Privacy Policy

Effective Date: 1 July 2025 | Version 1.0

This Privacy Policy is issued in compliance with Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data ("UAE PDPL"), its implementing regulations, and all applicable UAE laws and regulations. TARS is the Data Controller with respect to personal data processed through the Service.

PP.1 Who We Are

TARS ("we", "us", "our") is a software and automation services provider operating in the United Arab Emirates. For the purposes of UAE data protection law, TARS is the Data Controller for personal data collected in connection with the Service. For personal data processed on behalf of the Client (such as customer order data from marketplace accounts), TARS acts as a Data Processor and the Client is the Data Controller.

For data protection enquiries send an email to:

support@mytars.io

Subject: Data Privacy

PP.2 Personal Data We Collect

PP.2.1 Data Collected from Clients (Business Representatives)

When a Client subscribes to the Service, we collect:

• Full name, job title, and business email address of account administrators.
• Business address, trade licence number, and VAT registration number.
• Billing information including payment card details (processed via PCI-DSS compliant payment processors; we do not store full card numbers).
• Phone number and WhatsApp/Slack contact for the daily digest and escalation alerts.
• Login credentials for the TARS platform dashboard (passwords are hashed using bcrypt and are never stored in plain text).

PP.2.2 Marketplace Account Data Processed on Behalf of Clients

In the course of delivering the Service, TARS processes the following categories of data held within the Client's marketplace accounts:

• Product catalogue data: ASINs, SKUs, titles, descriptions, images, pricing, inventory levels.
• Transaction data: Order IDs, order values, fulfilment status, return records, cancellation data.
• Advertising data: Campaign structures, keyword lists, bid histories, ACOS/ROAS metrics, Search Term Reports.
• Customer review data: Review text, star ratings, reviewer identifiers (as provided by marketplace APIs).
• Financial data: P&L metrics, fee structures, reimbursement claim records.

This data is processed solely for the purpose of providing the Service. TARS does not use Client marketplace data for any other purpose, including its own commercial purposes, without explicit written consent.

PP.2.3 Data Collected Automatically

TARS automatically collects the following technical data when the Client accesses the dashboard:

• IP address, browser type, operating system, and device identifiers.
• Session logs, feature usage patterns, and click-stream data for the purpose of service improvement and security monitoring.
• Cookies and similar tracking technologies.

PP.3 Lawful Basis for Processing

TARS processes personal data on the following lawful bases under the UAE PDPL:

PP.4 How We Use Personal Data

TARS uses personal data strictly for the following purposes:

• Providing, operating, maintaining, and improving the Service.
• Sending operational communications including daily digests, escalation alerts, and service notifications.
• Processing payments and issuing VAT-compliant invoices.
• Maintaining security, detecting fraud, and ensuring the integrity of the platform.
• Meeting legal and regulatory obligations under UAE law.
• Compiling anonymised, aggregated analytics that do not identify individual clients.

TARS does not sell, rent, or trade personal data to third parties for marketing purposes. TARS does not use Client marketplace data to train AI models without explicit written consent.

PP.5 Data Sharing and Third-Party Processors

TARS may share personal data with the following categories of third parties, subject to appropriate data processing agreements:

• Cloud Infrastructure Providers: Hosting and compute services operating within UAE or GCC data centres, subject to equivalent data protection standards.
• Marketplace API Platforms: Amazon and Noon receive API calls from TARS on the Client's behalf; the data transmitted is the Client's own account data.
• Payment Processors: PCI-DSS compliant payment service providers for billing purposes.
• Communication Platforms: WhatsApp Business API and/or Slack for delivery of daily digests and escalation alerts, subject to the Client's consent.
• Legal and Regulatory Authorities: Where required by UAE law, court order, or regulatory request.

TARS does not transfer personal data outside the UAE or GCC without ensuring equivalent data protection safeguards are in place, in compliance with UAE PDPL transfer restrictions.

PP.6 Data Retention

TARS retains personal data for the following periods:

• Client account data: For the duration of the subscription plus 5 years (for tax and commercial record-keeping requirements under UAE law).
• Audit logs: Minimum 24 months from the date of the logged action.
• Marketplace Account Data processed as Processor: Retained only for as long as necessary to deliver the Service; deleted within 30 days of contract termination.
• Security and access logs: 12 months.
• Payment records: 5 years in compliance with UAE VAT regulations.

Upon expiry of the relevant retention period, personal data is securely deleted or anonymised.

PP.7 Data Subject Rights Under UAE PDPL

Under the UAE Federal Decree-Law No. 45 of 2021, data subjects have the following rights with respect to their personal data:

• Right of Access: The right to request confirmation of whether TARS holds personal data about you and to obtain a copy of such data.
• Right of Rectification: The right to request correction of inaccurate or incomplete personal data.
• Right to Erasure: The right to request deletion of personal data where it is no longer necessary for the purpose for which it was collected, subject to legal retention obligations.
• Right to Restriction: The right to request that processing be restricted in certain circumstances.
• Right to Data Portability: The right to receive personal data in a structured, commonly used, machine-readable format.
• Right to Object: The right to object to processing based on legitimate interests.
• Right to Withdraw Consent: Where processing is based on consent, the right to withdraw consent at any time without affecting the lawfulness of prior processing.

To exercise any of the above rights, please contact our Data Protection Officer at privacy@tars.ae. TARS will respond to all requests within 30 days. Where a request is complex or numerous, TARS may extend this period by a further 30 days with written notice.

PP.8 Security Measures

TARS implements comprehensive technical and organisational security measures consistent with the UAE PDPL and industry best practices:

• AES-256 encryption of all credentials and sensitive data at rest.
• TLS 1.3 encryption for all data in transit.
• Role-based access controls with multi-factor authentication for platform access.
• Penetration testing conducted on a minimum semi-annual basis.
• Credential vault with strict access logging and rotation policies.
• Event bus with immutable audit trail for all system actions.
• ISO 27001-aligned information security management practices.
• Regular vulnerability scanning and patch management.

In the event of a personal data breach that is likely to result in a risk to data subjects, TARS will notify the UAE Data Office and affected Clients in accordance with UAE PDPL notification requirements.

PP.9 Cookie Policy

The TARS dashboard uses the following categories of cookies:

• Strictly Necessary Cookies: Required for the platform to function. These cannot be disabled. They include session tokens, authentication cookies, and CSRF protection tokens.
• Functional Cookies: Remember Client preferences such as language settings and dashboard layout. These are enabled by default but can be disabled in browser settings.
• Analytics Cookies: Anonymised usage analytics to help TARS improve the platform. Clients may opt out via the Cookie Preferences panel in the dashboard.

TARS does not use advertising or tracking cookies. Cookie preferences can be managed at any time through the dashboard settings.

PP.10 Children's Data

The TARS Service is not directed at individuals under the age of 18 and we do not knowingly collect personal data from minors. If we become aware that we have inadvertently collected personal data from a minor, we will delete it promptly.

PP.11 Changes to this Privacy Policy

TARS may update this Privacy Policy periodically to reflect changes in the law, our practices, or the Service. We will notify Clients of material changes by email or via the dashboard at least 14 days before the changes take effect. The current version of this Policy is always available on our website and in the dashboard.

PP.12 Data Processing Agreement

Where TARS processes personal data on behalf of the Client as a Data Processor (for example, processing marketplace customer order data), a separate Data Processing Agreement (DPA) governs such processing. The DPA forms part of the overall service agreement and is available upon request. The DPA sets out the subject matter, nature, purpose, and duration of processing, the type of personal data processed, and the obligations and rights of both parties.

PP.13 Contact and Complaints

For data protection enquiries send an email to:

support@mytars.io

Subject: Data Privacy

If you are not satisfied with how TARS has handled your data protection concern, you have the right to lodge a complaint with the UAE Data Office (www.dataoffice.gov.ae), the competent supervisory authority in the UAE.

Terms of Service

Effective Date: 1 July 2025 | Version 1.0

These Terms of Service ("Terms") constitute a legally binding agreement between you ("Client", "Vendor", or "User") and TARS ("we", "us", or "our"), governing your access to and use of the TARS Trading Automation & Retail System platform, including all associated software, bots, tools, APIs, dashboards, and services (collectively, the "Service").

By accessing or using the Service, you confirm that you have read, understood, and agree to be bound by these Terms and our Privacy Policy. If you do not agree, you must not use the Service.

These Terms are governed by and construed in accordance with the laws of the United Arab Emirates, including Federal Decree-Law No. 45 of 2021 on Personal Data Protection (PDPL) and all applicable UAE commercial laws.

2. Definitions

The following terms have the meanings set out below throughout these Terms and the Privacy Policy:

• TARS / Platform: The Trading Automation & Retail System, an AI-powered multi-bot automation platform for e-commerce account management on Amazon UAE/KSA and Noon UAE/SAU.
• Client / Vendor: The business entity or individual that has subscribed to the Service and authorised TARS to act on their marketplace accounts.
• Bots: Automated software agents within TARS including the Chief of Staff Bot, Catalogue Bot, Pricing Bot, Ad Bot, Operations Bot, Review Bot, and Analytics Bot.
• Marketplace APIs: Third-party platform interfaces including Amazon SP-API, Amazon Ads API, Noon Vendor API, and Noon Seller Lab, through which TARS executes actions.
• Account Data: All data, credentials, sales records, inventory data, advertising metrics, customer reviews, and operational information associated with the Client's marketplace accounts.
• Autonomous Actions: Actions executed by Bots without real-time human approval, within pre-configured rules and thresholds set by the Client.
• Approval Queue: The human oversight interface through which the Client reviews, approves, or rejects Bot-proposed actions before execution.
• Escalation Alert: An automated notification triggered when critical account health metrics approach risk thresholds.
• MAP: Minimum Advertised Price, the floor price below which TARS will not reprice any product.
• ACOS/ROAS: Advertising Cost of Sale / Return on Ad Spend, key advertising performance metrics managed by the Ad Bot.

3. Description of the Service

3.1 Overview

TARS provides an AI-orchestrated automation platform designed to manage e-commerce operations across Amazon UAE/KSA and Noon UAE/SAU on behalf of the Client. The Service comprises seven specialist Bots coordinated by a Chief of Staff Bot:

• Chief of Staff Bot: LLM orchestrator that reads account state, prioritises tasks, routes instructions, and produces daily briefings.
• Catalogue Bot: Manages listing health, title and content optimisation, image compliance, and suppression fixes. Runs daily at 6:00 AM.
• Pricing Bot: Executes dynamic repricing within configured MAP floors and price ceilings, competitor scanning, deal scheduling, FBA fee recalculation, and reorder triggers. Runs every 3 hours.
• Ad Bot: Manages bid optimisation, budget allocation via dayparting, keyword harvesting from Search Term Reports, and negative keyword pruning. Runs every 6 hours.
• Operations Bot: Monitors orders, returns, SLA metrics, account health (ODR, LSR, Cancellation Rate), reimbursement claims, and FBA inventory. Runs continuously on a 15-minute polling cycle.
• Review Bot: Monitors reviews, drafts responses for Client approval, flags product quality issues, tracks review velocity, and manages Vine enrolment. Runs twice daily.
• Analytics & Intel Bot: Generates P&L reports, competitor benchmarking, keyword rank tracking, and daily WhatsApp/Slack morning digests. Runs daily at 6:00 AM.

3.2 Human Oversight Layer

All Bot actions are subject to the Human Oversight Layer, which includes an Approval Queue, override controls, daily digest reporting, and escalation alerts. The Client retains full authority to approve, reject, or override any Bot-proposed action at any time.

Certain high-impact actions (including but not limited to new campaign creation, price changes exceeding configured thresholds, and listing content submissions) are routed to the Approval Queue before execution. The Client must configure approval thresholds during onboarding.

3.3 Scope Limitations

TARS explicitly does not replace or automate vendor relationship decisions, new product launch strategy, brand positioning, supplier negotiations, or any decision the Client designates as requiring human judgement. TARS surfaces data and recommendations; strategic decisions remain solely with the Client.

4. Client Obligations and Responsibilities

4.1 Account Authorisation

The Client is solely responsible for authorising TARS to access their Amazon and Noon marketplace accounts via the relevant APIs. The Client warrants that they hold all necessary rights and permissions to grant such access and that doing so complies with the terms of service of the respective marketplaces.

4.2 Configuration and Oversight

The Client must:

• Configure all required parameters prior to go-live, including MAP floors, price ceilings, bid ranges, budget limits, approval thresholds, and escalation notification preferences.
• Monitor the Approval Queue and respond to escalation alerts in a timely manner.
• Review the daily digest and take corrective action where flagged.
• Ensure that designated personnel with appropriate authority have access to the oversight interface.

4.3 Accuracy of Information

The Client is responsible for ensuring that all product information, inventory data, pricing structures, and account credentials provided to TARS are accurate and up to date. TARS is not liable for errors arising from inaccurate or outdated information supplied by the Client.

4.4 Marketplace Compliance

The Client remains solely responsible for compliance with all policies of Amazon, Noon, and any other marketplace on which TARS operates. TARS automates actions within the Client's account but does not guarantee that such actions will comply with marketplace policies that change after the Service is configured.

4.5 Prohibited Uses

The Client must not use the Service to:

• Manipulate reviews, ratings, or search rankings in violation of marketplace policies.
• Engage in price-fixing, collusion, or any anti-competitive conduct prohibited under UAE Federal Law No. 4 of 2012 on Regulating Competition.
• Infringe the intellectual property rights of any third party.
• Process or store data in violation of applicable data protection laws.
• Circumvent marketplace security measures or scrape data beyond what is permitted by API terms.

5. Autonomous Actions, Approvals, and Liability Allocation

5.1 Autonomous Action Framework

Within the thresholds configured by the Client, certain Bots execute actions autonomously without requiring per-action approval. These include repricing within MAP and ceiling bounds, bid adjustments within configured ranges, and reimbursement claim submissions.

5.2 Client Responsibility for Autonomous Actions

The Client accepts full responsibility for all Autonomous Actions executed within the thresholds they have configured. TARS acts as an authorised agent of the Client in executing such actions. The Client should configure conservative thresholds initially and expand them only after reviewing Bot performance.

5.3 Escalation and Override

The Operations Bot will trigger an immediate Escalation Alert when the Client's Order Defect Rate (ODR) approaches 1% or Late Shipment Rate (LSR) approaches 4%. Upon receipt of an Escalation Alert, the Client must review and take appropriate action. TARS will pause affected automated actions pending Client confirmation where technically feasible.

5.4 Limitations of Liability

To the maximum extent permitted by UAE law:

• TARS shall not be liable for any losses arising from marketplace account suspension or penalty resulting from the Client's violation of marketplace policies.
• TARS shall not be liable for lost profits, lost revenue, or consequential damages arising from Bot decisions made within the Client's configured parameters.
• TARS's total aggregate liability to the Client shall not exceed the fees paid by the Client in the three (3) months immediately preceding the event giving rise to the claim.
• Nothing in these Terms excludes liability for fraud, gross negligence, or death or personal injury caused by TARS's negligence.

6. API Access, Credentials, and Security

6.1 Credential Vault

All marketplace API credentials, access tokens, and authentication keys provided by the Client are stored in an encrypted Credential Vault within the TARS shared infrastructure. TARS implements industry-standard AES-256 encryption at rest and TLS 1.3 encryption in transit for all credential storage and transmission.

6.2 Rate Limit Management

TARS operates a Rate Limit Manager to ensure that API calls to Amazon and Noon do not exceed the permitted quotas for the Client's account tier. The Client acknowledges that marketplace API limits are set by Amazon and Noon respectively and are beyond TARS's control.

6.3 Audit Logging

TARS maintains a comprehensive Audit Log of all Bot actions, API calls, approvals, and overrides for a minimum period of 24 months. The Client may request access to their Audit Log at any time. Audit logs are stored within UAE jurisdiction in compliance with UAE data residency requirements.

6.4 Security Incidents

In the event of a security incident affecting Client credentials or Account Data, TARS will notify the Client within 72 hours of becoming aware of the incident, consistent with UAE PDPL obligations, and take immediate steps to mitigate the impact.

7. Fees, Payment, and Subscription

7.1 Fees

Fees for the Service are as set out in the Client's Order Form or Subscription Agreement. All fees are quoted in UAE Dirhams (AED) exclusive of VAT unless otherwise stated. VAT is applicable at the rate prescribed under UAE Federal Decree-Law No. 8 of 2017 on Value Added Tax.

7.2 Payment Terms

Fees are payable monthly in advance unless otherwise agreed. TARS reserves the right to suspend the Service after 14 days' written notice if fees remain unpaid. Disputed invoices must be raised within 7 days of receipt.

7.3 Refunds

Fees paid in advance are non-refundable except where TARS has materially failed to deliver the Service as described in these Terms and has failed to remedy such failure within 30 days of written notice from the Client.

8. Intellectual Property

8.1 TARS IP

All intellectual property rights in the TARS platform, including the Bot architecture, orchestration logic, algorithms, models, dashboards, and documentation, are and remain the exclusive property of TARS. These Terms grant the Client a limited, non-exclusive, non-transferable licence to access and use the Service during the subscription term.

8.2 Client Data

All Account Data, product information, and business data belonging to the Client remain the Client's property. TARS is granted a limited licence to access, process, and analyse such data solely for the purpose of delivering the Service.

8.3 Feedback

If the Client provides TARS with suggestions, feedback, or ideas regarding the Service, TARS may use such feedback without restriction or compensation to the Client.

9. Term and Termination

These Terms commence on the Effective Date and continue until terminated. Either party may terminate the Service by providing 30 days' written notice. TARS may terminate immediately upon the Client's material breach of these Terms. Upon termination, TARS will provide the Client with a final Audit Log export and delete Client credentials from the Credential Vault within 30 days.

10. Governing Law and Dispute Resolution

These Terms are governed by the laws of the United Arab Emirates. Any dispute arising from or in connection with these Terms shall first be referred to good-faith negotiation. If unresolved within 30 days, the dispute shall be submitted to the exclusive jurisdiction of the courts of Dubai, UAE. The parties may mutually agree to refer disputes to arbitration under the DIAC Arbitration Rules.