Privacy Policy

Fairlyst Software Systems L.L.C. ("Fairlyst", "we", "us" or "our") is a software company registered in Abu Dhabi, United Arab Emirates.

We build and operate:

• RICO by Fairlyst (Regenerative Innovation for Climate Outcomes), ESG and climate reporting software for document extraction, source attribution, emissions calculation support, review workflows and evidence packs, available at rico.ae and app.rico.ae.
• Certly by Fairlyst, In-Country Value (ICV) software for score estimates, improvement suggestions, document checklists and score tracking, available at certly.ae.

Together with fairlyst.com, these are our "Websites", and the Websites and products together are the "Platform".

This Policy applies to our Websites, waitlists, demo requests, client portals, Platform registration, support communications, pilots, subscriptions and use of RICO, Certly or related services.

Fairlyst may act in different roles depending on the context:

• Controller: for personal data we collect for our own purposes, such as website enquiries, waitlist sign-ups, demo requests, account administration, billing, support, marketing, security monitoring and business operations.
• Processor or service provider: for personal data contained in documents and data that Clients upload, such as ESG evidence, supplier records, financial statements, headcount and payroll summaries, reviewer comments and reporting workflows, which we process on the Client's behalf.
• Other roles: an Order Form, Data Processing Agreement or local law may define a different role or allocation of responsibility.

Where required, Fairlyst and the Client may enter into a separate Data Processing Agreement that governs processing of personal data in more detail.

What we collect depends on your relationship with Fairlyst and which parts of the Platform you use.

We process data for specific business, contractual, security, operational and legal purposes. Depending on applicable law, the legal basis may be contract performance, legitimate interests, consent, legal obligation or Client instructions under a Data Processing Agreement.

• Platform delivery: to provide, operate, maintain, secure and support the Platform, client accounts and related services.
• ESG workflows (RICO): to classify documents, extract fields, link values to source evidence, support emissions calculations, keep review records and generate the outputs you request.
• ICV workflows (Certly): to estimate ICV scores, identify what affects your score, suggest improvements, prepare document checklists and track your score over time.
• Automated and AI-assisted processing: to process uploaded content or extracted text for classification, extraction, summarisation, calculation support and review assistance (see Section 5).
• Security and fraud prevention: to detect unauthorised access, misuse, credential compromise, unusual activity, technical errors and data-integrity risks.
• Support: to answer enquiries, manage tickets, troubleshoot problems, set up pilots and help with onboarding.
• Product improvement: to improve performance, reliability, workflows and features, using aggregated, anonymised or de-identified information wherever reasonably possible.
• Legal compliance: to comply with applicable laws, enforce agreements, keep records, respond to legal requests and manage disputes.
• Marketing: to send product updates, launch news to waitlist members and relevant content where permitted by law or with your consent. You can unsubscribe at any time.

RICO and Certly use automated and AI-assisted functionality to classify documents, extract fields, summarise content, support calculations, estimate scores, identify inconsistencies and prepare reviewable records. These outputs may contain errors, omissions or misclassifications and must be reviewed by authorised people before formal use.

• Fairlyst may use third-party AI service providers, including Anthropic where applicable, to process uploaded content or extracted text for classification, extraction, summarisation, calculation support and review assistance.
• Fairlyst does not permit third-party AI service providers to use Client Content to train public foundation models, unless expressly agreed in writing or unless Client independently gives feedback or consent directly to that provider.
• Fairlyst does not use Client documents to train, fine-tune or improve public AI models.
• Processing may generate confidence indicators, review status, source references, extracted fields, summaries, calculations, score estimates or suggested classifications.
• The Platform may record timestamped extraction events, reviewer actions, comments, corrections, approvals, exports and change history to support source-linked audit history.
• No decision with legal or similarly significant effect on an individual is made solely by automated means. Outputs are tools for your team to review.
• Retention, logging and processing by AI providers are governed by the applicable commercial terms, data processing terms, Order Forms and security documentation.

Fairlyst does not sell, rent or trade personal data. We share data only where needed to deliver the Platform, comply with law, protect rights and security, run our business or follow Client instructions.

Material subprocessors currently include Anthropic (AI processing), Zoho Creator (application hosting and workflows) and Webflow (website hosting), depending on the deployment. A current list is available on written request to privacy@fairlyst.com or in an applicable Data Processing Agreement or Order Form.

Fairlyst is based in the United Arab Emirates and supports Clients in multiple jurisdictions. Depending on your deployment, configuration, subprocessors, support needs and Order Form, data may be processed in the UAE, Saudi Arabia, the wider GCC, Europe, the United States, Africa or other regions where Fairlyst or its subprocessors operate.

Where data is transferred internationally, Fairlyst uses appropriate safeguards where required by law. These may include contractual safeguards, data processing agreements, standard contractual clauses or equivalent mechanisms, security measures, regional hosting commitments or Client-specific terms.

Unless a specific data-residency commitment is stated in an Order Form, Data Processing Agreement or enterprise agreement, Client Content, extracted data, outputs, usage data, support communications and related technical data may be hosted, stored, accessed or processed in the UAE or other jurisdictions by Fairlyst, its affiliates, infrastructure providers, AI service providers, support providers and subprocessors.

Zoho Creator and other infrastructure providers may host data in region-specific data centres depending on account setup and configuration. The hosting region for a specific Client deployment can be confirmed in the relevant Order Form, security documentation or Data Processing Agreement.

Fairlyst processes personal data in accordance with this Policy and, where applicable, UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data and other data protection laws that apply to the relevant Client, data subjects, processing location and contractual arrangement.

We keep data only as long as reasonably necessary for the purposes in this Policy, to provide the Platform, meet legal obligations, resolve disputes, enforce agreements, maintain security and support Client workflows. Periods may vary by agreement, deployment, jurisdiction and legal requirement.

On termination, Clients may request export or deletion under the applicable Order Form, Terms, Data Processing Agreement or written instructions. Unless otherwise agreed, Fairlyst provides export functionality or reasonable export help for 30 days after termination before deleting or deactivating production access to Client Content, subject to legal retention obligations and backup deletion cycles.

Fairlyst uses reasonable technical and organisational measures designed to protect personal data and Client Content against unauthorised access, misuse, alteration, loss and disclosure. No software, AI system, cloud infrastructure, transmission method or storage system can be guaranteed to be completely secure.

• Role-based access and account-level permissions where supported by the deployment.
• Authentication and administrative access controls.
• Encryption, backups, data segregation and infrastructure safeguards provided by our hosting and platform providers where applicable.
• Monitoring, logging and troubleshooting processes designed to detect errors, misuse or unauthorised access.
• Source-linked review history and timestamped system events to support accountability.
• Incident-response procedures to investigate, contain and notify affected Clients where legally or contractually required.
• Subprocessor certifications may vary by provider, region, data centre and configuration.

Clients may request security documentation, subprocessor information or data-processing details as part of a paid plan, pilot, security review or Order Form.

Depending on your jurisdiction, role and relationship with Fairlyst, you may have the following rights over your personal data. To use them, email privacy@fairlyst.com. We will respond within the period required by law, or within 30 days where no shorter period applies.

Our Websites and Platform may use cookies, local storage, pixels, server logs and similar technologies for authentication, security, functionality, analytics and performance. We never use Client ESG or ICV data for third-party advertising.

• Strictly necessary: authentication, session management, load balancing, fraud prevention and security.
• Functional: remembering preferences such as language, region, dashboard settings or display choices.
• Analytics: understanding aggregated usage, diagnosing errors and improving performance.
• Marketing: used on public website pages only where permitted by law or consent, and never applied to Client data inside the Platform.

You can manage cookies through your browser settings or any cookie settings panel on our Websites. Disabling some cookies may affect how the Platform works.

This Policy may be made available in English, Arabic or other languages for convenience, accessibility or regional use. Unless expressly stated otherwise in a signed agreement, the English version controls.

If an Arabic or other translated version conflicts with the English version, the English version prevails to the maximum extent permitted by law. Where law requires an Arabic version or gives it legal effect, Fairlyst will use commercially reasonable efforts to ensure the Arabic version reflects the meaning of the English version.

Fairlyst may provide privacy, operational, legal, billing, security, support or service notices in English and, where commercially reasonable, Arabic.

The Platform is a business service and is not directed at or intended for anyone under 18. We do not knowingly collect personal data from minors.

If you believe a minor has given us personal data, contact privacy@fairlyst.com and we will take reasonable steps to delete it where required by law.

If Fairlyst is involved in a merger, acquisition, financing, restructuring, sale of assets, joint venture, change of control, insolvency or similar transaction, personal data and Client Content may be transferred as part of that transaction, subject to confidentiality obligations and applicable law.

Where required, Fairlyst will give notice of material changes in ownership, data-processing responsibility or privacy practices that affect active Clients.

We may update this Policy to reflect changes in our data practices, legal obligations, subprocessors, products, automated processing or business operations.

Material changes will be communicated to active Clients by email, in-Platform notice, website notice or another reasonable method where required by law or contract. Each version shows its version number and effective date.

Continued use of the Platform after an update takes effect means you accept the updated Policy to the extent permitted by law. Where consent is required for a new processing activity, we will ask for it separately.

For privacy questions, rights requests or questions about this Policy, contact us using the details below.