Privacy Policy
Last updated: 20 September 2026
1. Who we are
FirstPass AD (“we”, “us”) provides an AI-assisted pre-submission review platform for civil infrastructure drawing packages in the Emirate of Abu Dhabi. This policy explains what we collect, why, and how we handle it.
2. What we collect
- Account data — name, email, organisation and authentication details.
- Project content — the drawing packages, documents and screening data you upload and generate.
- Usage and technical data — log data needed to operate, secure and improve the Service.
- Billing data — handled by our payment processor; we do not store full card details.
3. How we use it
We use your data to provide and secure the Service, generate the analyses and deliverables you request, process payments, and communicate with you. We process project content only to deliver the Service to your organisation.
4. AI processing
To produce findings, relevant project material is sent to third-party AI model providers for processing, under contractual confidentiality terms and only after your organisation has consented for that package. We do not use your confidential project content to train publicly available models.
We use more than one model provider, and material from real customer packages has been processed by more than one of them. The named list of providers is available to your organisation on request, under confidentiality. If we add or change a provider, we will update section 6 before customer material reaches it.
5. Storage, access and security
Project files are held in private storage and scoped to your organisation; access is restricted by row-level security so users see only their own organisation’s data. We use the infrastructure providers named in section 6 and apply reasonable technical and organisational safeguards. No system is perfectly secure, and you upload material at your own risk.
6. Sharing and sub-processors
We do not sell your data. We share it only with the service providers needed to run the platform, under appropriate terms, or where required by law. These are the categories of provider we use today, what each one handles, and where it processes your material:
| Provider category | What it handles | Where it processes |
|---|---|---|
| Cloud database, authentication and file storage | Your account, your organisation’s records and your uploaded drawing packages. | United States. |
| Application hosting | Serving the platform and running its server-side processing. | United States for server-side execution; static assets from a global edge network. |
| AI model providers | AI processing of drawing images and extracted text, per package and only with your consent. | Provider-operated infrastructure; we have not contracted a specific processing region. |
| Payment processing | Card payments. Full card details are handled by the payment processor and are never stored by us. | Provider-operated infrastructure; we have not contracted a specific processing region. |
| Transactional email | Sign-in links, notifications and replies to your messages. | Provider-operated infrastructure; we have not contracted a specific processing region. |
A named list of our sub-processors, with the terms each is engaged under, is available to your organisation on request and under confidentiality. We will tell you before a new category of provider receives customer material.
7. Where your data is processed
FirstPass AD serves the Emirate of Abu Dhabi, but the Service does not run on UAE-resident infrastructure. Your account data, uploaded drawing packages, extracted values and generated deliverables are stored and processed outside the UAE — principally in the United States, as set out in the table above — and material sent for AI processing leaves the UAE as well.
By using the Service you accept that transfer. If your organisation or your client contract requires data to remain in the UAE, we cannot meet that today; please tell us before you upload anything.
8. Retention and deletion
We retain your data for as long as your account is active or as needed to provide the Service and meet legal obligations. You may request deletion of your account and associated project data by contacting us.
One exception you should know about. To avoid re-sending the same material to a model and to keep results reproducible, we cache model responses keyed by a hash of their input. Those cached responses are derived from your project content, but — unlike everything else we hold — they are not linked to an organisation or a project record, they have no automatic expiry, and deleting your account and project data does not currently remove them. We are addressing this; until we do, treat it as a stated limit on the deletion described above rather than something the deletion covers.
9. Your choices
You may access, correct or delete your account information, and request a copy or deletion of your data, subject to applicable law and to the cache limitation stated in section 8. Contact us to exercise these rights.
10. Changes
We may update this policy from time to time and will notify you of material changes through the Service or by email.
11. Contact
Questions about privacy? Contact us through the form at our contact page.
This policy describes how we handle your data and does not constitute legal advice. It has not yet been reviewed by legal counsel against UAE data-protection law; the date above changes when it has.