1. Who is responsible for your data
The controller of personal data described in this notice is RITS Solutions LLC, trading as Framework27, a Wyoming limited liability company, 1309 Coffeen Avenue, STE 18929, Sheridan, Wyoming 82801, United States. We are operated from Dubai and work mainly with businesses in the United Arab Emirates.
Contact for anything in this notice, including rights requests: hello@framework27.ai.
2. What this notice covers
This notice covers personal data we handle for our own purposes: visitors to framework27.ai, people who enquire or book a call, and the contacts at our clients and prospects.
When we deliver services for a client and handle personal data about that client's customers, leads or staff, the client is the controller and we act as its processor under our Data Processing Agreement. That client's own privacy notice applies to that data, not this one.
3. What we collect
When you send an enquiry
The enquiry form asks for your name, work email and company, and optionally your website, your revenue band and a description of what is not working. We also record which form you used and when.
When you book a call
The booking page asks for your contact details and the time you choose. Calls are held on Zoom. We only record a call if we tell you first.
When we correspond or work together
Emails and messages you exchange with us, call notes, and for clients the contract, billing and contact details needed to run the engagement. Payments are taken by Stripe. We never see or store full card numbers.
When you browse the site
Our hosting provider processes technical data that every visit generates, such as IP address, browser type and the page requested, to serve the site and protect it from abuse. The site loads fonts from Google Fonts and scripts from cdnjs and jsDelivr, which means those providers receive your IP address when the page loads.
Cookies. This site does not set analytics or advertising cookies, and does not use advertising pixels. If we add analytics or advertising tools, we will update this notice first and ask for your consent where the law requires it. The booking page is provided by our CRM provider and may set cookies it needs to work.
4. Why we use it, and on what basis
| Purpose | Legal basis |
|---|---|
| Replying to your enquiry and arranging calls | Steps you ask us to take before a contract; our legitimate interest in responding to business enquiries |
| Delivering paid services, invoicing and account management | Performance of our contract with you or your employer |
| Keeping accounting, tax and contract records | Legal obligations |
| Securing the site and our systems, preventing misuse | Legitimate interests |
| Occasional business updates about our services | Your consent, or our legitimate interest in contacting business customers, with an opt-out in every message |
Under the UAE Personal Data Protection Law we rely on the equivalent grounds it allows, including consent, performance of a contract, and compliance with legal obligations.
We do not sell personal data. We do not use it to train AI models. We do not make decisions that have legal or similarly significant effects on you by automated means alone.
5. How AI is involved
Our AI operator, Axis, may read enquiries, summarise them and draft replies. Axis runs on Anthropic's Claude models through their business API. A human reviews what is sent on our behalf. You can ask for your correspondence to be handled by a human only. Details are in our AI disclosure.
6. Who processes data for us
We share personal data only with providers that help us run Framework27, under contracts that limit their use of it:
| Provider | What it does for us |
|---|---|
| HighLevel (LeadConnector) | CRM: stores enquiries and contacts, runs the booking calendar and our email and messaging |
| Cloudflare | Hosts this site, runs the form handler, protects against abuse; also delivers scripts via cdnjs |
| Microsoft 365 | Our business email |
| Anthropic | AI models used by Axis to read and draft (business API) |
| Zoom | Video calls |
| Google Fonts and jsDelivr | Deliver fonts and scripts the site loads |
| Supabase and Hetzner | Data warehouse and automation server used to deliver client engagements |
| Slack | Internal approval queue for client work |
| Stripe | Takes payments; Stripe acts as an independent controller of payment data |
We may also disclose data where the law requires it, or to a successor business if Framework27 is transferred, under the same protections.
7. International transfers
Our providers store and process data in the United States, the European Union and other locations. Where the EU or UK GDPR applies, we rely on adequacy decisions or the Standard Contractual Clauses. Where the UAE PDPL applies, we transfer data only on the bases it permits, with contractual protections in place.
8. How long we keep it
- Enquiries and prospect records that do not become clients: up to 24 months after our last contact, then deleted.
- Client contact, contract and billing records: for the engagement, then as long as accounting and tax law requires.
- Data handled for a client's engagement: returned or deleted after the engagement ends, as set out in the Data Processing Agreement.
- Technical and security logs: kept by our hosting provider for its standard short periods.
9. Your rights
Depending on the law that applies to you, you can ask us to: give you a copy of your data; correct it; delete it; restrict or object to how we use it; give it to you in a portable format; and stop using it for marketing. Where we rely on consent, you can withdraw it at any time. You can also ask for a human to review any automated processing.
Email hello@framework27.ai. We reply within 30 days and may need to confirm your identity first. If you are not satisfied, you can complain to the regulator where you live or work, such as the UAE Data Office, an EU data protection authority or the UK Information Commissioner's Office.
10. Security
Traffic to this site and between our systems is encrypted in transit. Access to client systems is least-privilege, and access tokens are held in encrypted credential storage, never in documents or email. No security is perfect. If a breach affects your data, we will tell you and the regulator where the law requires it.
11. Changes
We will post any update here with a new "last updated" date, and tell clients directly about material changes.