Privacy Policy

Privacy Policy & Safe Harbor Governance for SpaceJAT by JATDEV.

Effective October 29, 2026 · Provider: JATDEV · Portal: www.spacejat.com · Jurisdiction: Cairo, Egypt / Dubai, UAE

1. Introduction, Statutory Framework & Foundational Roles

This Privacy Policy governs the manner in which JATDEV (“Company,” “we,” “us,” or “our”) collects, uses, maintains, and discloses information acquired through the SpaceJAT platform, its server software, APIs, desktop clients, mobile applications, and web interfaces (the “Services”).

This Policy is structured in strict compliance with the laws of the Arab Republic of Egypt, including Personal Data Protection Law No. 151 of 2020 (the “Egyptian PDPL”) and its Executive Regulations (MCIT Decree No. 816 of 2025), Anti-Cyber and Information Technology Crimes Law No. 175 of 2018, and Telecommunications Regulation Law No. 10 of 2003, alongside applicable UAE data protection regulations for regional deployments.

To establish rigorous legal and operational clarity, we delineate the following statutory roles:

• Customer as Data Controller / Data Owner (المتحكم في البيانات): When an enterprise, institution, government entity, or commercial subscriber establishes an organization or workspace (“Customer”), that entity is the statutory Data Controller of all content, logs, messages, documents, recordings, and identities created within (“Customer Data”). The Customer is solely responsible for securing valid statutory consents from its End Users and obtaining any required permits from the Egyptian Personal Data Protection Center (PDPC).
• JATDEV as Data Processor / Technical Vendor (معالج البيانات): In Managed Cloud deployments, JATDEV processes Customer Data strictly pursuant to documented Customer instructions and Service Agreements. In Self-Hosted and On-Premises architectures, JATDEV is neither a Controller nor a Processor of Customer Data and acts solely as a software licensor.
• Authorized End Users (الشخص المعني بالبيانات): Individuals accessing the platform via an organizational workspace must direct all statutory data inquiries, retention inquiries, and access or deletion requests to their organizational administrator or Data Protection Officer (DPO).

2. Architecture & Data Sovereignty Models

SpaceJAT offers distinct operational topologies tailored to enterprise sovereignty requirements:

• Self-Hosted & On-Premises: The platform is installed on Customer hardware or private cloud tenants. JATDEV operates zero remote monitoring, zero content storage, and zero telemetry collection unless explicitly authorized via a technical maintenance contract. The Customer bears sole statutory responsibility for infrastructure security and regulatory compliance under Law No. 151 of 2020 and Law No. 175 of 2018.
• Managed Cloud (Dedicated/Multi-Tenant): Customer Data is segmented cryptographically and logically in certified regional data centers (including local Egyptian data centers where contracted) under strict access controls.
• Cryptographic Enclaves & E2EE: For rooms and calls designated as End-to-End Encrypted, cryptographic ratchets and session keys reside exclusively on authenticated client devices. Plaintext cannot be decrypted, reconstructed, or inspected by JATDEV servers, except for a meeting that a host chooses to record or transcribe: participants’ apps then share that call’s media keys with the meeting recorder or transcriber, which decrypts the call to record or transcribe it (Sections 3.3 and 3.4).

3. Information We Collect & Process

JATDEV distinguishes strictly between operational account metadata and customer-managed content:

3.1 Account, Administrative & Statutory Metadata (Collected by JATDEV)

• Subscriber Identifiers: Legal entity name, corporate email address, enterprise billing domicile, administrative contact phone numbers, and commercial/tax registration details.
• Commercial Transaction Details: Billing records, licensing tiers, seat allocations, payment settlement confirmations, and corporate tax compliance records.
• Diagnostic Telemetry: Anonymized client application versions, IP network routing metadata, OS architecture, crash tracebacks, and handshake latency measurements (configurable/deactivatable on self-hosted builds).
• Mandatory Statutory System Logs (Egyptian Law No. 175 of 2018): Strictly for JATDEV-hosted cloud infrastructure and public portals, and in compliance with Article 2 of Egyptian Law No. 175 of 2018 (Anti-Cyber and Information Technology Crimes Law), JATDEV retains system connection logs, IP routing identifiers, session timestamps, and terminal device metadata for a continuous statutory period of 180 days. In Self-Hosted deployments, complying with this 180-day statutory retention requirement is the sole obligation of the Customer.

3.2 Customer Content & Sensitive Data (Controlled Solely by Customer)

Chat messages, shared files, media payloads, whiteboard captures, voice streams, and room structures constitute Customer Data. JATDEV does not access Customer Content except:

1. Upon explicit, authenticated written instruction from the Customer administrator for technical recovery;
2. Transiently in volatile computer memory as strictly required to route real-time signaling and WebRTC media streams across authenticated endpoints.

Under Article 12 of Egyptian Law No. 151 of 2020, the Customer bears sole responsibility for ensuring that any Sensitive Personal Data introduced into its workspace is covered by explicit written consent and applicable PDPC permits. JATDEV disclaims all liability for unauthorized data categories uploaded by a Customer or its End Users.

3.3 Meeting Recordings & Media Key Sharing

When an authorized meeting host initiates a recording in an E2EE call, participant clients share that call’s ephemeral media keys with the designated recording module. Recordings are stored strictly within the Customer’s designated storage environment under Customer retention policies.

3.4 Localized AI Assistants & Transcription

Where a Customer enables localized AI document assistants or speech-to-text transcription, media and document payloads are processed exclusively within the Customer’s isolated inference environment. JATDEV never uses Customer Data, prompts, or transcripts to train external or foundational AI models.

4. Demo, Sandbox & Evaluation Environments

Scope of Application: The provisions of this Section 4 apply exclusively to non-production demonstration, sandbox, beta, trial, and evaluation environments hosted and operated directly by JATDEV (collectively, “Demo Environments”). These provisions do not apply to commercial Customer Self-Hosted, On-Premises, or contracted Managed Cloud production deployments.

• Discretionary Right to Accept or Reject Signups: Access to Demo Environments is a revocable evaluation privilege. JATDEV reserves the full, sole, and absolute right to accept, defer, or reject the signup or registration of any user or organization within Demo Environments at its complete discretion, without any obligation to state a reason or justification.
• Unilateral Right to Ban or Remove Users Without Explanation: JATDEV retains full administrative dominion over all Demo Environments and reserves the unconditional right to ban, suspend, revoke access for, or permanently remove any user account, workspace, or participant from any Demo Environment at any time, without prior notice, explanation, or liability of any kind.
• Ephemeral Data Lifecycle & Abuse Prevention: Demo Environments are provided strictly on an “AS-IS” basis without retention guarantees. Upon rejecting, banning, or removing a user in a Demo Environment, JATDEV may immediately purge all associated trial content and account data without recovery obligations, while retaining minimal blocklist identifiers (such as IP addresses or email hashes) strictly as necessary to prevent repeat unauthorized signups and comply with Egyptian Law No. 175 of 2018.

5. Statutory Disclosures & Judicial Orders

Pursuant to Article 2 of Egyptian Law No. 175 of 2018 and Law No. 151 of 2020, JATDEV preserves the strict confidentiality of stored administrative metadata and logs and does not disclose such information to third parties except pursuant to a formal, justified order issued by competent Egyptian judicial authorities. Due to SpaceJAT’s cryptographic architecture, JATDEV cannot decrypt E2EE communications or access Customer Self-Hosted servers in response to any compulsory order, and will formally certify such technical impossibility where applicable.

6. Cross-Border Transfers & Data Residency

In accordance with Articles 14 and 15 of Egyptian Law No. 151 of 2020, Customers requiring strict national data residency may deploy SpaceJAT On-Premises within Egypt or utilize JATDEV’s local Cairo cloud infrastructure. Where a Customer configures multi-region routing or hosting across JATDEV’s international nodes (including Dubai, UAE), the Customer explicitly authorizes such technical transfers and warrants compliance with applicable regulatory transfer permits.

7. Security Safeguards & 72-Hour Breach Notification

JATDEV enforces enterprise-grade cryptographic security, including TLS 1.3 in transit and AES-256 encryption at rest. In accordance with Article 7 of the Egyptian PDPL (Law No. 151 of 2020) and its Executive Regulations, in the event of a confirmed security breach affecting JATDEV-managed infrastructure, JATDEV will notify the affected Customer Controller and, where statutorily required, the Egyptian Personal Data Protection Center (PDPC) within seventy-two (72) hours of discovery (or within twenty-four (24) hours if national security is implicated).

8. Limitation of Liability & Indemnification

To the maximum extent permitted by Egyptian law, the Customer agrees to indemnify and hold harmless JATDEV from any regulatory fines, claims, or penalties arising from the Customer’s failure to comply with Law No. 151 of 2020, Law No. 175 of 2018, or Law No. 10 of 2003 within its workspace. Furthermore, JATDEV assumes zero liability for any rejected signup, account ban, user removal, or data deletion executed within a Demo Environment under Section 4.

9. Governing Law & Contact Information

This Privacy Policy shall be governed by the laws of the Arab Republic of Egypt, with exclusive jurisdiction vested in the competent Economic Courts of Cairo, Egypt, unless otherwise agreed in a signed Enterprise Master Services Agreement. For privacy or legal inquiries, contact JATDEV at privacy@spacejat.com or legal@spacejat.com.

Terms of Service & SLA