Privacy Policy

1. Information We Collect

1.1 Information You Provide

When you register and use the Platform, we collect:

• Full name, email address, and password.
• Date of birth (for age verification).
• Profile information including talent category, expertise, skills, biography, and professional experience.
• Portfolio content including images and videos you upload.
• Availability and calendar preferences.
• Rate and pricing information.
• Communications you send through the Platform, including messages to other users.
• Identity verification information provided during onboarding (e.g. nationality, passport country — not passport number).
• Business details (for client accounts), including company name, website, and industry.
• Bank details, for providing payout information to clients.

1.2 Automatically Collected Information

When you use the Platform, we automatically collect:

• IP address and approximate location derived from IP.
• Device type, operating system, and browser type.
• Usage data including pages visited, features used, and interactions within the Platform.
• Session duration and engagement metrics.
• Analytics data via Google Analytics and similar tools.

1.3 Information from Third Parties

We may receive information about you from:

• Social media platforms if you choose to connect your accounts.
• Identity verification providers.
• Our AI agent partners (Society AI), who process Platform data to provide the AI Talent Agent and Client Agent features.

2. How We Use Your Information

We use your information to:

• Create and manage your account.
• Provide and operate the Platform, including talent matching and job discovery.
• Power AI features including smart matching, profile optimisation, and job recommendations.
• Send service communications including booking updates, account notifications, and security alerts.
• Send promotional content about Thrilla (you may unsubscribe at any time).
• Improve Platform performance and user experience.
• Analyse usage patterns and engagement.
• Verify user identity and maintain Platform safety.
• Comply with legal obligations.

We do not sell your personal data.

3. Legal Basis for Processing

3.1 UAE Personal Data Protection Law (PDPL)

As a UAE-incorporated entity, our primary data protection framework is UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data ("UAE PDPL"). We process personal data on the following bases:

• Consent — where you have provided explicit consent (e.g. joining the waitlist, receiving marketing communications).
• Contractual necessity — to provide the services you have requested and to fulfil our obligations under these Terms.
• Legitimate interests — to operate, secure, and improve the Platform, provided such interests are not overridden by your rights.
• Legal obligation — where processing is required to comply with UAE law.

3.2 GDPR / UK GDPR (EU and UK users)

If you are located in the EU or UK, we additionally rely on:

• Consent — where explicitly obtained (e.g. marketing communications, optional data collection).
• Performance of a contract — to provide Platform services.
• Legitimate interests — to improve the Platform and prevent fraud.

You may withdraw consent at any time by contacting support@thrilla.io or using the unsubscribe link in any marketing email.

4. How We Share Your Information

We share personal data only as described below. We do not sell or rent your data.

4.1 With Other Users

Your profile information — including your name, talent category, portfolio, skills, and availability — is visible to other users of the Platform as part of the marketplace functionality. You control what you include in your profile.

4.2 With Service Providers (Sub-Processors)

We share data with the following categories of trusted service providers:

• CRM and outreach: MailChimp
• Email delivery: transactional and marketing email providers
• Analytics: Google Analytics
• Hosting and infrastructure: AWS cloud hosting providers
• AI agent platform: Society AI (PUBLC Foundation LTD) — processes Platform data to provide AI Talent Agent and Client Agent features

All sub-processors are required to maintain appropriate security measures and may only process your data for the purposes we specify.

4.3 Legal Requirements

We may disclose your data where required by UAE law, court order, or regulatory authority.

5. Data Retention

We retain personal data for as long as necessary to provide the Platform and fulfil the purposes described in this Policy. Specific retention periods:

• Active account data: retained for the duration of your account.
• Profile and portfolio content: retained until you delete the content or your account.
• Communications: retained for up to 3 years for dispute resolution purposes.
• Analytics data: retained for up to 26 months (Google Analytics default).
• Marketing email records: retained until unsubscribe or deletion request.

Following account deletion, we may retain anonymised or aggregated data for analytical purposes. Personal data is securely deleted or anonymised within 30 days of an account deletion request, except where retention is required by law.

6. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access — request a copy of the personal data we hold about you.
• Correction — request correction of inaccurate or incomplete data.
• Deletion — request deletion of your personal data (subject to legal retention requirements).
• Restriction — request that we limit how we use your data.
• Portability — request your data in a portable format (EU/UK users).
• Objection — object to processing based on legitimate interests.
• Withdraw consent — where processing is based on consent, withdraw it at any time.

To exercise any of these rights, contact us at support@thrilla.io. We will respond within 30 days. We may need to verify your identity before processing your request.

7. Cookies & Tracking

We use cookies and similar tracking technologies on the Platform. Cookies are categorised as follows:

• Strictly necessary cookies — essential to Platform functionality. Cannot be disabled.
• Analytics cookies — help us understand how users interact with the Platform (e.g. Google Analytics). These can be disabled through your browser settings or our cookie preferences panel.
• Marketing cookies — used to deliver relevant content and measure campaign effectiveness. You may opt out at any time.

You can manage cookie preferences through your browser settings. Note that disabling certain cookies may affect Platform functionality.

8. International Data Transfers

THRILLA GLOBAL FZCO is incorporated in the UAE. Your data may be stored or processed in the following locations:

• United Arab Emirates — primary data residency.
• United States — via service providers including Google Analytics and AWS.
• European Union / United Kingdom — where our hosting or sub-processor infrastructure is located.

Where we transfer data internationally, we ensure appropriate protections are in place, including contractual safeguards consistent with UAE PDPL requirements and, where applicable, EU Standard Contractual Clauses.

9. Data Security

We implement commercially reasonable technical and organisational security measures to protect your personal data, including:

• Encrypted data transmission (TLS/HTTPS).
• Firebase authentication with secure credential management.
• Cloudflare bot protection and DDoS mitigation.
• Access controls limiting data access to authorised personnel.

No digital platform can guarantee absolute security. In the event of a data breach that poses a risk to your rights, we will notify affected users and relevant authorities as required by UAE PDPL and applicable law.

10. Children's Privacy

The Platform is not directed at individuals under the age of 18. We do not knowingly collect personal data from anyone under 18. If we become aware that a user under 18 has created an account, we will take steps to delete the account and associated data promptly. If you believe a minor has provided us with their data, please contact support@thrilla.io.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified via email or in-platform notification. The "Last Updated" date at the top of this Policy will reflect the most recent revision. Continued use of the Platform after changes take effect constitutes acceptance of the updated Policy.

12. Contact & Complaints

For any questions, requests, or concerns regarding this Privacy Policy or our data practices:

• Email: support@thrilla.io
• Address: THRILLA GLOBAL FZCO, IFZA, Dubai Silicon Oasis, Dubai, UAE

If you are an EU or UK user and are not satisfied with our response to a data-related request, you have the right to lodge a complaint with your local data protection authority.