Privacy Policy
Clear privacy, by default. Here is what we collect, why, and the control you have.
Effective date: 5 October 2026 · Last updated: 15 October 2026
If there is any conflict between the Arabic and English versions, the Arabic version prevails.
This policy explains what personal data Otaly collects, why, who we share it with, and the choices and rights you have. One policy covers every place Otaly is offered: otaly.com, app.otaly.com, the Otaly apps for iOS and Android, channel and event pages, and organizer pages shown on a custom domain.
The short version
- OCTATIX EVENT MANAGEMENT L.L.C, the company that operates Otaly, is responsible for your personal data on Otaly.
- We collect what we need to run your account and issue your tickets. When you register for an event, its organizer receives your registration details.
- For events in Dubai, we share the ticket-holder details that DET requires with DET, because the law requires it.
- We never sell your personal data, and we do not use it for advertising.
- Card details go to Stripe. We never see full card numbers.
- You can access, correct, export or delete your data: write to support@otaly.com, or delete your account in the app.
1. Who is responsible for your data
1.1 Us. OCTATIX EVENT MANAGEMENT L.L.C (Dubai trade licence No. 1375180; Office 101-390, Al Raffa, Bur Dubai, Dubai, United Arab Emirates) is the controller of the personal data processed to run Otaly, under the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021, "PDPL"). Contact us at support@otaly.com or +971 50 740 1530.
1.2 Organizers. When you register for an event, the organizer receives your registration details and decides how to use them to run the event. The organizer is responsible for that use, and its own privacy notice may also apply to you.
1.3 Payments. Paid tickets are charged on the organizer's own Stripe account. Stripe and the organizer handle that payment data under their own privacy policies. Payments for Otaly plans are processed by Stripe on our account.
2. What we collect
2.1 What you give us
- Account details: name, email address, username, password, and optionally a photo, bio, organization and phone number.
- Organizer details: your business or legal name, trade licence and event permit numbers, venue details, and the restricted key and publishable key you give us to connect your Stripe account (the restricted key is stored encrypted). We never receive your bank account details.
- Registrations and tickets: your name, email address, phone number if the organizer asks for it, your answers to the organizer's registration questions, your ticket type, and your order and check-in status.
- Details DET requires for events in Dubai: your name, contact details and, where DET requires them, your nationality and country of residence.
- Payment records: limited details such as amount, currency, status and a payment reference. Card details go directly to Stripe.
- Messages and support: event chat messages, messages to organizers, support conversations (including with our AI support assistant), complaints and feedback.
- Content: events, images, channel pages and other content you create, and what you type into AI tools.
- Location: only if you allow it on your device, to set an event's location or show events near you.
2.2 What we collect automatically
- Device and connection data: IP address, device and browser type, operating system, language, app version, approximate location derived from your IP address, and error logs.
- Usage data: the pages and screens you view and the actions you take in the app.
- How you found us: when you sign up, the campaign tags in the link you followed and the domain of the website that referred you.
- Notifications: a push token for your device, if you turn on notifications.
- Cookies and similar technologies: see section 7.
2.3 What we receive from others
- Google or Apple, if you sign in with them: your name, email address and an account identifier.
- Stripe: payment status and references.
- Organizers: if an organizer invites you or issues you a complimentary ticket, the details they enter, such as your name and email address.
- Cloudflare: the result of the automatic bot check on some forms.
3. How we use your data, and our legal basis
We use personal data to:
- create and run your account and keep you signed in;
- publish events, issue tickets, check guests in, and send confirmations, reminders and notices of changes or cancellations (these service messages cannot be switched off while you hold a ticket or an account);
- share your registration details with the organizer of each event you register for;
- process refunds, answer support requests and handle complaints;
- meet our legal duties, including DET's ticketing rules, consumer protection law (receipts, refunds and complaints), tax and record-keeping law, and lawful requests from authorities;
- keep Otaly safe: prevent fraud, spam and abuse, moderate content and enforce our Terms of Service;
- provide the AI features you choose to use;
- understand how Otaly is used and improve it (see section 7);
- send you marketing emails, but only if you have agreed. Every marketing email has an unsubscribe link.
Legal basis. Under the PDPL we process personal data with your consent or where the law allows processing without consent. Mainly, that is processing needed to perform our contract with you (your account and your tickets), to meet obligations that UAE law places on us, and to establish or defend legal claims. Where we rely on your consent, you can withdraw it at any time.
Automated tools. We use automated tools, such as bot checks and rate limits, to block spam and abuse. You can ask for a person to review any decision about your account.
5. Events in Dubai: sharing with DET
Tickets for events in Dubai, including free registrations, are issued under the rules of the Dubai Department of Economy and Tourism (DET). When DET's eTicketing system is connected for an event, we send DET the ticket and ticket-holder details it requires: your name, your contact details (phone or email) and, where DET requires them, your nationality and country of residence. We also share event, permit, sales and attendance information with DET as the law requires. We do this to comply with the law, and DET uses this data under its own legal powers. We keep the nationality and country of residence you give us for DET with your account, so you do not have to enter them again for your next event in Dubai. We use them only to meet DET's requirements and never show them to organizers. They are deleted with your account (see section 10).
6. AI features and your data
- When you use an AI feature, we send the content that request needs (such as your draft, your prompt, the event details or your question) to our AI provider to produce the result.
- Conversations with our assistants are stored so they can continue and so we can improve support.
- We do not use your private event data or attendee data to train AI models. Our AI provider processes this data on our behalf and, under its API terms, does not use it to train its models.
- AI suggestions change your content only when you accept them. We never change the text you wrote.
- Automatic translations of public event and channel pages are made from content that is already public.
8. International transfers
Our servers and many of our service providers are outside the UAE, including in the United States. When personal data leaves the UAE, we transfer it only as the PDPL allows: to countries whose data protection laws are adequate, or under contracts that require the recipient to protect it.
9. How long we keep data
- Your account: for as long as it is active.
- Events, tickets and orders: while your account is active and for as long as needed to run the event, handle refunds, disputes and complaints, and keep the records DET and other authorities require.
- Billing and transaction records: for as long as UAE tax and commercial law requires, up to seven years.
- Your Stripe connection (organizers): while it is connected, and after you disconnect for as long as needed to refund tickets already sold.
- Google Analytics visit-level data: no longer than 14 months. Our own page counts contain no personal data.
- After you delete your account: see section 10.
10. Deleting your account
You can delete your account at any time in the app under Settings → Account. If you cannot get into your account, email support@otaly.com and we will verify that the request is yours before acting on it.
- Deletion signs you out everywhere, disconnects your sign-in methods (email, Google, Apple) and hides your profile straight away.
- Your personal data and content are deleted or irreversibly anonymized within 90 days at the latest. Deletion is permanent: nothing can be restored if you come back.
- A few things are kept, in the most limited form: billing and transaction records the law requires us to keep, minimal fraud- and abuse-prevention signals, and your username.
- Your username stays reserved for you alone, so nobody else can take it. If you return and we can verify it is you, you can claim it again, empty. Signing in with the same Apple or Google account works however long you have been away; your verified email address works within 60 days of deletion.
- The web addresses of any public channels you ran are retired permanently. They are never given to anyone else, but they cannot be restored.
- If you are an organizer with upcoming events, deleting your account cancels them and ticket holders are refunded under our Refund Policy.
Deletion can be paused while one of your events is under a moderation or fraud review, or while a paid plan cannot yet be cancelled. The app tells you when this happens. Full details: Deleting your account.
11. Security
We encrypt traffic to and from Otaly (TLS), restrict access to our production systems, and keep payment card details out of our systems entirely. No system is completely secure. If a breach is likely to affect your privacy, we will notify you and the UAE Data Office as the law requires. To report a security vulnerability, email support@otaly.com or see otaly.com/.well-known/security.txt.
12. Your rights
Under the PDPL you have the right to:
- get information about, and a copy of, the personal data we hold about you;
- receive your data in a structured, machine-readable format, or ask us to send it to someone else;
- have inaccurate data corrected;
- have your data erased;
- restrict or stop our processing in certain cases;
- object to decisions made solely by automated processing;
- withdraw consent at any time, where we rely on it.
To use these rights, email support@otaly.com from the address on your account. We may ask you to confirm your identity. It is free, and we aim to reply within 30 days. If the data is held by an organizer, contact the organizer as well; we will help them answer you.
If you are not satisfied with our answer, you can complain to the UAE Data Office. If you live outside the UAE, the data protection law of your country may give you further rights, and we will respect them.
13. Children
You must be at least 16 to create an Otaly account. We do not knowingly collect personal data from children under 16. If we learn that a child under 16 has created an account, we delete it. A parent or guardian may register a child for an event where the organizer allows it.
14. Changes to this policy
We may update this policy as Otaly develops or the law changes. We change the date at the top each time, and we tell you in the app or by email before a material change takes effect.
This policy is published in Arabic and English. If the two versions differ, the Arabic version prevails.
15. Contact
- Company: OCTATIX EVENT MANAGEMENT L.L.C
- Registered office: Office 101-390, Al Raffa, Bur Dubai, Dubai, United Arab Emirates
- Email: support@otaly.com
- Phone: +971 50 740 1530
Full details: Company details.
