Privacy Policy

1. What we collect

When you book with Innovex Studios we collect:

• Contact info: name, email, phone number, company (if applicable).
• Booking info: dates, times, use case, crew size, product (studio / podcast / equipment), tier selection, podcast set preference (where applicable — for podcast bookings you can pick which set / backdrop you’d like), any notes you add.
• Payment info: handled by Stripe — our PCI-DSS-validated payment processor. You are redirected to Stripe's hosted checkout page to complete your deposit. Card details never touch our servers — we receive only a payment confirmation reference after the transaction is verified.
• ID verification (equipment rentals): Emirates ID, passport, or driver’s license, checked in person when you collect the equipment — never uploaded through the website. The copy is kept with the rental paperwork, accessible only to the studio operator and finance staff, and deleted by our team within 30 days of safe return. Collected as a contractual necessity for equipment damage liability.
• Minors on set: where children are present during a shoot, their image may be captured by CCTV under the terms of our House Rules. Parents or guardians are responsible for acknowledging this before entry. We do not collect names or identifying information for under-16 guests through the booking flow; if a production requires it (e.g., minor model release), the producer handles consent directly with the guardian.
• Loyalty & credit history: we track cumulative booking spend and studio-credit balances against your email to calculate your loyalty tier (Regular / Pro / Elite) and the credits you’ve earned. This includes a rolling 6-month spend total used for tier transitions. The tier affects your credits-back percentage and perk eligibility — see the Loyalty page for how it works.
• Referral attribution: if you entered a referral code in the booking form, we match it to the customer our team issued that code to, so both of you can be credited after your shoot completes. Bookings are linked only through an issued code — we do not look anyone up by email. The credit posts to both accounts once, when the referred customer’s first qualifying booking (one that meets the qualifying threshold) is marked completed; later bookings by the same customer do not earn another referral credit. See the Referral page for the full mechanics.
• Referral fraud-control checks: to protect programme integrity we compare the booker’s email, phone number and signed-in account with those of the code’s owner, so no one can refer themselves. We also enforce a minimum qualifying booking size (currently 4 hours or AED 1,000). These checks are processing activities tied to the referral programme; no data from them is shared with the referrer.

When you use the website we collect minimal technical data:

• Technical info: browser type, device category, and approximate city-level location for performance diagnostics. Logged in aggregate only.
• Cart (browser local storage): when you add equipment on /rent, or a studio set or podcast session to your booking cart, your selections — items and quantities, pickup and return dates and delivery preference, and each set or session’s date, start time and hours — are saved to your browser’s localStorage under the key innovex.bookingCart.v3 (an older cart saved under innovex.rentalCart.v2 is read once and moved to it). This persists across pages and reloads so you don’t lose your cart between visits. The data stays on your device — it reaches us only when you send a rental request or make a booking. It contains no name, email, phone, or payment data. Clearing your browser storage removes it.
• Other browser storage: your light/dark theme choice and your recent site searches (localStorage), and short-lived flags plus an unsent booking-form draft kept while you switch language (sessionStorage). All of it stays on your device.
• AI chat history (browser session storage): when you use the “Ask Innovex” chat assistant, your conversation (your messages and the AI’s replies) is saved to your browser’s sessionStorage under the key innovex.chat.v1 so it persists while your tab is open. It is automatically cleared when you close the tab. The chat is intended for users 18 and over; if you are under 18 please do not send personal information through it. Each message you type is transmitted to Anthropic, Inc. (USA) — our AI model provider — to generate a reply (see Section 3). You can clear the local copy at any time using the “Clear” button in the chat panel or by closing your browser tab.
• Analytics: anonymised pageviews and navigation paths are planned (Google Analytics 4 with IP anonymisation, launching with the backend). When analytics go live, we will add a cookie consent banner and update this section. At the time of this policy revision, no analytics scripts run on the site.

2. Why we collect it — and our lawful basis

Every piece of data above maps to a specific lawful basis under UAE Federal Decree-Law No. 45 of 2021 (PDPL) and, where applicable, EU GDPR:

• Booking fulfilment, payments, balance collection — contractual necessity. We cannot run your shoot without knowing who you are, when you want the studio, and how to reach you if something changes.
• Tax records, VAT invoicing, legal compliance — legal obligation (UAE Federal Tax Authority requires retention of financial records for 7 years).
• Equipment damage liability (ID verification) — contractual necessity. Holding a refundable damage deposit against a verifiable ID is how we insure against loss or damage.
• CCTV in common areas (premises safety) — legitimate interest balanced against customer privacy. Cameras cover entry, corridors, and the studio floor; never private areas (changing rooms, bathrooms, prep room). Footage is retained 30 days, then automatically deleted.
• Marketing updates (availability, promotions, new services) — explicit consent. We only send marketing email if you tick the opt-in checkbox on the booking, tour or contact form, or confirm a newsletter signup from the link we email you. You can unsubscribe at any time via the link in every marketing email.
• Loyalty programme (credits-back + tier tracking) — contractual necessity. Being an Innovex customer includes the benefit of loyalty credits on every completed booking. We need to track your spend history to calculate your tier (Regular / Pro / Elite) and post the correct credit amount after each shoot. Credit balances and tier changes are accessible to you on request.
• Referral attribution — contractual necessity: you entered a referral code to unlock your welcome credit, and the code’s owner joined the programme when they asked our team for that code. We process only the link between the two accounts that is needed to post each party’s credit.
• Referral fraud-control (self-referral check against the code owner’s email, phone and account; qualifying booking threshold) — legitimate interest balanced against customer privacy. The check is the minimum needed to keep the programme economically viable; results are not shared with referrers and are never used for marketing.
• AI chat assistant messages — legitimate interest. We operate an on-site chatbot to answer common questions about pricing, gear, packages, and policies. Messages you type are transmitted to Anthropic’s API to generate a reply, and the conversation is stored only in your browser’s sessionStorage (we don’t persist it on our servers). You can avoid this processing entirely by using email or WhatsApp instead — both are linked from the chat panel and the contact page.
• Website analytics (when active) — consent via a cookie banner. Essential cookies (your sign-in session and language choice) run without consent; all other cookies wait for the banner.

3. Who we share it with

We share your data with the minimum number of third parties needed to run your booking. Each has a written data-processing agreement (DPA) with Innovex:

• Stripe: payment processing. You complete your deposit on Stripe's hosted checkout page; we receive a verified payment reference (amount, currency, transaction ID) after confirmation.
• Hostinger Titan Email: transactional email (booking confirmations, cancellation links, password resets, newsletter signups). Receives the emails we send you — your name and email address and the message itself, such as your booking details. Hostinger acts as the SMTP relay for our self-hosted email delivery.
• Anthropic, Inc. (USA): AI model provider for the on-site “Ask Innovex” chat. When you send a message via the chat, your message text and the recent conversation history for that session are sent to Anthropic’s API to generate a reply. Anthropic processes this under a Data Processing Agreement and may retain inputs/outputs for up to 30 days for safety monitoring before deletion. Anthropic does not use your chat data to train models by default.
• WhatsApp / Meta Platforms Ireland Ltd.: when you submit a booking enquiry or rental cart via our WhatsApp deep-link (the green “WhatsApp us” buttons across the site), the message you send — including any contact details, booking dates, and rental cart contents you chose to type or paste — is delivered through WhatsApp’s end-to-end encrypted infrastructure. Meta acts as the message-transit processor for that exchange under WhatsApp’s own privacy policy. We do not push your data into WhatsApp on your behalf; the data flow only starts when you tap a WhatsApp button and choose to send the pre-filled message.
• Google Analytics (planned, not yet active): anonymised traffic measurement.
• UAE Federal Tax Authority: aggregate VAT reporting as required by law.

We do not sell, rent, or trade personal data with advertisers, marketers, or unrelated third parties.

4. Cross-border data transfers

Jurisdiction. Innovex Studios operates under a UAE Mainland trade licence (Dubai Department of Economy & Tourism / DET) and is not registered in the DIFC or ADGM. The federal UAE Personal Data Protection Law (Decree-Law 45/2021) applies. The DIFC PDPL Amendment 2023 — including its Transfer Impact Assessment regime that took effect post-July 2025 — does not apply to us by jurisdiction. If our entity ever moves into a free zone, we will update this section and complete the relevant TIAs.

Some of the vendors below process data outside the UAE:

• Stripe: payment processing. Transaction data (amount, currency, reference ID) is processed by Stripe as an independent payment processor under its data processing agreement and international security standards (PCI-DSS).
• Hostinger (non-EU, email relay), Google Analytics (US), Anthropic (US): limited personal data (email, anonymised usage, chat message text) transferred under each vendor’s published DPA and Standard Contractual Clauses (SCCs) where applicable. These vendors maintain EU/UK adequacy mechanisms.

You can request the list of our active sub-processors at any time by emailing the address in section 9. If you object to a specific cross-border transfer, contact us and we will explain your options (including deletion of your record where the transfer is not legally required).

5. How long we keep it

• Booking records: kept with your customer record while you remain a customer; the payment and tax parts for 7 years (see below). Ask us to delete the rest at any time (section 6).
• Payment and tax records: 7 years (UAE Federal Tax Authority requirement).
• Marketing contacts (opted in): until you unsubscribe.
• ID copies for equipment rentals: paper records, deleted by our team within 30 days of safe return of the equipment.
• CCTV footage (common areas): 30 days, then auto-deleted. Never shared except with law enforcement on formal request or in response to an insurance claim.
• Loyalty credits + tier history: credit balances and the rolling 6-month spend window used for tier calculation are retained for the life of your customer relationship. Each credit expires 12 months after it is posted to your account (when the booking that earned it is marked complete).
• Referral records: kept with your customer record so we can reconcile disputes and fraud checks; ask us to delete them at any time (section 6).
• Add-to-calendar exports (.ics files): once you click “Add to calendar” from a confirmation page, the booking details (date, time, total, address) are embedded in the ICS file and stored in your own calendar application — its retention rules apply from that point. We have no ability to revoke or delete an ICS entry once it’s in your calendar.
• Website analytics (when active): 14 months (Google Analytics default retention).

6. Your rights

Under UAE PDPL (and, if applicable, EU GDPR / UK GDPR / California CCPA), you can request at any time:

• Access — a copy of the personal data we hold about you.
• Correction — we fix inaccurate or outdated information.
• Deletion — we remove your data, subject to legal retention requirements (e.g., tax records held 7 years). Note: chat messages transmitted to Anthropic may be retained by Anthropic for up to 30 days under their data-processing agreement for safety monitoring, after which Anthropic deletes them. We cannot action earlier deletion of data inside Anthropic’s systems.
• Portability — a machine-readable copy of your data in a standard format.
• Objection / restriction — you can object to specific processing (e.g., marketing) or ask us to restrict processing while we investigate a concern.
• Withdraw consent — for any processing based on consent (marketing, analytics cookies) at any time.

Email your request to the address in section 9 — we reply within 14 days. No charge for a standard request.

7. Marketing communication

• We only send marketing email if you explicitly opt in — on the booking, tour or contact form, or by confirming a newsletter signup. Opt-in is captured with a timestamp.
• Every marketing email includes an unsubscribe link. One click, you’re out.
• Booking-related email (confirmations, reminders, balance due, receipts) is transactional — you receive this as part of running your booking, independent of marketing consent.

8. Cookies

• We use two essential cookies: sid, which keeps you signed in to your account (30 days), and NEXT_LOCALE, which remembers the language you chose (30 days). They run without consent because they are strictly necessary for the site to function.
• When analytics launch (Google Analytics 4 with IP anonymisation), we will add a cookie consent banner and update this section. No analytics cookies run until then.
• We do not use advertising or behaviour-tracking cookies, now or in any planned rollout.

9. Contact for privacy matters

Email info@innovexstudios.com with “Privacy” in the subject line. We respond within 14 days. For urgent data-protection concerns, WhatsApp the number on our Contact page.

10. Changes to this policy

Material changes to this privacy policy will be announced on the website and, where appropriate, emailed to customers with active bookings at least 14 days before they take effect.