplication, ineligible activity or integrity findings can reduce, exclude or flag an entry. Depending on the program configuration, these results may feed automated entry validation or reward calculations, or inform a customer's decision. They can affect content acceptance, ranking, eligibility or reward amount. The program notice explains whether final eligibility or reward outcomes are automatic or require confirmation by a reviewer. An automated score is not itself evidence of human review.

Content classification concerns a post's characteristics. Analysis linked to a person that evaluates their behaviour or performance may also be profiling and remains subject to the consent and permitted-use restrictions in Section 7. A fraud or moderation flag can be incorrect and is not a definitive finding of misconduct.

You can email privacy@weyqi.com to request an explanation, correct relevant information, express your view, contest an outcome and ask for review by a person able to reconsider it. We handle the request or route it to the responsible customer and provide the assistance and safeguards required by law. If a solely automated decision has legal or similarly significant effects, we apply the applicable jurisdiction's conditions and safeguards, including meaningful information and human intervention where required. We do not use confidentiality as a reason to withhold information the law requires.

10. Cookies and similar technologies

Cookies and similar technologies support authentication, security, preferences and, where enabled, analytics or embedded content. The WeyQi Cookie Notice explains the relevant categories and controls.

Where consent is required, optional technologies are not activated before it is given. You can reject optional technologies or change your choice through the offered controls, and use browser settings. We honour legally recognised preference signals, including Global Privacy Control where applicable. New advertising technologies require the appropriate notices and choices before use.

11. Who receives personal data

• The Brand and authorised Agency personnel responsible for the relevant program, content permission or reward.
• Providers of hosting, storage, authentication, collection or integration, analytics, communications, moderation, verification, security, payments, support or fulfilment.
• Connected social platforms where necessary for the authorised connection or applicable platform obligations.
• Professional advisers, auditors, insurers and transaction counterparties where necessary and subject to appropriate confidentiality safeguards.
• Authorities or other parties where disclosure is legally required or otherwise lawfully necessary to protect rights and safety.
• Other recipients you direct or validly authorise us to use.

Recipients receive only information needed for their permitted role. Providers are bound by appropriate confidentiality, security, purpose and deletion terms, including restrictions on their own providers. Meta Platform Data may be disclosed only through a route permitted by Meta's terms. When a relevant provider engagement ends, that provider must stop processing and promptly delete the Meta data as required.

Program dashboards may show relevant content, handles, scores, claims and permission records to authorised customer users. Public leaderboards or showcases display selected content, names, handles or rankings only as described for that feature. Contact details, private claim information and credentials are not made public merely because a leaderboard is public.

Where permitted, authorised customers can download cleared content and relevant records to their own systems. External asset-library, CRM or reporting integrations apply only where separately enabled and authorised. A download remains subject to its content permissions, privacy law and source restrictions.

If deletion or changed rights affect a disclosed asset, we restrict our controlled copies, instruct our processors and obtain appropriate confirmation. We notify relevant independent customer controllers, require action where we have authority and follow up on required removal. We cannot remotely erase every downloaded file or independent publication, but we fulfil our notification and assistance duties and explain unresolved parts of a request. A local download does not become an independently sourced copy.

12. Sale and targeted advertising

WeyQi does not sell personal data for money. We do not sell or license Meta Platform Data or use it for cross-context behavioural advertising. Some laws define sale, sharing or targeted advertising more broadly than a cash transaction. Any activity within those definitions requires applicable disclosures and opt-out controls and remains subject to platform prohibitions. We do not knowingly sell or share children's personal data for targeted advertising.

13. International transfers

WeyQi operates from the UAE. Customers and service providers may process information in other countries, including through remote access, where privacy laws differ from those where you live.

For transfers requiring legal safeguards, we require an applicable transfer mechanism. This can be an adequacy decision or approved contractual safeguards, such as the European Commission's Standard Contractual Clauses for relevant EEA transfers and the UK Addendum or International Data Transfer Agreement for relevant UK transfers. We assess whether supplementary protection is required. Transfers governed by Meta's terms are also subject to the transfer clauses incorporated into those terms. UAE transfers follow the applicable UAE requirements.

Email privacy@weyqi.com for the destinations, recipients and mechanism relevant to your information, and a copy or explanation of the safeguards, with lawful redactions where necessary. Transfer safeguards do not authorise an otherwise prohibited disclosure or use.

14. Security

We use technical and organisational safeguards appropriate to the processing risks, including access controls, authentication and secrets protection, encryption where appropriate, monitoring, secure development, vendor restrictions, backups and incident response. We investigate incidents and notify affected customers, people, authorities and Meta as required by the applicable obligations.

No system is completely secure. Report a suspected vulnerability, exposed content or security concern to privacy@weyqi.com without including passwords, usable tokens or unnecessary personal data.

15. How long we retain personal data

Standard retention periods

We keep personal data only while necessary for a disclosed, lawful purpose. The following periods are WeyQi's standard limits and fallback periods for customer-controlled data without a different lawful schedule. They are not minimum holding periods or permission to retain unnecessary data. The tax row states a legal minimum for the records it covers. Earlier legal or platform deletion duties and valid requests take priority.

Customer instructions

Where we act for a Brand, Agency or other customer, we retain, return or delete its data as required by its lawful documented instructions, the DPA and an agreed retention schedule. A shorter or longer customer period must be necessary, proportionate, supported by a lawful basis and disclosed as required. It applies only to the specified customer-controlled records and cannot override platform restrictions, the 90-day limit for content awaiting reuse permission, or a right that must be honoured.

On service termination, we return or delete customer data under the applicable offboarding arrangements. A standard maximum does not entitle us to keep all data after the service ends. We do not implement instructions requiring unlawful or indefinite retention.

Earlier deletion and platform requirements

We promptly update or delete Meta Platform Data following a relevant user or Meta request. We delete it as soon as reasonably possible when the permitted need ends, the relevant service stops, Meta or law requires deletion, or a user request or account closure triggers deletion under Meta's terms. For Tech Provider data, this also includes a client request or the client ceasing to have an account with us. Any exception must actually be permitted by the applicable terms.

A content licence, general fraud-prevention interest, client instruction or backup cycle does not override those duties. Legally required retention is limited to the required information and period, restricted to that purpose, with evidence of the requirement available to Meta where required. Meta data received in error is reported and deleted as required by its terms.

Deletion covers affected media, previews, metadata, scores and other identifiable derivatives, indexes, caches and controlled provider copies, as applicable. Hiding content is not completed deletion. Required source-post action follows Section 7, and recipient action follows Section 11.

Limited exceptions and review

For other data, a binding legal requirement, specific dispute or documented investigation may justify retaining only the necessary records beyond a standard limit. We record the reason, scope and review or end date, restrict access and review continued need at least annually. Platform data remains subject to the stricter rules above. The longest period never automatically applies to an entire account or content archive.

We use genuine anonymisation only where it satisfies the relevant duty and source terms allow it. Hashing or pseudonymisation alone does not remove privacy or platform obligations. Routine imports, reconnection or backup restoration must not revive data or permissions that must remain deleted or expired.

16. Children and minors

Our general services and creator participation are intended for adults aged 18 or older, or the age of majority where higher. A program permitting younger participants must expressly say so and provide the age controls and parent or guardian authorisation required by law. If you believe we hold a child's data unlawfully, contact privacy@weyqi.com so we can investigate and remove or restrict it as appropriate.

17. Your privacy rights

Depending on applicable law and our role, you may request information, access, a copy or portability; correction; erasure; restriction; objection to processing; withdrawal of consent; opt-out of sale, sharing, targeted advertising or certain profiling; and review of qualifying automated decisions. You may also appeal a refusal where applicable and complain to a competent regulator. We do not unlawfully discriminate against people for exercising rights.

Consent withdrawal does not affect earlier lawful processing. Rights have conditions and limited legal exceptions; we explain any relevant refusal or retained information. We assist with customer-controlled records and do not deny a request solely because you never had, or can no longer access, a WeyQi or social account.

18. How to request deletion or exercise rights

Email privacy@weyqi.com with what you want deleted, corrected or otherwise addressed. A suggested subject is "Data Deletion Request" or "Privacy Request," but no particular wording is required. Provide available locating details, such as an account email, current or former handle, Brand, program or post link, and a reply address. You may request one asset, connection data, participation records or account closure. Missing optional details do not invalidate a request.

We may ask for proportionate verification of identity, control or authority, using existing information where practical. Authorised representatives and parents or guardians may act with appropriate authority. We do not routinely require government identification. Do not send passwords, tokens or unnecessary identity documents. Deletion requests are free of charge. Any fee or refusal for another type of request must be permitted by law and explained.

We act without undue delay and aim to resolve routine requests within 30 calendar days of receipt, with earlier legal and platform deadlines taking priority. Where the EU or UK GDPR applies, the usual response period is one calendar month; any lawful extension requires timely explanation. We follow other applicable deadlines and do not automatically restart a deadline when a request is reassigned or clarified.

We confirm the action taken, any limited information retained and why, applicable backup removal and any unresolved part involving another controller. You can request progress or challenge a response by replying or emailing the same address. We arrange review and provide applicable appeal information. A supported platform deletion request reaching us is handled without requiring a duplicate email.

Removing an account connection, deleting a source post, closing a WeyQi account and withdrawing a content licence have different effects. Disconnection stops future access through that connection and triggers any required deletion; source-post handling follows Section 7. Deleting WeyQi data does not itself delete the original social post, terminate every copyright licence or close a separate Brand loyalty account.

Deletion may prevent verification, updating a score, displaying content or completing a claim, subject to the disclosed rules and law. We do not automatically label post deletion as fraud or cancel an earned reward solely because a person exercises privacy rights. The separate WeyQi Data Deletion Policy and Instructions provides further detail; the email route above is available independently of that document.

19. Regional information

United Arab Emirates

Where Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data applies, we use the permitted grounds described in Section 8 and respect applicable information, access, transfer, correction, erasure, restriction, objection and automated-processing rights. You may complain to the competent UAE data-protection authority through its applicable complaints procedure.

European Economic Area and United Kingdom

Sections 8, 13, 15 and 17 to 18 describe grounds, transfers, retention and rights where the EU GDPR or UK GDPR applies. You may object to processing based on legitimate interests for reasons relating to your situation, and to direct marketing at any time. Applicable rights concerning automated decisions include safeguards described in Section 9; the EU and UK legal conditions are not identical.

You may complain to the supervisory authority where you live, work or where an alleged infringement occurred. The European Data Protection Board authority directory and the UK Information Commissioner provide contact routes. Email privacy@weyqi.com to reach the team responsible for your request and obtain information about the responsible controller or applicable regional contact.

California and other United States states

Where applicable state privacy law covers the processing, you may have access, correction, deletion, portability, opt-out and appeal rights described above. Sections 5, 6, 8 and 11 identify information categories, sources, purposes and recipient categories, and Section 15 gives retention criteria. We do not use sensitive personal information to infer sensitive characteristics. Applicable authorised-agent requests and recognised opt-out signals are honoured.

A program that constitutes a regulated financial incentive linked to personal information requires a separate notice before opt-in, including its material terms, withdrawal method and the required explanation of data value. The responsible program notice provides that information where applicable. A general UGC permission or privacy-policy acknowledgement does not substitute for that choice.

Other locations

Mandatory local protections concerning consent, transfers, security, retention and privacy rights continue to apply. Email privacy@weyqi.com for help exercising those rights or identifying the responsible customer.

20. Communications and marketing choices

We send necessary account, security, support, program-result and reward-claim messages. Collecting your name, email or loyalty identifier to verify or fulfil a claim does not enrol you in marketing.

Optional marketing and marketing-specific CRM transfers require separate disclosures and the lawful basis applicable to the sender and channel. Required consent is affirmative, identifies the sender and purpose, and is recorded with its wording, time and scope. A UGC checkbox, social login, hashtag or reward claim does not establish consent to unrelated marketing.

Unsubscribe using the message control or privacy@weyqi.com. Necessary service messages may continue. We help route requests concerning a Brand's own list. Social messaging also follows the relevant platform's permissions and rules.

21. Third party services

Linked or integrated social platforms, Brand websites, authentication services and reward providers have their own privacy notices. WeyQi remains responsible for its own processing and the obligations applicable to its providers and disclosures.

22. Changes to this Policy

We update the date above when this Policy changes, provide additional notice and obtain consent or platform approval where required before new uses begin. Changes do not retrospectively authorise collection or enlarge existing content licences.

The current published version is available on the WeyQi Privacy Policy page.

23. Questions and complaints

For questions or complaints, email privacy@weyqi.com. We investigate and respond under applicable law. You may also contact a competent regulator without first complaining to WeyQi.