Privacy
Datlay is not open yet. This is version 1 of this page, published ahead of the launch in 2027. The part about this website applies now. The parts about the service, your company's account and payments apply from the day your company first uses the service, in the beta or after launch.
Who is responsible
Datlay is a product of a-systems, a brand of Rteam FZE LLC. Rteam FZE LLC runs this website and, from launch, the Datlay service. On this page "we" and "us" mean Rteam FZE LLC.
- Company
- Rteam FZE LLC, trade licence 4420354.01, Sharjah Publishing City Free Zone
- Address
- Business Centre, Sharjah Publishing City Free Zone, Sharjah, United Arab Emirates
- Contact
- support@datlay.com
We have two roles, and this page says which one applies where.
- Controller for this website, for email you send us, for your company's account with us (who signed up, who pays, the invoices, and the record of what was accepted), and for the anonymous figures described below.
- Processor for everything inside your company's Datlay workspace: your colleagues' user accounts, what Datlay reads from the systems your company connects, and the log of changes. Your company is the controller of that data, and the Data Processing Agreement sets our duties. Questions about it go first to your company.
We are established outside the European Union. We have not appointed a representative in the EU under Article 27 of the GDPR. If we appoint one, this page will name it.
This website
datlay.com sets no cookies, runs no analytics, loads nothing from a third party and has no forms. Its fonts are the ones already on your device. What exists is a web server log, with your IP address shortened before the line is written.
- What is kept
- One line for every request: the time, the request line (the page asked for), the status and the size of the answer, the referring page, the browser's own description of itself, and your IP address with its end removed. For an IPv4 address the web server replaces the last two parts with zeroes. For an IPv6 address it keeps at most the first three groups. The full address is never written to this log.
- Errors
- This site's error logs record server faults and failed connections, not ordinary requests. Such an entry can include the full IP address of the connection involved. They are kept for the same two weeks.
- Why
- To keep the site running and safe, and to see whether it is reached at all.
- Kept for
- About two weeks. The logs are rotated daily and only the fourteen most recent copies are kept.
- Where
- One server we rent from Hetzner Online GmbH in Nuremberg, Germany. The logs do not leave it.
- Cookies, trackers, third parties
- None.
Email to us and from us
Our email goes through Google Workspace, our mail service, including mail to support@datlay.com and security@datlay.com. We keep what you send and our replies, with your name and address, to answer you and to keep a record of the matter. We keep that correspondence while the matter is open, and then for as long as a claim about it could be brought. The emails the service sends go through Google Workspace, with Resend as a backup sender.
The service: your company's account
This part applies from launch. When a person signs up for Datlay for a company, and while the company uses it, we keep the following.
- Sign-up
- The person's name, role or title and work email address. The company's name, country, registration or VAT number and industry. If a partner sent you, the partner's referral code.
- Acceptance record
- When the Terms and the DPA are accepted, and again when the company first pays: the person's name, role and verified email address; the company's name, country and number; the version of each document and a SHA-256 fingerprint of the exact text shown; the time; the IP address the browser connected from; and the browser's own description of itself. This record proves who accepted which text, for which company. It is written once and never edited. If the email address is never verified, no acceptance record is kept and the pending sign-up is deleted.
- Administrators and billing
- Who the administrators and the billing contact are; the plan, size, currency and term; invoices, payments, refunds and credit notes; the billing address and the VAT or registration number.
- Abuse checks at sign-up
- To stop the trial being abused, the sign-up limits the number of sign-ups from one IP address and refuses disposable email addresses. For this it uses the IP address and the email domain of each sign-up, and keeps them no longer than the limit needs.
- Letters
- We send the letters the service needs: sign-in links, reminders before a trial ends, invoices, and notices before a change to your price, to the Terms or to our sub-processors. They carry no tracking. We send no marketing mail.
- Where the data comes from
- From you; from a colleague who entered it, such as an administrator who invited you or named you as the billing contact; or, when your company starts Datlay from an app listing in a vendor's marketplace, from that vendor, which passes us the sign-up profile (name and email address).
- Do you have to give it?
- The sign-up data is needed to open a workspace and make the contract with your company. No law requires you to give it, but without it we cannot open a workspace.
The service: inside your workspace
Each company gets its own workspace, at an address of the form name.datlay.io, hosted in the region shown in it; at launch, the European Union (Germany). In it, Datlay keeps the user accounts of your people; the documents, and their history, that it reads from the systems your company connects (for example who moved an order and when, and the customer and the amount on it); and the log of every change made through Datlay. We process this only on your company's instructions, under the DPA. Your company decides who sees what, and answers requests about it. We help it do so.
Datlay itself sends none of this to an AI provider of ours, and we do not use it to train any model. If your company connects its own AI assistant, the data that assistant reads reaches its provider, which works for your company, under your company's own terms with it.
The service sets the cookies it needs to sign you in and to keep your session and your connections secure. It sets no advertising cookies and uses no analytics service of a third party.
Anonymous figures across companies
From the process data in the workspaces, we compute aggregated figures about how processes run: how long the steps of a process take, the share of documents in a given state, and counts of documents, grouped by industry, company size and pair of connected systems. For this use we are the controller. Before any figure is computed, the identity of whoever took a step is replaced by its class (for example a person, a system or an assistant). A figure contains no personal data and no name of a company, person, customer or supplier, and it is shown or published only when enough companies contribute that no single company can be identified from it. We use the figures only to show customers how their processes compare with companies like theirs, and to publish anonymous medians. Section 12 of the DPA sets out the terms.
Payments
Payments are taken by Stripe on its own hosted pages. Card and bank details are typed into Stripe's pages and never reach our servers. From Stripe we receive what our books need: the amount, the date and the status of each payment, and the invoice.
Stripe processes payment data partly on our behalf, to provide its payment service, and partly as a controller in its own right, for purposes of its own such as preventing fraud and meeting its legal duties, for example anti-money-laundering and know-your-customer checks. Section 2 of Stripe's Data Processing Agreement and its privacy policy describe this.
Why we may
We give the legal bases in the terms of the EU GDPR. Our contract is with your company, so for the people named in it we rely on our legitimate interest. Where the UAE Personal Data Protection Law or another law applies and gives you rights, you have those rights too.
| What | Legal basis |
|---|---|
| Website log and error log | Our legitimate interest in running the site safely (Art. 6(1)(f)) |
| Email you send us | Our legitimate interest in answering you (Art. 6(1)(f)) |
| Sign-up, account, administrators, billing contacts, the letters the service needs | Our legitimate interest in setting up and performing the contract with your company (Art. 6(1)(f)) |
| Abuse checks at sign-up | Our legitimate interest in protecting the service and its customers (Art. 6(1)(f)) |
| Acceptance record | Our legitimate interest in proving the contract (Art. 6(1)(f)) |
| Invoices and payment records | Our legal duty to keep tax records (Art. 6(1)(c)); for the people named on them, our legitimate interest in billing the contract (Art. 6(1)(f)) |
| Referral code | Our legitimate interest in paying the partner who sent you (Art. 6(1)(f)) |
| Anonymous figures across companies | Our legitimate interest in showing customers how their processes compare and in publishing anonymous medians (Art. 6(1)(f)) |
| Everything inside your workspace | Your company's decision as controller. We act on its instructions (Art. 28) |
How long
- Website logs
- About two weeks.
- While the matter is open, then for as long as a claim about it could be brought.
- Sign-up, administrators and billing contacts
- While your company's account exists. They are deleted with the workspace at the end, except the two records below.
- Invoices and payment records
- For as long as tax law requires us to keep them.
- Acceptance records
- For as long as the subscription runs, and then for the period in which a claim under the contract could be brought.
- Inside your workspace
- Until 30 days after the trial or the subscription ends. Then it is deleted, and its backups can no longer be read, as section 15 of the Terms describes.
- Anonymous figures
- They hold no personal data, so they are kept.
Where the data is
This website runs on a server of Hetzner Online GmbH in Germany. Each workspace runs in the region shown in it; at launch, on servers of Hetzner Online GmbH in Germany. Backups of the workspaces are encrypted before they leave those servers. They are kept by Backblaze in its EU region in Amsterdam, the Netherlands, with a further encrypted copy at Hetzner in Germany. The sub-processors page lists every company that helps us, what each holds, and where.
We are established in the United Arab Emirates. Our staff and contractors reach the servers remotely, from the United Arab Emirates and from the other countries where they work. For personal data inside the workspaces of customers in the EU, the UK or Switzerland, the DPA covers this access with the EU standard contractual clauses and their UK and Swiss adaptations.
Google, Resend and Stripe can process data in the United States, each under the EU standard contractual clauses or, where the recipient is certified, the EU-US Data Privacy Framework. Ask us for a copy of the safeguards.
We do not sell personal data, and we do not use it for advertising.
What you can ask for
A shortened address in the website log is not something we can find you by, so a request about "your" visits to this site has nothing to match against. A server fault or a failed connection can leave a full address in an error log for two weeks, and you can ask about that like anything else.
For your email, your account data and the acceptance record, you can ask to see the data, to correct it, to have it deleted, to restrict or object to its use, or to receive it in a portable form. Some of it we must keep, such as invoices and acceptance records, and we will tell you which and why. Write to support@datlay.com. You will get an answer within 30 days. You can also complain to a data protection authority, in particular the one in the EU country where you live or work.
For data inside a workspace, ask the company that uses Datlay: it is the controller. If you write to us instead, we pass your request to that company and help it answer.
Changes to this page
A new version is published here with its number and date. Where a change affects customers of the service, we tell their administrators in advance, as section 21 of the Terms describes.
Contact
Questions about this page or your data: support@datlay.com. Security issues: security@datlay.com, as the Security page describes.