Privacy policy

Who is responsible

The controller of your personal data is Next Vision Ai, LLC, a Delaware (USA) limited liability company ("we", "us"). The controller is established in the State of Delaware, USA, and the product serves visitors to Dubai. Requests can be sent to [email protected]. You can reach us for any privacy question at [email protected]. Our full contact details are at the end of this page.

Who this is for

Viply is for travellers aged 18 or older. We do not knowingly collect data from children. If you think a child has used Viply, write to us and we will delete the data.

What we collect and why

We collect only what we need to plan and run your trip.

• This website: no cookies, no analytics and no third-party scripts, fonts or trackers. Our servers and our network provider process technical data such as your IP address while delivering the site and defending it against abuse.
• Waitlist form: your email address (stored encrypted), the role and language you pick, the time and wording of your consent, and a keyed one-way fingerprint of your IP address for abuse review. Purpose: to write to you about the pilot. Nothing else is sent to that address.
• Your phone number on WhatsApp: to reach you and recognise you. It is stored encrypted, together with a keyed one-way fingerprint so that we can match your messages. A web chat without WhatsApp stores no phone number.
• Your messages and our replies: to plan and run your trip. They are stored encrypted.
• Trip details: dates, interests, party size, and food and access needs if you tell us. Accessibility and halal notes can be inferred from them and are stored with the plan.
• Your location: only at the moment you check in at a place, to confirm you are there. We do not track you in the background.
• Check-in photos: optional. Stored privately.
• Points, rewards and reward codes: to keep your balance and let a venue verify a code.
• Layover flight number: if you give one, it is stored encrypted, used for your plan and removed 7 days after your trip ends. It is never sent to an AI provider.
• Consent records: the notice version, the time, the choices you made, a fingerprint of the exact text shown, and for web chats a keyed fingerprint of your IP address.
• Security and audit records: action codes and counts. They contain no phone numbers, message text or names.

If you message us before agreeing

We keep only the minimum needed to answer and to ask for your consent, and we delete it after 7 days if you do not agree. Nothing else is stored, and nothing is planned for you until you agree.

Tour groups, hosts and guests

Each traveller agrees for themselves. A guide, agency or host cannot consent for anyone.

• Tour groups: a group code on a QR card links your trip to your group only after you have agreed. The agency sees group totals only (for example how many joined and how many visits were made). Figures built from fewer than five trips, including the member count, are hidden. The agency never sees your messages, plan, position, name or phone number.
• Hosts and guests: a guest you invite sees the shared plan and earns their own points. You only see that the guest joined. The guest agrees on their own and can leave at any time.

Legal basis

We rely on your consent. You give it in the notice shown before you start (on WhatsApp or the web), and for the waitlist by ticking the box. The required parts are storing your chat, trip and phone number, and using your location at check-in. Processing your typed text with an AI provider is a separate, optional choice.

The UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL) applies to our processing of the personal data of individuals in the UAE, even though we are established in Delaware, and we aim to follow it. Withdrawing your consent means deleting your data, and you can do that at any time. We have not assessed the laws of other countries in detail. We do not assume that the data protection rules of the DIFC or the ADGM apply.

AI processing (optional)

Planning and understanding your messages normally use simple rules, and in the current pilot AI processing is off unless we tell you otherwise. When it is enabled and only if you chose to allow it, what you type may be processed by Anthropic (USA) to understand your requests. Before that we remove phone numbers, e-mail addresses and passport-like numbers. We do not remove names, addresses, health or religious details if you write them, so please do not include them.

The planner receives trip context without ids, phone number, name or coordinates. If you choose "Agree without AI", nothing you type is sent to any AI provider.

Who receives your data

We do not sell your data and we do not use it for advertising. We do not share personal data with any government entity. Pilot reports contain aggregate figures only.

• Meta Platforms (WhatsApp Business Platform): carries and processes your WhatsApp conversation, including your phone number and message content, as the messaging provider.
• Cloudflare: delivers this website and our services (CDN, proxy and TLS), so it sees technical data such as IP addresses in transit.
• Our hosting: our own servers (hosting location: Hetzner Online GmbH, Helsinki, Finland).
• Anthropic (USA): only if AI processing is enabled and you agreed to it, as described above.
• Open-Meteo and Aladhan: weather and prayer-time lookups for a fixed point in Dubai. No personal data is sent.
• Partner venues: when you redeem a reward, the venue sees the masked reward code and its status, never who you are.
• Authorities: only where the law requires it.

Transfers outside the UAE

WhatsApp is operated by Meta, whose infrastructure is outside our control and may be outside the UAE. Our company is established in the USA, so our team may also access data from outside the UAE. If AI processing is enabled and you agreed, Anthropic processes text in the USA. Cloudflare serves traffic through a global network. Where we host your data is stated above. By agreeing you accept these transfers; you can refuse AI processing and still use Viply.

How long we keep data

These periods run automatically.

• Messages: 90 days after your trip ends.
• Check-in photos: 30 days after your trip ends.
• Precise check-in positions: until 90 days after your trip ends, then only the place is kept.
• A chat you started but never agreed to: 7 days.
• Layover flight number: 7 days after your trip ends.
• Technical delivery records: 30 days.
• If you stop using Viply: your data is erased after 365 days of inactivity. A web chat that never made a trip is erased after 30 days of silence.
• Waitlist entries: 365 days, or earlier if you ask.
• After you delete your data: your trips, bookings and check-ins stay under a random number for 12 months and are then deleted; the points history stays as an accounting record. This is pseudonymised data, not anonymous data.
• Security records: a keyed fingerprint of your network address is kept for 12 months and then cleared.
• Backups are replaced within 30 days.

How we protect data

Phone numbers and messages are encrypted at rest. We use keyed one-way fingerprints instead of storing identifiers where we can. Logs do not contain phone numbers, message text or names. Login links are single use and expire after 10 minutes. Staff access is limited by role and recorded. No system is perfectly secure; if a breach affects you we will tell you and the authority as the law requires.

Your rights

You can use these rights at any time, free of charge. Full steps for deletion are on the data deletion page.

• Copy of your data: send EXPORT on WhatsApp, or use "Download my data" in the web chat.
• Delete everything: send DELETE MY DATA on WhatsApp, or use "Delete my data" in the web chat.
• Stop messages: send STOP. Send START to resume.
• Correction, questions, objections or complaints: write to [email protected]. You may also complain to the UAE data protection authority.

Cookies and tracking

This website sets no cookies and loads no third-party scripts. The web chat keeps a session token in your browser session storage, which ends when you close the tab or delete your data, and does not use advertising or analytics cookies.

Changes

If this policy changes in a way that affects your choices, we will ask you to read and agree again before we continue. The date at the top shows the latest version.

Contact and imprint

Viply, also called Dubai Quest, is provided by Next Vision Ai, LLC, a Delaware (USA) limited liability company.

• Registered office: Next Vision Ai, LLC, 131 Continental Dr, Suite 305, Newark, DE 19713, USA (registered office)
• Company registration: Delaware file number 10747079
• Privacy, legal and data requests: [email protected]
• General contact: [email protected]