Privacy Policy

1. Who We Are and Scope of This Policy

Comfi AI Ltd ("the Company," "we," "us," or "our") (Gate Avenue, DIFC, Level 1, Dubai, United Arab Emirates) operates the Comfi.ai invoice financing platform at getcomfiai.com (the "Service"). The Company is registered in the Dubai International Financial Centre and is subject to the DIFC Data Protection Law 2020 (DIFC Law No. 5 of 2020) as a data controller in respect of personal data processed through the Service.

This Privacy Policy explains what personal data the Company collects from businesses and individuals who use the platform, how that data is used, with whom it is shared, how long it is retained, and what rights you have in respect of it. If you have questions, contact us at [email protected].

2. Information We Collect

Because Comfi.ai is a financial services platform handling business credit and invoice financing, the personal data we collect is more detailed than a typical website collects. We collect the following categories:

Business identity and KYC documents: trade licence, company registration certificate, authorized signatory identity documents (Emirates ID or passport copies), proof of registered business address, and beneficial ownership information. These are collected to meet our Know Your Customer and Anti-Money Laundering obligations under DIFC financial regulation.

Invoice and transactional data: trade invoices you submit for financing, including buyer and seller names, invoice amounts, due dates, payment terms, and the nature of the underlying goods or services. This information is the core input to our AI scoring engine.

Financial and accounting data: bank statements, payment track records, debtor aging reports, and data drawn from accounting or ERP integrations (QuickBooks, Xero, Zoho Books, Tally, or direct upload) that you authorize the Company to read in connection with an application.

Credit and risk queries: where permitted, the Company may initiate credit bureau queries or consult UAE credit reference data to supplement its scoring assessment.

Bank account details: account name, IBAN, and bank details provided for the purpose of transferring approved advance funds.

Contact and communications data: name and title of the authorized representative, business email address, telephone number, and any correspondence with the Company's support or onboarding teams.

Platform usage data: log files, IP address, device and browser type, timestamps, and interaction data within the financing application portal, collected automatically when you use the Service.

Website visitor data: for visitors who submit a contact form or browse getcomfiai.com without creating an account, we collect the information you submit and standard web analytics data.

3. How We Use the Information

The Company uses the personal data it collects for the following purposes:

Delivering the financing service: assessing invoice financing applications through our AI cash flow scoring engine; generating advance offers; processing approved fund transfers to your nominated bank account; and managing the financing relationship throughout its term.

KYC and AML compliance: verifying the identity of business owners, directors, and authorized signatories; screening against applicable sanctions lists; and meeting the Company's obligations as a DIFC-registered financial services provider under the DFSA's AML/CTF and Sanctions rulebook. This processing is mandatory; the Company cannot provide financing without completing it.

Credit risk management and fraud prevention: building and continuously calibrating our credit scoring models using historical transaction performance; monitoring the portfolio for signs of fraud; and detecting potentially misrepresented invoices or duplicate financing submissions.

Account and platform communications: onboarding guidance, financing offer notifications, repayment reminders, platform maintenance notices, and responses to your support requests.

Product and service improvement: analyzing aggregated and anonymized platform usage data to identify friction points in the application flow and improve the scoring experience. This analysis does not use individual invoice contents.

Legal and regulatory obligations: producing and maintaining records as required by DIFC commercial law, UAE financial regulation, and any order or request from a competent authority.

We do not sell personal information. We do not use your invoice data or financial information to train or sell scoring models to third parties.

4. Legal Bases for Processing

Under the DIFC Data Protection Law 2020, the Company processes personal data on the following bases:

• Contractual necessity: processing required to evaluate your application and deliver the invoice financing service you have applied for.
• Legal obligation: KYC and AML identity verification, sanctions screening, and transaction recordkeeping required by DIFC and UAE financial regulation.
• Legitimate interests: fraud detection, credit risk management, and product improvement, where those interests are not overridden by your rights and interests.
• Consent: analytics cookies and non-essential tracking, where you have provided consent through the cookie banner on our website.

5. Sharing and Disclosure

The Company shares personal data only in the following circumstances:

• Service providers acting as processors: cloud infrastructure, KYC identity verification technology providers, credit bureau query services, and secure document storage, each engaged under a written data processing agreement that limits their use of data to performing services for the Company.
• Regulatory and legal authorities: the Dubai Financial Services Authority (DFSA), the UAE Central Bank, and other competent authorities, where disclosure is required by applicable law, regulation, court order, or legal process.
• Business transactions: in the event of a merger, acquisition, or investment round where prospective parties require due-diligence access to platform data, under confidentiality obligations and to the extent required for the transaction.

We do not share your invoice contents, credit scoring outputs, or personal data with third parties for their own marketing or commercial purposes.

6. Retention and Security

The Company retains personal data only as long as necessary for the purposes described in this policy or as required by applicable regulation:

• KYC and customer due diligence records: a minimum of five years from the end of the business relationship, in accordance with the DIFC AML Module and applicable UAE financial regulation.
• Invoice and transaction records: a minimum of five years from the date of each transaction.
• Platform usage and analytics logs: up to 13 months.
• Support and communications records: up to three years.

We apply administrative, technical, and physical safeguards designed to protect personal data from unauthorized access, loss, or disclosure. Data in transit is encrypted using TLS 1.2 or higher. Data at rest is stored in encrypted form. Access to customer financial documents is controlled by role-based permissions; platform engineers cannot access invoice contents outside approved processes. The Company holds read-only access to third-party accounting integrations and does not write to or modify your accounting records.

7. Your Rights

Subject to the DIFC Data Protection Law 2020 and applicable UAE law, you may have rights to: access the personal data we hold about you; receive a correction of inaccurate data; restrict or object to certain processing; request deletion of data where no mandatory legal retention obligation applies; and receive a copy of your data in a portable format.

Note that as a regulated financial services provider, the Company is subject to mandatory recordkeeping obligations that may require us to retain certain KYC and transaction records regardless of a deletion request. Where this applies, we will explain the relevant obligation when responding to your request.

To make a data rights request, contact us by email at [email protected]. We respond within 30 days.

8. Cookies

See our Cookie Policy for information on how we use cookies and similar technologies on getcomfiai.com.

9. Changes and Contact

Material changes to this Privacy Policy will be reflected by an updated "Last updated" date at the top of this page. We encourage you to review this policy periodically.