Privacy Notice

1. Who We Are

This Privacy Notice applies to personal data collected through referral and ambassador registration links issued within the UPLINK platform, operated by:

Each referral link is associated with an individual UPLINK Ambassador ("Link Owner") whose name is displayed on the registration page (e.g., "Invited by [Name]"). The Link Owner does not independently process your data — all data processing is carried out by Connect Management FZE.

2. What We Collect

When you complete a referral registration form, we collect the following:

• First and last name — provided by you on the form
• Email address — provided by you on the form
• Phone number (including country code) — provided by you on the form
• Country of residence — provided by you on the form
• Optional message — provided by you on the form
• Referring sponsor — the Link Owner associated with your referral URL
• UTM and campaign parameters (utm_source, utm_medium, utm_campaign, utm_term, utm_content) — collected automatically from the URL when present, to attribute the introduction to the right campaign
• IP address — collected automatically when you visit the page
• Browser type and user-agent — collected automatically for security purposes
• Submission fingerprint — a technical hash derived from your contact details and submission context, used to detect duplicate or fraudulent registrations
• Consent timestamp — the date and time you ticked the consent checkbox and submitted the form

3. Why We Collect It

We process your personal data for the following purposes:

• Follow-up — to contact you about your inquiry and UPLINK opportunities, on behalf of the referring sponsor and Connect Management
• Lead routing — to assign your registration to the correct Link Owner for accurate referral attribution
• Sponsor contact — to enable the referring sponsor to follow up with you directly as the introducing ambassador
• Onboarding — to evaluate your eligibility for participation in the UPLINK ambassador and referral programme
• Compliance — to meet applicable UAE regulatory requirements, including AML and KYC obligations
• Security and fraud prevention — to protect the integrity of the registration process using technical data (IP, browser, fingerprint, referral URL parameters)
• Lead scoring — to automatically assess the relevance and completeness of your inquiry using signals from the form (region, source, completeness, etc.). This scoring assists routing and prioritisation; it does not produce legal or similarly significant decisions about you, and you can request a human review at any time via support@connect.ac

Lawful basis (GDPR and equivalent frameworks): processing is based on your freely given, specific, and informed consent, provided by ticking the checkbox on the registration form. Where processing is required to comply with a legal obligation (e.g., AML/KYC), we rely on that legal obligation as an additional basis. Referral attribution relies on our legitimate interest in accurately tracking ambassador performance.

You may withdraw your consent at any time — see Section 7.

4. Who Sees Your Data

Your data is shared on a strictly need-to-know basis:

• Connect Management FZE staff — for onboarding, compliance, and platform administration
• The referring Link Owner (Ambassador) — receives your name and contact details to facilitate the introduction and follow-up
• Authorised service providers — CRM platforms, email delivery services, and cloud hosting providers, each bound by data processing agreements
• Regulatory authorities — only where required by UAE law

We do not sell, rent, or trade your personal data to any third party for marketing or commercial purposes.

5. How Long We Keep It

At the end of the applicable period, records are deleted or irreversibly anonymised, unless a legal hold applies.

6. Children's Data

Our services are intended for adults aged 18 and over. We do not knowingly collect personal data from individuals under 18. If you believe we have inadvertently collected data from a minor, please contact us at support@connect.ac and we will promptly delete it.

7. Your Rights

Depending on your country of residence, you may have the right to:

• Access — request a copy of the personal data we hold about you
• Rectification — ask us to correct inaccurate or incomplete data
• Erasure — request deletion of your data, subject to legal retention obligations
• Restriction — ask us to limit processing while a dispute is resolved
• Objection — object to processing based on legitimate interests
• Portability — receive your data in a structured, machine-readable format
• Withdrawal of consent — withdraw your consent at any time without affecting the lawfulness of processing that took place before withdrawal

To exercise any of these rights, contact us at support@connect.ac with the subject line: Data Rights Request — [Your Full Name]

We will respond within 30 days of receiving a verifiable request. If you are unsatisfied with our response, you have the right to lodge a complaint with the relevant data protection authority in your country of residence.

8. Contact

For any questions, concerns, or privacy requests:

We take all privacy concerns seriously and aim to resolve them promptly and transparently.

9. Connected Social Accounts (Meta, Threads & TikTok)

Ambassadors may optionally link their Facebook Page, Instagram Business account, and/or Threads profile to UPLINK to enable automatic publishing of their share posts. This section explains what data we access through Meta's Graph API and the Threads API, how we store it, and how to revoke access.

What we access from Meta

• Facebook Page list and metadata — your Page name, ID, profile picture, and follower count, used to identify which Page to publish to and display in your Connected Accounts dashboard.
• Instagram Business profile — your IG username, user ID, profile picture, and follower count, used to identify the IG account and display in your Connected Accounts dashboard.
• Page and Instagram access tokens — short-lived tokens issued by Meta during OAuth, exchanged for long-lived tokens (~60 days), stored encrypted at rest (AES-256-GCM) so we can publish posts on your behalf.
• Engagement metrics (posts, likes, comments — last 7 days) — aggregated counts shown in your Connected Accounts dashboard so you can see how your shared posts are performing.
• Published post identifiers — when a share post succeeds, we store the resulting post URL and post ID so the ambassador can navigate back to the live post.

How long we keep it

• Access tokens remain encrypted in our database until you press Disconnect in UPLINK or revoke the app at facebook.com → Settings → Apps. Upon revocation we delete the token and associated metadata within 30 days.
• Engagement metric counts are cached for up to 1 hour and refreshed on demand. They are deleted alongside the connection record on disconnect.
• Published post identifiers are retained alongside the associated share-post record for analytics; they contain no personal Meta credential data.

How to revoke

• From UPLINK — go to Profile → Connected Accounts → press Disconnect. This deletes the stored tokens and metadata from our database and asks the provider to revoke the app. Threads provides no API for that, so also remove UPLINK yourself at threads.com → Settings → Website permissions.
• From Facebook directly — go to facebook.com → Settings & Privacy → Settings → Apps and Websites → find "UPLINK" → Remove. Meta will notify us via webhook and we will clean up the associated record within 30 days.
• For full account deletion (UPLINK + all associated data including Meta connection), see our Data Deletion page or email support@connect.ac.

Threads

If you connect Threads, we access your Threads username and user ID (to display your connected account) and a Threads access token (encrypted at rest, ~60-day expiry) to publish your share posts to Threads on your behalf. We keep these only until you press Disconnect on Threads in UPLINK, or revoke access in your Threads settings — after which the token and metadata are deleted within 30 days. We send only the image and caption required to publish, and request no other Threads data.

TikTok

If you connect TikTok, we access your TikTok username, display name and avatar (to show which account a post will go to), your open ID, and access and refresh tokens (both encrypted at rest; the access token expires after 24 hours and is renewed automatically). Before each post we read your current TikTok settings — the privacy levels your account allows and whether you have disabled comments, Duet or Stitch — and we store the settings you confirmed for that post. We use the video.publish permission only to post a video you selected, previewed and confirmed; we never post without that confirmation, and we never add anything to your video. We keep all of this only until you press Disconnect, which revokes our access at TikTok and deletes the stored tokens.

Third parties

Meta (Facebook + Instagram) processes the data we send and receive in line with their own privacy terms. We only send the minimum data required to publish your post (composited image URL and caption) and receive only what is required to identify your account and display the dashboard. We do not share your Meta data with any other third party.