Privacy Policy

LEGAL_PACKAGE_COMPLETE=YES · EXTERNAL_LEGAL_REVIEW=PENDING

PMGI PROJECT MANAGEMENT SERVICES L.L.C (One Person LLC) · Dubai, UAE · Commercial Licence No. 1471379 · info@pmgi.ae

Version: AITS_LEGAL_PACKAGE_20261002_V9_1_PRIVACY
Published: 2026-10-02 UTC
Registration CLOSED · PAPER-only demonstration; owner actual observations separate.

Status and operator

PMGI PROJECT MANAGEMENT SERVICES L.L.C (One Person LLC), Dubai, UAE; licensed spelling P M G I PROJECT MANAGEMENT SERVICES L.L.C; Commercial License 1471379; licensed address Office C1802-51, Business Bay, Dubai, UAE. Support, complaints and privacy: info@pmgi.ae, owner-confirmed monitored. Preparation is complete for final review; EXTERNAL_LEGAL_REVIEW=PENDING; owner-authorized technical publication does not assert professional approval. A commercial licence is not evidence of financial-services authorization. No regulated status, investor protection scheme, insurance, custody licence or regulatory endorsement is claimed.

Privacy and data inventory

Controller: PMGI, contact above. Necessary account fields are name, normalized email, generated immutable identifiers, language, verification/status and notice acceptance evidence. Authentication stores password hashes, hashed recovery/verification references and expiring session references; never plaintext passwords. PAPER records hold tenant-scoped simulation instructions, positions, marks and reports. Security records contain minimal event/time and rate-limit metadata. No marketing consent, identity document, biometrics or optional analytics is collected by the application. The owner read-only mapping is separate from future customer onboarding. Do not include financial records or credentials in a support message.

Proposed purposes and legal bases for counsel review

Account and simulation data: necessity to provide the requested demo service, subject to counsel confirming the applicable UAE and audience-specific basis and necessity of each name field. Authentication and security: access protection and abuse prevention, subject to the applicable lawful basis and proportionality assessment. Acceptance evidence: demonstrate the applicable service terms and notice version; counsel must confirm the lawful basis and retention. Support and privacy requests: handle the request and applicable obligations, with identity minimization. Marketing: not performed. No blanket processing consent is inferred from reading a notice. No automated decision with legal or similarly significant effects is made. These are proposed mappings, not asserted approved legal bases.

Processors, locations and subprocessors

DigitalOcean: application/database hosting, observed fra1 Frankfurt deployment; public DPA and subprocessor register linked below. Cloudflare: HTTPS edge, DNS/tunnel delivery and associated security metadata; network processing can be distributed. Hostinger: verification/recovery transactional email via HTTPS API and PMGI support mailbox; actual mailbox routing, storage and retention must be confirmed from the account. Public provider registers are references, not proof every listed subprocessor is used. No AI provider receives customer context while the adapter is disconnected. Account-specific contracts, service-specific subprocessors, region settings, edge/mail logging retention, cross-border mechanisms and rights-assistance terms require operator account evidence and qualified review. No residency or transfer compliance assurance is made from a public DPA alone.

Cookies, communications and security

The application uses the necessary secure HttpOnly SameSite=Lax session cookie for authentication and CSRF. Current application code has no optional marketing/analytics scripts or cookies. Edge providers may set security cookies; service-specific settings and audience requirements need review. No real test email is sent by this mission. TLS, tenant authorization, hashed secrets and expiring sessions are controls, not a security guarantee. Verified operational update, 2026-10-02 UTC: the client application and database use an encrypted LUKS volume. The service refuses to start on the underlying unencrypted path; service restart and locked-volume recovery were tested. Recipient-encrypted off-server backups on the encrypted owner T9 were recovered in memory and checked for integrity. The recovery private key is separate from the server and backup destination. A Mac-side coordinator checks availability and schedules daily verified backups; Mac, network and destination availability remain operational dependencies. A full host reboot has not been tested. Older owner-only rollback copies remain access restricted; this update does not claim that all historical copies were retroactively encrypted. No external-client data has been onboarded. Client retention, deletion/restore reconciliation, provider-account details and onboarding qualification must be completed before registration opens. Security controls do not establish legal compliance or a service-availability guarantee.

Deletion and request handling procedure

Responsible operational role: PMGI service operator; accountable privacy/complaints role: PMGI management through info@pmgi.ae. Record a minimal case reference, received time, request type and due-date assessment. Verify control through the authenticated account or existing verified email; never ask for password, recovery token or unnecessary identity documents. Confirm scope and applicable legal deadline, search tenant-specific profile, ledger, consent, auth, audit, mail/log and backup references; produce an export or proposed deletion inventory for review. Disable access and revoke sessions/tokens on verified closure through existing authorized operations. Review legal holds, approve the exact inventory, execute only under separately approved policy, retain minimal completion/tombstone evidence and reconcile backups on restore. Prevent cross-tenant exports. Proposed service targets: acknowledge within 5 business days and assess/escalate within 10 business days; these internal proposed targets never override a shorter applicable statutory deadline. Counsel must confirm applicable deadlines and supervisory authority before onboarding.

Publication, changes and acceptance

LEGAL_PACKAGE_COMPLETE=YES. EXTERNAL_LEGAL_REVIEW=PENDING. The owner authorized publication of this complete closed-environment package. Publication does not open registration, deem existing users to have accepted new contractual terms, approve future processing, or claim legal/regulatory review. Each document has a stable URL, version, publication date, content SHA-256 and change record. Existing recorded acceptances are not rewritten. Before any future onboarding, approved versions and content hashes must pass the existing registration controls. Prior V8 evidence remains in immutable checkpoints; V9 completes eligibility, liability, termination, law/jurisdiction fields, document indexing and all entry-point links.

Change history and integrity

Content SHA-256: 47ed39d430f93bdef935351c75e1f0cec5bb38d55d32def8d2e9020b210b768f

Publication does not represent legal or regulatory approval, financial-services authorization or acceptance of new terms. No registration or execution gate is opened.