Atreff Privacy Policy
Last updated: 24 September 2026
Replaces the version last updated 17 September 2026.
This Privacy Policy explains how personal data is collected, used, stored and shared when you use Atreff, including the website at atreff.com and the group and event sign-up services available through it.
This Privacy Policy is available in Arabic and English. If there is any inconsistency between the two versions, the Arabic version prevails.
1. Who we are
Atreff is operated by Klarsted FZC LLC, a free zone limited liability company licensed by Sharjah Publishing City – Free Zone Authority (licence no. 4432092.01), Business Centre, Sharjah Publishing City Free Zone, Sharjah, United Arab Emirates ("Atreff", "we", "us" or "our").
We are responsible for the personal data described in this policy. We process it in accordance with the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data ("PDPL"), and any other data protection law that applies to you.
Privacy questions and requests: privacy@atreff.com.
2. What Atreff does
Atreff is a sign-up tool for groups and events. Organisers create groups and events and share a link. Participants use the link to see upcoming events and to join, leave or join a waitlist.
Atreff is designed so that people in a group can see who has signed up for an event. Section 6 explains exactly who can see what.
3. Personal data we collect
We aim to collect only what we need to run Atreff.
Your account
- your name and email address;
- when and how you accepted our Terms of Use, which version you accepted, which version of this Privacy Policy you were shown, and your confirmation that you are 18 or over;
- your choice about event updates (see section 12); and
- sign-in and security information, such as one-time sign-in codes and session information.
Atreff doesn't use passwords. You sign in with a one-time code sent to your email address.
Groups and events
If you are an organiser, we collect what you enter when you create and manage groups and events. This includes the group's name and description, activity type, event names, dates and times, locations, minimum and maximum numbers, costs, cancellation deadlines, notes, and whether you want an attendance update before an event. We also record your confirmation that people you add by name are 18 or over and happy to be listed.
Most of this isn't personal data. It can become personal data if you include information about a person. Please don't include sensitive information about yourself or others in free-text fields (see section 17).
Taking part in events
When you use an event, we record:
- which events you joined;
- whether you are going or on the waitlist, and your place on the waitlist;
- whether you left an event or waitlist, or were removed by the organiser;
- whether you were moved up from the waitlist;
- whether the organiser has marked you as paid, where the event has a cost; and
- the related dates and times.
We keep information about past and cancelled events so that organisers and participants can see event history.
People added by an organiser
An organiser can add a person to an event by typing their name, for example if the person doesn't use Atreff. We then store only that name, the event it relates to, and the person's status and payment mark as recorded by the organiser. We don't create an account for that person and we don't contact them. We don't link their name across events.
The organiser must only add people who are 18 or over and happy to be listed (see section 7). If you have been added and want your name removed, contact the organiser or email us.
Messages
When we email you, we process your email address, the content of the message (for example a sign-in code or a message that you have been moved up from a waitlist), and whether the message was sent or failed. We don't track whether you open our emails or click their links.
We also process messages you send us, for example support requests.
How Atreff is used
We record basic actions in Atreff, such as events created, joins, leaves, waitlist moves and use of the share buttons. These records hold identifiers and counts, not names. We use them to understand how Atreff is used, and to improve and develop it. We do not currently use them for advertising.
Technical information
When you use Atreff, our hosting and security systems process limited technical information to run and protect the service. This includes your IP address, browser and device information, access times, pages or functions used, error information and security logs.
We use your email address and IP address to limit repeated sign-in attempts. When you ask for a sign-in code, Cloudflare Turnstile checks that the request comes from a person and not an automated program, using technical information from your browser and device.
4. What Atreff does not do
- Atreff does not process payments, and does not collect payment card or bank details.
- Atreff does not sell or rent personal data, and does not give lists of users to advertisers or other businesses.
- Atreff does not currently show advertising or use personal data to target advertising.
- Atreff does not send marketing messages.
- Atreff does not ask for your precise location.
- Atreff does not collect phone numbers.
- Atreff does not access your WhatsApp contacts, chats or groups. When you share an event to WhatsApp, WhatsApp opens with the text ready to send, and you choose where it goes.
An organiser may show a cost for an event and record whether someone has paid. That record is the organiser's own note. Payments are arranged outside Atreff.
If we introduce new features that change any of this, we will update this Privacy Policy before the new processing starts.
5. How we use personal data, and why we're allowed to
Under the PDPL, personal data may be processed with your consent, or without it in specific cases set out in the law. This table shows what we use personal data for and which case applies.
| What we use it for | Why we're allowed to |
|---|---|
| Creating and running your account; signing you in; running groups, events, waitlists and history; sending sign-in codes, waitlist messages, organiser updates and essential account messages; remembering your settings | It is necessary to provide the service you asked for under our Terms of Use |
| Keeping Atreff secure; limiting sign-in attempts; checking for automated abuse; fixing problems | It is necessary to provide the service safely under our Terms of Use, and to protect your interests |
| Understanding how Atreff is used, producing statistics, and using what we learn to improve Atreff | The law permits processing for statistical studies. You can object to this (section 15) |
| Listing people an organiser adds by name | The person's consent to being listed. Before organisers can add anyone by name, they must confirm that the people they add have agreed, and we keep a record of that confirmation. The person can withdraw consent at any time by asking the organiser or us to remove their name |
| Complying with the law and responding to valid legal requests | It is necessary to meet our legal obligations |
| Establishing, exercising or defending legal claims | The law permits processing for this purpose |
Apart from listing people added by name, we don't rely on consent for the core service. If we ever ask for your consent for something optional, we will ask separately, and you can withdraw it at any time. Withdrawing consent does not affect what happened before.
We won't use personal data for a purpose that is incompatible with the reason we collected it.
6. Who can see your information
People who aren't signed in and open a group or event link can see the event details and how many people are going, but not participants' names.
People who are signed in and open a group or event link can see participants' names, and whether each person is going or on the waitlist.
The organiser of an event can see participant names, whether each person is going or on the waitlist, the waitlist order, and payment marks. The organiser can also see whether an Atreff message to a participant has been sent or has failed, so they can contact that person directly if it failed.
Your email address is never shown to other participants or to organisers.
When someone deletes their account, their past sign-ups are shown as "Former member".
Group and event links are meant to be shared. Someone who receives a forwarded link and signs in can see the names of people signed up. Don't treat an Atreff link as confidential.
7. Organisers and participant information
Organisers see the information described in section 6 so they can manage their groups and events. They must use it, and any names they add, only for purposes connected with their group or events. They must not use it for unrelated marketing, spam or harassment, or pass it to others.
Organisers must only add people by name who are 18 or over, happy to be listed, and whose names they have a proper reason to share with the group.
If an organiser copies or uses participant information outside Atreff, the organiser is responsible for that use. Atreff does not control what happens to information once it has been taken outside Atreff.
8. Service providers
We use these providers to run Atreff. They process personal data on our behalf, and each has its own data protection and security commitments.
| Provider | What it does | Where it processes data |
|---|---|---|
| Supabase | Database and sign-in | Ireland (EU) |
| Vercel | Website hosting | Ireland (EU); Vercel may also transfer data to the United States |
| Resend | Sending email | Emails are sent through Japan; email records are stored in the United States |
| Cloudflare (Turnstile) | Checking sign-in requests come from a person | Cloudflare's data centres in the United States and Europe |
We may also disclose personal data where reasonably necessary:
- to comply with the law or a valid legal request;
- to establish, exercise or defend legal rights;
- to investigate fraud, misuse or security incidents;
- where needed to protect your interests, or where the law otherwise permits it; or
- as part of a merger, sale or restructuring of all or part of our business, subject to confidentiality and data protection safeguards.
9. International transfers
Atreff is operated from the United Arab Emirates, but our providers process personal data outside the UAE. It is mainly processed in Ireland, in the European Union. Emails are sent through Japan, email records are stored in the United States, and the sign-in check runs on Cloudflare's data centres in the United States and Europe. Section 8 has the details.
We transfer personal data outside the UAE in accordance with the PDPL, and we use providers that commit to protecting it.
10. How long we keep personal data
| Information | How long we keep it |
|---|---|
| Your account (name, email address, acceptance records) | While your account exists. Deleted when you delete your account (section 13) |
| New accounts where the Terms were never accepted | Deleted 7 days after the account was started |
| Sign-ups, groups and events | Kept as event history while the group exists. When you delete your account, your sign-ups are kept as "Former member" without your name |
| Closed groups (for example, because their only organiser deleted their account) | Deleted, with their events and sign-ups, 12 months after closing |
| Notices inside Atreff | 12 months |
| Records of emails we send | 90 days; records of sign-in code emails, 24 hours |
| Sign-in attempt records (email address and IP address) | 7 days |
| Usage records (section 3) | Kept, holding identifiers and counts only. Unlinked from you when you delete your account |
Our providers also keep their own technical records for the periods they set: Supabase's sign-in logs, Vercel's request logs (kept for up to a day), and Resend's records of the emails it sends (stored in the United States). Any backups of our database are kept for no more than 7 days.
Information needed to resolve a dispute or meet a legal obligation may be kept longer, for as long as that need lasts.
Aggregated and anonymised information
We may combine information from across Atreff into aggregated statistics or anonymised information, for example about activity types, event timing, broad locations, group sizes, sign-ups, cancellations and waitlists. We use this to understand how Atreff is used and how demand for activities changes, and to improve, develop and promote Atreff. We may share statistics like these with venues, organisers and other organisations. When we share them or use them to promote Atreff, they are in a form that does not identify you, and does not identify your group without the organiser's agreement. Once information has been properly anonymised, it no longer identifies you, so we may keep it after the underlying personal data has been deleted.
11. Cookies and similar technologies
Atreff uses only what is strictly necessary to run the service:
- a sign-in cookie, which keeps you signed in; and
- Cloudflare Turnstile on sign-in screens, which checks that a sign-in request comes from a person. It uses a one-time token and technical information from your browser.
Atreff does not use analytics, advertising or tracking cookies. If we ever want to use technologies that aren't strictly necessary, we will tell you first and ask for your consent where the law requires.
12. Your messaging choices
You can stop event emails by choosing Don't send updates in My events. If you do, we won't email you about events, including when you are moved up from a waitlist, so check your status in Atreff yourself. Sign-in codes and essential messages about your account are still sent, and notices inside Atreff still appear.
13. Deleting your account
You can delete your account at any time from Delete my account in Atreff, or by emailing privacy@atreff.com.
When you delete your account:
- your name, email address, acceptance records and group memberships are deleted;
- your past sign-ups stay in event history as "Former member", so organisers' numbers stay accurate;
- your name is removed from other people's notices and from records of emails sent to other people;
- records of emails we sent you, your sign-in code records and your sign-in attempt records are deleted;
- usage records are unlinked from you;
- groups where you are the only organiser are closed, and their upcoming events are cancelled. People signed up see a notice in Atreff. Until the closed group is deleted 12 months later, with its events and the names in them, its remaining members can still see those names;
- groups with another organiser continue. Group and event descriptions and notes you wrote stay as written, without your name attached as their author. If you included your name in that text, it stays unless you edit it before deleting your account. Names of other people you added to events stay in those events' history.
Copies may remain in any database backups for up to 7 days, and in our providers' own records for the periods they set: Supabase's sign-in logs, Vercel's request logs, and Resend's records of the emails it sent (stored in the United States).
14. Security
We use technical and organisational measures to protect personal data against unauthorised access, accidental loss, misuse, alteration, disclosure and destruction. These measures include access controls, encrypted connections and protection against automated abuse. No online service can guarantee complete security.
Please protect access to your email account, because it is how you sign in, and think about who you share Atreff links with.
If a personal data breach puts your privacy, confidentiality or security at risk, we will notify you and the UAE Data Office where the PDPL requires it.
15. Your rights
Under the PDPL, and depending on any other law that applies to you, you have the right to:
- be told what personal data we hold about you and how we use it;
- get a copy of your personal data and, where technically possible, have it transferred to another provider;
- have inaccurate or incomplete data corrected;
- have your personal data deleted;
- have processing of your data restricted;
- object to processing for direct marketing, including related profiling, or for statistical surveys, and object where processing breaks the PDPL;
- ask for human review of a decision made solely by automated processing that has legal or similarly serious effects on you (Atreff doesn't make such decisions; see section 18);
- withdraw any consent you have given; and
- complain to the UAE Data Office.
Some rights are subject to conditions or exceptions in the law.
To use a right, email privacy@atreff.com. We may need to confirm your identity first. You can also delete your account yourself in Atreff (section 13).
16. Age limit
You must be 18 or over to use Atreff. Everyone listed for an event must be 18 or over, including people an organiser adds by name. If you believe someone under 18 has an account or has been listed, contact us and we will remove the information.
17. Sensitive information
Atreff is not designed to collect sensitive personal data, such as information about health, religion, ethnic origin, political or philosophical opinions, family, biometrics or criminal records. Please don't include this kind of information in group or event names, descriptions or notes unless there is a real need and it is lawful.
18. Automated processing
Atreff applies simple automatic rules to run events. It works out whether an event has reached its minimum or maximum, places people on a waitlist once an event is full, and moves the first person on the waitlist up when a place becomes available. These rules follow the organiser's settings and the order in which people signed up. Atreff does not use profiling to make decisions about you.
19. Other services and links
Atreff may link to other websites, venues or services, and lets you add events to your own calendar or share them to WhatsApp. Those services have their own privacy practices, which this policy doesn't cover.
20. Changes to this Privacy Policy
We may update this Privacy Policy as Atreff develops or when legal or operational requirements change. Each version shows the date it was last updated. If we make a material change to how we use personal data, we will tell you before it applies, and show you the updated policy in Atreff.
21. Contact us
Klarsted FZC LLC
Business Centre, Sharjah Publishing City Free Zone, Sharjah, United Arab Emirates
Privacy questions and requests: privacy@atreff.com
You can also complain to the UAE Data Office, or to the data protection authority in your country.