Privacy, in plain words.

SARZ (sarz.ae) is an AI and digital studio in Dubai, United Arab Emirates, run by two partners, Muhammad Raza (RZ) and Saish. SARZ is the trading name of RZ Webworks, Dubai trade licence No. 1657875.

RZ Webworks is the data controller for the personal data in this policy. That means we decide why and how it’s used, and we answer for it. When this policy says “SARZ”, “we” or “us”, it means RZ Webworks.

We’re licensed on the Dubai mainland, not in a financial free zone. So the law that governs how we handle personal data is the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the “PDPL”). The separate data protection laws of the DIFC and ADGM don’t apply to us.

For anything about your data, email hello@sarz.ae. Privacy questions and requests are handled by the partners directly. If we appoint a data protection officer, we’ll name them here.

This policy covers personal data we collect and use for our own business, through:

• this website, sarz.ae, including the Start a project form (/contact, and the name box on the home page) and the Book a demo form for SARZ Command (/command/demo);
• emails, WhatsApp messages and calls between you and us;
• messages and lead forms on our social media accounts;
• calls and messages we send to businesses about our own services (section 05).

It doesn’t cover the systems we build and run for our clients, such as an AI receptionist answering a client’s phone, a chatbot on a client’s WhatsApp number, or a calling campaign we run for a client. For those, the client decides how your data is used, and the client’s own privacy policy applies. Section 10 explains how that works.

The website’s terms cover everything else about using this site and working with us.

We collect personal data in two ways: what you choose to send us, and a small amount of technical data that any website receives.

When you start a project or book a demo

Both forms ask the same questions, one per screen:

Nothing reaches us until you press Send. Until then, your answers stay in your own browser (section 09). When you send, our server checks the answers and emails them to our inbox, then emails you a confirmation with a copy of what you sent. The website doesn’t keep a database of enquiries: the record lives in our inbox.

If sending fails, the form offers you a pre-filled email instead. That email goes from your own email app, through your own email provider, straight to us.

When you email, message or call us

By email: your email address, your name and signature if your email includes them, and whatever you write or attach.

On WhatsApp or by phone: your phone number, your WhatsApp name and whatever you send or tell us. The WhatsApp button on this site only opens WhatsApp with a suggested first message. Nothing is sent until you press send in WhatsApp.

On social media

If you message one of our accounts, or fill in a lead form attached to one of our posts or ads (on Instagram or Facebook, for example), we receive what you send or enter: usually your name, contact details, business name and your answers. The platform collects that data first and handles it under its own privacy policy. This website has no advertising pixel, so it doesn’t track you for any ads.

If you ask us to test or audit your business (for example, how quickly your team answers an enquiry), we use what we find only to prepare your report.

Automatically, when you visit

• Hosting logs. Our host, Vercel, records basic request data for every visit: your IP address, browser and device type, the page requested, the referring page and the time. This keeps the site working and secure.
• Spam protection. When you send a form, our server uses your IP address to allow no more than five enquiries in ten minutes. The address is held only in the server’s working memory, never written to a database, and is gone when that server instance stops.
• Visit statistics. Vercel Web Analytics counts page views, referring sites, country, browser, operating system and device type. It uses no cookies. Vercel states that it tells visits apart with a hash of the incoming request that is discarded after 24 hours, so we can’t identify you or follow you to other sites.
• Speed measurements. Vercel Speed Insights measures how fast each page loads and responds on your device, with the page, browser, device type and country. No cookies.
• A “form sent” count. When a form is sent, the statistics record that it happened, which form it was, the service areas picked and the budget range. Never your name, email, business description or notes.

What we don’t collect

• No cookies, from us or anyone else.
• No advertising pixels, social-media trackers or cross-site tracking.
• No embedded social content. The Instagram images on the site are stored on our own server; Instagram only sees you if you click through.
• No outside font service. Our fonts are served from sarz.ae itself.
• No access to your location, camera or microphone. The site tells your browser to block them.
• No AI service reads your enquiry on this website. It goes from the form to our inbox, and that’s all.
• No sensitive data. Please don’t send us health, religious, biometric, financial account or identity-document details through the form; we don’t need them to reply.

The PDPL lets a business use personal data with your consent, or without it only in the cases the law lists. Here is each thing we do, and which of those reasons allows it.

We don’t sell or rent personal data. We don’t add anyone to a mailing list without asking. And we don’t make decisions about you by automated means alone: a person reads every enquiry.

Part of what we do is reach out to businesses: by phone, WhatsApp, email or social media. When we contact a business about our own services, these rules apply:

• Business contacts only. We contact people in their work role, about services for their business.
• We say who we are. Every call or message opens with our name and why we’re in touch, and we ask whether you’re happy to carry on. If a call is made by an AI voice agent, it tells you so. If you ask, we tell you where we got your details.
• We follow the UAE telemarketing rules (Cabinet Resolution No. 56 of 2024): calls only between 9am and 6pm UAE time, no calls to numbers on the TDRA’s Do Not Call Register, and no pressure or misleading offers.
• No means no. If you say no, don’t answer or hang up, we won’t keep calling: at most once more that day and twice that week, and never again about the offer you turned down.
• Recording. We record a call only after telling you at the start. Recording a private conversation without permission is a crime under the UAE Cybercrimes Law (Federal Decree-Law No. 34 of 2021), and we don’t do it.
• Stop any time. Reply “stop” to any message, or tell us on the call, and we’ll mark your details so you aren’t contacted again.

You can add your number to the Do Not Call Register by texting DNCR to 2211. Calls we make for a client follow the same rules, but the client decides who is called and why (section 10).

We share personal data only with the service providers that run this site and our conversations, and only what each one needs. Vercel, Resend, our email provider and our business tools process it for us, under their data processing terms. Meta and the other social platforms run their services as controllers in their own right, under their own privacy policies.

People. Inside SARZ, your data is seen by the two partners, RZ and Saish, and by anyone working with us on your enquiry or project, only as far as they need it and under a duty to keep it confidential.

Anyone else only if the law requires it, for example a valid request from a UAE court or authority, or where we need it to establish or defend a legal claim. If we ever reorganise the business (for example, moving SARZ into a new company), your data would move with it under this policy.

Ask us at hello@sarz.ae for the name of any provider in this list.

Several of our providers store or process data outside the UAE, mainly in the United States. So when you send us an enquiry, it may leave the UAE.

The PDPL allows personal data to go to countries with adequate data protection laws, and otherwise in the cases it sets out: for example, under a contract that binds the recipient to protect the data to the PDPL’s standard, where it’s needed to perform a contract with you, or with your express consent. We rely on our providers’ data processing terms, which commit them to protect it.

The detailed transfer rules are due in the PDPL’s executive regulations, which had not been issued when we last updated this page. We’ll update this section when they are. Ask us at hello@sarz.ae and we’ll tell you more about the safeguards for any provider.

We keep personal data only as long as we need it for the purposes in section 04, then we delete it or make it anonymous.

You can ask us to delete your enquiry sooner, at any time (section 12).

This site sets no cookies. Not for analytics, not for ads, not for anything. That’s also why there’s no cookie banner.

It does use your browser’s session storage for three small conveniences. Session storage stays on your device, is never sent to us, and is wiped by your browser when you close the tab.

None of this tracks you, and it only does what you’d expect the page to do. If your browser blocks storage (in a private window, for example), the site still works: it just won’t remember these things. You can clear it any time in your browser’s settings.

If we ever add cookies or tracking, we’ll update this table first and ask for your consent before anything non-essential is set.

Most of what SARZ builds handles personal data for other businesses: AI receptionists that answer their calls and take bookings, WhatsApp chatbots on their numbers, CRMs and the SARZ Command business system, online stores and apps, email marketing, telemarketing and AI lead calling, outreach and workflow automations.

That data isn’t covered by this policy. For it, our client is normally the controller: they decide why and how their customers’, callers’ and leads’ data is used. SARZ acts as their processor. Under the PDPL, that means we:

• use the data only on the client’s instructions, only to provide the service, and under a signed agreement with them;
• keep it confidential and protect it with suitable security;
• use other providers only as needed to run the service, such as hosting, telephony, messaging, e-commerce platforms and AI model providers, and stay responsible for them;
• help the client answer requests from the people whose data it is, and tell the client without delay if there’s a breach;
• export the client’s data on request, and delete it 60 days after the engagement ends unless the law requires it to be kept.

Calls and AI. When an AI receptionist answers or a campaign calls on a client’s behalf, callers should be told when they’re speaking with an automated system and when a call is recorded. Our clients are responsible for those notices, and we build them in. Recordings from telemarketing campaigns are kept for 90 days. Material a client puts into an AI system is processed by the AI providers we use, and we name them to the client on request.

If you called, messaged or were contacted by one of our clients through a system we run, their privacy policy applies, and requests about your data should go to them. If you write to us instead, we’ll pass your request to the right client and help them answer it.

Under the UAE PDPL

You have the right to:

• be told and get a copy of the personal data we hold about you, why we use it, who we’ve shared it with (inside and outside the UAE), how long we keep it and how it’s protected, free of charge;
• move it: receive it in a structured, machine-readable format, or have it sent to someone else, where that’s technically possible;
• correct anything that’s wrong or incomplete;
• delete it, for example when we no longer need it, you withdraw your consent, or it was used unlawfully;
• restrict how we use it, for example while we check a correction you’ve asked for;
• stop us using it, including for direct marketing of any kind;
• object to decisions made about you by automated processing alone that have legal or serious effects (we don’t make any);
• withdraw your consent at any time. This doesn’t affect anything we did before you withdrew it;
• complain to the UAE data protection authority (section 12).

Some rights have limits the law sets out: for example, we may need to keep invoices for tax purposes even if you ask us to delete them. If a limit applies, we’ll tell you which one and why.

If you’re in the EU, EEA or UK

Our services are for businesses in the UAE, and we don’t target people in Europe, so in most cases the GDPR and UK GDPR don’t apply to how we handle your data. Where they do (for example, if we offer our services to you while you’re there), you also have the rights of access, rectification, erasure, restriction, portability and objection, including an absolute right to object to direct marketing. You can complain to your local data protection authority, or in the UK to the Information Commissioner’s Office.

• Email hello@sarz.ae with “Privacy request” in the subject, and tell us what you’d like. You don’t need to give a reason, use a form or quote the law.
• We may ask you to confirm it’s you before we act, usually by replying from the email address or WhatsApp number you used with us. We only ask for what we need to check.
• We’ll respond within 30 days. If a request is complex, we’ll tell you within that time if we need longer, and why.
• It’s free. We’ll only refuse a request if the law allows it, for example one that’s clearly unfounded or repeated, and we’ll explain why.
• To stop marketing, reply “stop” to any message from us, on any channel, and we will.

If you’re not happy with our answer, tell us and we’ll look at it again. You can also complain to the federal authority that oversees the PDPL. The law gave that role to the UAE Data Office, which in June 2026 became part of the new Artificial Intelligence and Data Authority.

This site and our services are for businesses and adults. We don’t knowingly collect personal data from anyone under 18. If you think a child has sent us their details, email hello@sarz.ae and we’ll delete them.

We take reasonable, practical steps to protect your data. On this website that means:

• Encrypted connections only. The site is served over HTTPS, and browsers are told never to use an unencrypted connection to it.
• Protected forms. Every answer is checked and size-limited on our server, a hidden trap field catches bots, and sending is rate-limited by IP address.
• Locked-down pages. Security headers stop other sites from framing ours, block camera, microphone and location access, and send only our domain name (never the full page address) when you follow a link away from the site.
• Secrets kept server-side. The key that sends email lives only on our server, never in the page.
• Limited access. Only the people who need enquiries and leads to do their work can see them.

No way of sending or storing data is completely secure, so we can’t promise perfect security. If a breach affects personal data we’re responsible for, we’ll report it to the UAE authority as soon as we know, as the PDPL requires, and tell you directly if it could harm your privacy or security. Where we’re a client’s processor, we tell the client straight away so they can do the same.

The site links to other services, including WhatsApp (058 970 8504), Instagram, LinkedIn, our clients’ live websites, the live demos of systems we’ve built (they run on sample data at their own addresses), Coursera’s pages for checking our course certificates, and the official sources cited in our articles. When you follow a link, you leave sarz.ae, and that site’s own privacy policy applies. We don’t control what they collect, and nothing from them loads on our pages until you click.

When we change how we handle personal data, we update this page first and change the date at the top. If a change significantly affects data we already hold about you, we’ll also tell you directly where we reasonably can.

Questions, requests or complaints about your data: email hello@sarz.ae. For anything else, the contact page or WhatsApp (058 970 8504) is quicker.

Data controller

RZ Webworks, trading as SARZ

Dubai trade licence No.

1657875

Based in

Dubai, United Arab Emirates

Email

hello@sarz.ae

Signed, SARZ.

SARZ is operated by RZ Webworks, Dubai, United Arab Emirates · Licence No. 1657875