Privacy Policy

InfoSecAgent (infosecagent.ai) is operated by DIGIAI (Digital and Artificial Intelligence Consulting FZ-LLC), a free zone limited liability company registered in the Ras Al Khaimah Economic Zone (RAKEZ), United Arab Emirates, under registration number 0000004048842 and services licence number 47011817. Registered address: FDBC0427, Compass Building, Al Shohada Road, Al Hamra Industrial Zone-FZ, Ras Al Khaimah, United Arab Emirates.

For any question about this policy or your personal data, write to info@digi-ai.tech.

We are the controller of the personal data we collect through this website and in managing our customer relationships: enquiries, demo bookings, user accounts and billing.

We are a processor of the content our customers put into the platform: client documents, evidence, interview answers, policies, statements of applicability and reports. We process that content only on our customer's instructions and under our agreement with them. If your organisation is a client of one of our customers, please contact that firm first about your data.

• Enquiries and bookings: your name, work email, company and message. Demo bookings are made through Calendly, which receives the details you enter there.
• Platform accounts: name, work email, role, login records and activity logs.
• Customer content: documents and evidence uploaded for assessment, discovery and interview answers, and the documents the platform produces. This content may contain personal data, such as the names of staff mentioned in a policy.

We do not sell personal data. We do not use customer content to train AI models.

To assess evidence and draft documents, InfoSecAgent sends the relevant excerpts of customer content to an AI model provider for processing. We currently use Anthropic (Claude). Under the provider's commercial terms, this content is not used to train its models.

The search index the platform uses to find relevant evidence is generated on our own infrastructure.

InfoSecAgent assesses an organisation's security controls. It is not used to make decisions about individuals. Everything it produces is a draft for review by the customer's consultants before it reaches their client.

Documents, evidence and reports are stored on the deployment chosen for each customer:

• UAE deployments: Microsoft Azure, UAE region.
• EU deployments: Frankfurt, Germany
• Main platform at infosecagent.ai: Frankfurt, Germany

When the platform sends excerpts to the AI provider for processing, that processing may take place outside the country where the data is stored, including US.

We share personal data only with service providers that help us run InfoSecAgent, under contracts that require them to protect it:

Customers can ask us for the current list at any time. We tell customers about changes to this list as set out in our agreement with them. We may also disclose data where the law requires it.

• Enquiries: 24 months after our last contact
• Account data: for as long as the customer's agreement is active, then 12 months
• Customer content: deleted or returned at the end of the customer's agreement, as the agreement sets out.

Each customer's clients are kept separate within the platform, and access to customer content is limited to authorised personnel.

Depending on where you are, data protection law — including the EU General Data Protection Regulation and the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) — may give you the right to access, correct or delete your personal data, to restrict or object to its use, to receive it in a portable form, and to withdraw consent where we rely on consent.

To exercise any of these rights, write to info@digi-ai.tech. If your data is part of a customer's content, we will pass your request to that customer and help them respond.

You can also complain to a data protection authority: in the EU, the authority in your country (in Greece, the Hellenic Data Protection Authority); in the UAE, the Federal Authority for Artificial Intelligence and Data.

We use only the cookies needed to keep you signed in and the platform secure.

The website uses browser local storage to remember your theme and EU/UAE content preference. It may use your browser's time-zone setting to select the initial regional content. The website loads fonts from Google Fonts, which means your browser connects to Google and shares technical connection information such as your IP address.

We will post any changes on this page and update the date at the top. If a change materially affects how we handle customer content, we will tell our customers in advance.