Skip to content
Yalla MediaYalla Media

Privacy Policy

Last updated: July 2026

This Privacy Policy explains how Yalla Media FZ-LLC (“Yalla Media,” “we,” “us,” or “our”), a company registered in Dubai, United Arab Emirates, collects, uses, discloses, and safeguards personal data when you visit yallamediaai.com, use our AI tools, purchase digital products, or engage our agency services (collectively, the “Services”). By using the Services you agree to the practices described here.

1. Who we are

Yalla Media FZ-LLC is a premium AI agency, AI tools hub, and digital-products store based in Dubai, United Arab Emirates. For the purposes of applicable data-protection law, we act as the data controller for personal data processed through the Services. Where we provide bespoke agency work that processes data on a client’s behalf, we may act as a data processor under a separate data-processing agreement.

2. Data we collect

We collect data you provide directly, data generated as you use the Services, and data from trusted third parties:

  • Account & identity data: name, email address, password (stored hashed), company, role, and profile details.
  • Billing data: billing name, address, country, VAT or tax identifiers, and a payment token. Full card numbers are handled by our payment processor and never stored on our servers.
  • Service & usage data: prompts and inputs you submit to our AI tools, generated outputs, files you upload, credit consumption, feature usage, and product or subscription history.
  • Technical data: IP address, device and browser type, operating system, referring URLs, language, and timestamps.
  • Communications: messages you send us via forms, email, or support, including any attachments.
  • Cookies & analytics: identifiers and preferences set through cookies and similar technologies, as described in our Cookie Policy.

3. How we use your data

We use personal data to operate, secure, and improve the Services, on the following legal bases: performance of a contract, our legitimate interests, your consent, and compliance with legal obligations. Specifically, we use data to:

  • create and manage your account and authenticate your access;
  • deliver AI-tool outputs, fulfil digital-product orders, and provide agency services you have requested;
  • process payments, subscriptions, renewals, invoices, and refunds;
  • provide customer support and respond to your enquiries;
  • monitor usage, enforce credit and rate limits, and prevent fraud or abuse, in line with our Acceptable Use Policy;
  • improve our models, prompts, and product experience using aggregated or de-identified data wherever practical;
  • send service messages and, with your consent, marketing communications you can opt out of at any time.

4. AI inputs and outputs

Content you submit to our AI tools may be transmitted to specialised AI model providers solely to generate the output you requested. We do not sell your prompts or outputs. We do not use your private inputs to train publicly available models without your explicit consent. You are responsible for ensuring you have the right to submit any content and for not including sensitive personal data you are not authorised to share.

5. Google User Data

Yalla Discovery, our SEO platform, lets you optionally connect your own Google Search Console and Google Analytics accounts using Google OAuth. This section explains exactly how we access, use, store, and share that Google user data. Connecting Google is entirely optional — the rest of the Services work without it.

  • Scopes we request are read-only. We request Google Search Console (webmasters.readonly) and Google Analytics (analytics.readonly). These permissions let us read your own site performance and analytics data. We never request write access, and we cannot modify or delete anything in your Google account.
  • How we use it. We use this data solely to display your own SEO and traffic insights — reports, charts, and recommendations — inside your dashboard. We do not sell it, we do not use it for advertising or ad targeting, we do not use it to train AI or machine-learning models, and we do not share it with third parties except sub-processors strictly necessary to operate the service (such as our hosting and database providers), who are bound by confidentiality obligations.
  • What we store, and for how long. We store the minimum needed to provide the feature: OAuth access and refresh tokens, held encrypted at rest, plus cached copies of the reports you have requested so the dashboard loads quickly. We do not copy your entire Google account.
  • Disconnecting and deletion. You can disconnect Google at any time from your Yalla Discovery settings, or revoke our access directly at myaccount.google.com/permissions. On disconnection we delete the stored tokens and associated cached Google data. You may also request deletion at any time by emailing [email protected].

Limited Use disclosure. Yalla Media’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

6. Cookies and similar technologies

We use strictly necessary, functional, analytics, and (where applicable) marketing cookies. You can control non-essential cookies through our consent banner and your browser settings. For a detailed breakdown, see our Cookie Policy.

7. Sharing and third parties

We share personal data only as needed to run the Services and never sell it. Categories of recipients include:

  • Payment processing: Stripe, which processes payments and stores cardholder data under PCI-DSS standards.
  • Cloud hosting and storage: our infrastructure and object-storage providers that host the platform and stored files.
  • AI model providers: specialised providers that generate AI outputs from your inputs.
  • Analytics and communications: tools that help us understand usage and deliver transactional and marketing email.
  • Professional advisers and authorities: where required to comply with law, enforce our terms, or protect rights, safety, and property.

Each processor is bound by contractual confidentiality and data-protection obligations.

8. International transfers

We operate from Dubai, United Arab Emirates and may process data in other countries through our service providers. Where personal data is transferred outside your jurisdiction, we rely on appropriate safeguards such as adequacy decisions or Standard Contractual Clauses to protect it.

9. Data retention

We keep personal data only for as long as necessary to provide the Services and to meet legal, accounting, tax, and reporting obligations. Account data is retained for the life of your account; billing records are typically retained for the period required by UAE law. When data is no longer needed, we delete or anonymise it.

10. Security

We apply technical and organisational measures including encryption in transit, hashed credentials, access controls, least-privilege permissions, and regular review of our providers. No method of transmission or storage is completely secure, so we cannot guarantee absolute security, but we work continuously to protect your data and will notify affected users and regulators of qualifying breaches as required by law.

11. Your rights (including GDPR)

Subject to applicable law, including the EU/UK General Data Protection Regulation, you may have the right to:

  • access the personal data we hold about you;
  • request correction of inaccurate or incomplete data;
  • request erasure of your data (“right to be forgotten”);
  • restrict or object to certain processing;
  • request portability of data you provided to us;
  • withdraw consent at any time, without affecting prior processing;
  • lodge a complaint with a supervisory authority.

To exercise any of these rights, contact us using the details below. We will respond within the timeframes required by applicable law.

12. Children

The Services are not directed to children under 18, and we do not knowingly collect their personal data. If you believe a child has provided us data, please contact us so we can remove it.

13. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be posted on this page with a revised “Last updated” date, and where required we will seek your consent.

14. Contact us

For privacy questions or requests, email us at [email protected] or visit our contact page. You can also review our Terms of Service.

This document is a template provided for convenience and does not constitute legal advice. It should be reviewed and adapted by qualified legal counsel before being relied upon.