AI-CSD 1 Web Security — UAE
Privacy Policy
Choose the contracting entity
Choose the company you intend to contract with, or the company named in your existing order. This selection changes the policy you view; it does not change a signed contract.
Legal entity
Silence AI LLC
- Registration
- Licence Number 2539365.01
- Registered address
- Shams Business Center, Sharjah Media City Free Zone, Al Messaned, Sharjah, UAE
- Customer deployment server
- United States or Europe; the assigned location is identified in the order or service plan
1. About this notice
1.1 What it covers: This notice explains personal-data processing connected with the UAE Web Security service, its console, protected traffic, accounts, support and purchases. It is a privacy notice, not a grant of service rights. The Terms of Service and its Data Processing Addendum (DPA) govern service and processor obligations. Email Security has a separate notice.
1.2 Responsible company: The relevant service company is Silence AI LLC, Licence Number 2539365.01, Shams Business Center, Sharjah Media City Free Zone, Al Messaned, Sharjah, UAE. Use this notice when that company and the UAE deployment appear in the actual order. UI language, visitor IP and URL locale do not establish the contracting party. Privacy questions: info@silenceai.net.
1.3 Roles: For protected-site visitors’ request logs and security events, the customer normally determines purposes as controller and Silence AI processes on its documented instructions under the DPA. Silence AI determines purposes for its own console-account administration, support, subscription administration, fraud prevention and service security. Payment providers and a separately operated SSO service may have their own roles; their exact arrangements are described below and in the applicable notices.
1.4 Service boundary: The customer console address is provided in onboarding materials. This notice also covers related APIs, the supplied agent, active proxy/WAF, incident and log views, and traffic at protected customer domains or IPs. The console supplies the protection-connection IP for each deployment; that IP can change or differ by customer. The separately deployed sign-in/SSO portal’s actual domain, operator and notice is identified in onboarding materials. A sign-in redirect does not remove Silence AI’s Web Security obligations.
2. Data and sources
2.1 Customer personnel: Customers and their staff may supply names, work contact details, organization, account identifiers, role and configuration choices, support messages and billing contacts. The console or separate SSO service may supply account/session identifiers. This notice does not assume that the CMC stores passwords or full payment-card numbers.
2.2 Website visitors: Protected-site traffic and security systems may provide visitor IP addresses, request URIs, timestamps, HTTP headers, user-agent strings, country indicators, traffic and attack metadata, incident records, and agent/edge telemetry. The customer controls which sites and traffic are connected.
2.3 Other records: Depending on features actually enabled, we may receive wallet and transaction references, audit and diagnostic logs, cookie or device data, and support attachments. AI features may process prompts, responses, tool results, provider or model settings and selected security data if configured. The deployment’s current subprocessor or data-flow schedule identifies the AI provider and data sent before the feature is enabled.
3. Purposes and roles
3.1 Customer instructions: As processor, Silence AI analyzes traffic routed through the customer's configured Web Security deployment to provide the proxy/WAF service, incident and log views, subject to the customer's instructions and DPA. Where included and enabled, WAF, IPS and DDoS controls are designed to detect and mitigate threats; they cannot identify or stop every attack. Malicious requests may pass and legitimate requests may be blocked. Traffic not routed through the service is outside this protection. We do not repurpose identifiable visitor logs for independent marketing or product analytics merely because this notice mentions improvement.
3.2 Our account operations: As controller for our own activities, we administer accounts and subscriptions, respond to support requests, maintain audit trails, secure the service, detect fraud and meet invoice or legal duties. These account and administration purposes do not expand the traffic covered by the customer's configured protection. We may use genuinely aggregated or de-identified service statistics for capacity planning and improvement; we do not present identifiable customer activity to other customers as evidence of traction.
3.3 AI processing: AI-assisted analysis applies only to enabled features and the DPA instructions for customer-controlled data. Before enabling an AI feature, we will identify its provider, processing location, data sent (including any security-tool results), and retention in the deployment's data-flow information available from info@silenceai.net.
4. Recipients and payments
4.1 Payment transactions: A Web Security subscription is required. The order or plan governs any included allowance, prepaid balance and payment for usage above the allowance. For online sales under agreements with Silence AI LLC in the UAE, Paddle.com handles checkout, billing and collection as authorized reseller and merchant of record and acts under its own Buyer Terms and Privacy Notice. Silence AI may receive purchaser identity, invoice, subscription and transaction status, wallet credit and limited payment-method references needed for administration. The checkout and invoice identify the payment party and details supplied to it. For a planned payment gateway provider change, Silence AI sends the initial notice to every affected customer at the email address used to sign in to Silence AI Email Security no later than three calendar months before the planned change date. If no response is received within seven calendar days after the email is sent, Silence AI may additionally notify the customer organization’s administrators in the Web Security administrative panel. This additional notice does not replace the email or change the three-calendar-month advance notice period under Terms of Service Section 3.3.3.
4.2 Other recipients: Depending on the actual deployment, recipients may include hosting and object-storage providers, backup and monitoring services, support providers, the separate SSO operator and enabled AI model providers. Service subprocessors act under the DPA; independent controllers follow their own notices. The current non-sensitive subprocessor list and relevant locations can be requested from info@silenceai.net. We may also disclose data when required by law.
5. Retention and deletion
5.1 Traffic and SIEM: Web-server logs, structured security events, incidents and backups may have different retention periods. The period applicable to each category is stated in the order or data-retention schedule, or is available from info@silenceai.net. Any SIEM storage allowance limits capacity, not retention time.
5.2 Other categories: Account and support records are kept while needed to administer the active relationship and resolve requests, then according to a documented deletion schedule. Transaction and invoice records are kept for the applicable tax, accounting and dispute periods. AI conversations, prompts, audit and diagnostic records follow the configured feature and security schedules available from info@silenceai.net. Backups expire under their documented rotation and may lag primary deletion. We do not promise a single period for every category.
5.3 End of service: For customer-controlled data, the customer may request return or deletion under the DPA, subject to legal retention and backup cycles. For data Silence AI controls, account users may request deletion where applicable; records required for invoices, disputes, security or law may be retained for the relevant period. Contact us for the active retention schedule and deletion status.
6. Individual rights
6.1 Account users: For account, billing, support and service-administration data that Silence AI controls, account users may request access, correction, deletion, restriction, objection or portability where applicable law grants those rights. Contact info@silenceai.net; we will verify the request and respond within the period required by that law. If GDPR applies, its ordinary response period is one month, subject to permitted extensions. Relevant users may complain to the competent data-protection authority.
6.2 Protected-site visitors: The customer whose protected site was visited normally controls the resulting traffic, incident and log data and is primarily responsible for receiving and answering visitor rights requests. Visitors should identify and contact that customer using the site's privacy notice. If a visitor contacts Silence AI about customer-controlled data, we will, where possible, direct or pass the request to the customer and provide reasonable assistance under DPA Section 12.9. The customer decides how to respond; Silence AI cannot independently promise deletion or other action on customer-controlled data.
7. Security
7.1 Safeguards: We use access controls, transport encryption, logging and operational security measures appropriate to the service. The exact measures for a deployment, including encryption at rest, MFA, backup and incident response arrangements, are available on request at info@silenceai.net. No measure guarantees absolute security.
8. Locations and transfers
8.1 Hosting: A customer contracting with Silence AI LLC is provided a Web Security deployment on a server located in the United States or Europe. The location assigned to that customer is identified in the order, plan or linked data-location schedule. This does not establish where SSO, support, payment data, backups, AI inference or other subprocessors process information. Their destinations and access locations are disclosed in the applicable data-flow schedule.
8.2 Safeguards: Where personal data leaves the UAE or another jurisdiction with applicable transfer rules, each flow must use a permitted transfer basis and required safeguards. GDPR transfer mechanisms apply where GDPR governs a relevant transfer. TLS is a security control, not a legal transfer mechanism. The contract’s UAE governing-law clause does not displace mandatory privacy law.
8.3 Change of contracting company: Under Terms of Service Section 11.9, Silence AI LLC may transfer the UAE agreement only to a Silence AI Group Company. Before the effective date, we will identify the new legal entity, country of registration, date and privacy contact to the customer. Account, billing and support data will pass only as needed to continue the same service and lawful purposes, with any required notice, legal basis and cross-border safeguards. For customer-controlled data, the new provider must assume the processor obligations under the DPA and continue to follow the customer's documented instructions. A change of provider does not itself authorise a new processing purpose or remove rights under applicable data-protection law.
10. Legal bases for our controller activities
10.1 Account and service administration: Where GDPR applies to Silence AI’s controller processing, account setup, subscription administration and support requested under a service contract rely on performance of that contract where the individual is party, or legitimate interests in serving the customer where they are its staff. Service security, fraud prevention and diagnostic logging rely on legitimate interests in protecting customers and the platform, subject to balancing and any right to object. Invoice and tax records rely on legal obligations. Optional marketing and nonessential tracking rely on consent where required; consent may be withdrawn for future processing.
10.2 Other applicable law: For processing governed by UAE law, we rely on valid consent or an applicable statutory permission for each controller activity, and obtain consent where the law requires it. The customer establishes the lawful basis for its website visitors’ traffic processing. The DPA governs our processor role.
11. Security incidents
11.1 Customer data: When acting as processor, if we become aware of a confirmed personal-data breach affecting customer-controlled data, we notify the customer/controller without undue delay and provide available technical details and reasonable operational assistance under DPA Section 12.10 and applicable law. The customer assesses and fulfils its own legal duties to notify affected visitors and authorities. Our assistance does not transfer those duties to us, without limiting any independent duty that applicable law imposes on Silence AI.
11.2 Our data: For account, billing, support and service-administration data that Silence AI controls, we assess and make any notices to affected individuals or authorities required by applicable law, within its applicable deadlines. Our controller duties for those data do not make Silence AI responsible for the customer's notices about customer-controlled visitor data.
12. Notice changes
12.1 Updates: We will publish an effective date and give notice of material changes as required. A new processing purpose will use the notice or renewed consent required by applicable law; continued use alone is not universal consent.
13. Contact and requests
13.1 Contact: Silence AI LLC, Licence Number 2539365.01, Shams Business Center, Sharjah Media City Free Zone, Al Messaned, Sharjah, UAE. Privacy and DPA requests: info@silenceai.net.
13.2 Requests: For data we control, tell us the relevant account and request type so we can verify and answer your request. Protected-site visitors should ordinarily contact the customer through that site's privacy notice; if a visitor contacts us, identify the site so we can direct or pass the request to the customer where possible. Applicable law governs response periods and complaint routes.
14. Applicable privacy rules
14.1 Contractual and statutory routes: For a contractual dispute with Silence AI LLC, Terms of Service Section 11.13 sets written notice, 30 days of good-faith negotiation and, if unresolved, the competent courts in Sharjah, UAE. This route does not limit mandatory consumer or data-subject rights, complaints to a data-protection authority or other regulator, or a forum required by applicable law. Paddle purchase disputes follow its separate Buyer Terms.
Updated 7 October 2026.