Privacy Policy

Last updated: 9 November 2026

1. Who we are

Smart-LOI is software operated by DCI Markets Ltd, a company limited by shares registered in Innovation City, Ras Al Khaimah, United Arab Emirates (licence number 07010685). In this policy, "we" and "us" mean DCI Markets Ltd.

Registered office: DCI Markets Ltd, Innovation City, Ras Al Khaimah, United Arab Emirates.

Privacy contact: support@smart-loi.com (please write "Privacy" in the subject line).

2. Two roles: controller and processor

We handle personal data in two different roles.

We are the controller (we decide why and how the data is used) for:

• people who hold a Smart-LOI account with us, including an investor's own records in the app until they are shared;
• staff and billing contacts of organisations that use Smart-LOI;
• people who contact us through this website;
• records addressed to an organisation that has not yet joined Smart-LOI (section 5).

We are the processor (an organisation decides why and how the data is used, and we act on its instructions) for:

• investor records that an organisation receives, either through its own capture page or because an investor shared a record with it;
• contact details that an organisation uploads so that we can send invitation links on its behalf.

For that second group the organisation is the controller, and its own privacy notice applies as well as this one. The change of role is never silent. Sharing a record is always your own choice, and we tell you at the moment you do it.

3. What we collect

• Records you create or submit. Name (or entity name), e-mail address, phone number and country, and the investment intent you state: for example amount range, time horizon and asset category. On the fuller forms also your stated preferences (such as preferred yield, funding or settlement preference, liquidity preference and existing exposure), city, background, a self-declared investor category (you can choose "prefer not to say") and optional details of an entity you act for (type, country of incorporation, registration number, job title, website). These are your own stated, non-binding preferences.
• Context of a record. The capture link, campaign, event or introducer a record came through, the form type, the device type, and the time and wording of the confirmation you ticked.
• Unsubmitted drafts. What you have typed but not yet submitted, saved so that you can resume or recover it.
• Your account and the app. Your e-mail address (you sign in with a link sent by e-mail; we do not use passwords), your records with their versions, status and shares, your settings, your device's push-notification token, and your messages with organisations.
• Choices you record. Where an organisation offers an optional box agreeing to receive its communications, whether you ticked it, and when. Your "contact me only through the app" setting, where the app offers it.
• Staff and billing contacts of organisations. Name, work e-mail address and role. Card details are taken by our payment provider; we do not receive full card numbers.
• People an organisation invites. The name and contact details the organisation uploads, a personal invitation link, and whether the link was opened or the person opted out.
• Website enquiries. Name, company, work e-mail address, enquiry type and your message.
• Technical data. IP address, device and browser details and the time of access, in logs kept for security and troubleshooting, and aggregate page-view measurements (section 11).

We do not ask for special-category data (such as health, religion or political views). Please do not type any into a free-text box. Smart-LOI does not take payments from investors, hold funds, or ask for card or bank details.

4. Why we use your data, and our legal basis

We use personal data to:

• provide the app and keep your records (to perform our contract with you);
• share a record with an organisation you choose (your instruction and consent);
• send service messages: sign-in links, receipts, and notices that an organisation has written or asked you to update a record (to perform our contract with you). We send no marketing to investors;
• reply to a website enquiry (steps you ask us to take);
• bill organisations and keep accounting records (contract and legal obligation);
• protect the platform, prevent misuse and meet our security duties (legal obligation and, under GDPR, legitimate interests);
• produce anonymised statistics (section 7) and measure page views in aggregate (section 11);
• comply with the law and establish or defend legal claims.

Under the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021), we rely on your consent, or on the cases the law allows without consent: where processing is necessary to perform a contract with you or to take steps at your request, to comply with a legal obligation, or to establish or defend legal claims. Where EU or UK GDPR applies, we rely on contract, consent, legal obligation and, for security, preventing misuse, improving the service, measuring visits and counting distinct investors (section 7), our legitimate interests, which we balance against your rights. Where we are the processor, the organisation's own legal basis applies.

You can withdraw consent at any time. Withdrawing does not affect what we did before.

5. Sharing with organisations

Smart-LOI lets many organisations use the same platform. When you share a record with an organisation, the record, with the personal data and preferences in it, becomes visible to that organisation. It then decides how to use it and is responsible for that use. When you complete an organisation's own capture page, the organisation receives the record from the start.

• You share only by an action of your own, and you are told at that moment that the organisation will see the record.
• A record you have not shared is not visible to any organisation.
• If you address a record to an organisation that has not yet joined Smart-LOI, we hold it, unread by anyone, until the organisation joins or 6 months have passed. If 6 months pass first, we anonymise it: your name, e-mail address, phone number and any free text are removed, and the structured answers stay so that counts remain accurate.
• If you choose "contact me only through the app", your phone number is withheld from the organisations you share with, and they can reach you only through the app.
• Where an organisation shows an optional marketing box, your answer is stored with the record, shown to that organisation, and can be withdrawn from your record in the app or on the web. The organisation, not DCI Markets Ltd, is responsible for what it sends you.

Sharing is a disclosure of your own intent. It is not an offer, order or instruction. Smart-LOI does not execute transactions, hold funds, match or advise.

6. Who else receives data

We use service providers, under contract, in these categories:

• cloud hosting for the website and application (Vercel) and for the server behind the investor app (Render);
• database hosting (Neon, on Amazon Web Services);
• e-mail delivery (sign-in links, receipts, notifications) and our own mailbox for support and enquiries;
• payment processing for organisations' plans and certificates;
• mobile push-notification services (Apple and Google);
• an AI model provider (Anthropic), for AI-generated demand reports and answers about aggregate demand for organisations that use those features, and for the optional "Suggest answers" box on capture pages;
• a public blockchain, for fingerprints only (below).

If you ask us under section 10, we will tell you which providers have received your data.

AI features. For demand reports and answers, we send aggregate tables, not names, e-mail addresses or phone numbers. If an organisation switches on the "Suggest answers" box and you use it, we send the AI model provider only the free text you type there and the form's answer options. Before the text leaves us, e-mail addresses, phone numbers, web addresses, long numbers and name-like words are replaced where detected. We send no name, e-mail address or phone number from your record. We do not keep the text, only a count of the units processed and the cost of each use. Under its published terms, the provider deletes what it receives within 30 days, unless it must keep it longer by law or to investigate misuse, and does not use it to train its models. Please do not type personal details in that box.

Public blockchain. So that anyone can check that a record has not been altered, we write a cryptographic fingerprint (a hash) of batches of records to a public blockchain. We never write personal data or record content to a blockchain. A fingerprint cannot be turned back into the record, and it cannot be removed from the blockchain. If a record is deleted, nothing readable remains.

We do not sell personal data and we do not use it for advertising. We may disclose data to authorities, courts and advisers where the law requires it or to protect legal rights, and to a successor if DCI Markets Ltd is reorganised or sold, on the same terms as this policy.

7. Anonymised and aggregated data

We may produce anonymised, aggregated statistics from records across the platform, for example the volume of investment intent by asset category, country or indicative-yield band. We use them for our own product analytics, for benchmarks we may share back with organisations in aggregate form, and to describe overall platform activity. We do not identify individuals in them and we do not sell raw records. We have not built any product beyond descriptive statistics. If we ever plan one, we will first seek a fresh and specific basis.

When an organisation asks for a Demand Statement, we may check across organisations whether the same investor appears more than once, so that the Statement can report distinct investors and not just rows. The result is a count only. It never tells anyone which other organisations an investor dealt with. For this check we act as controller. Our legal basis is your agreement to the investor terms (UAE) and our legitimate interests (GDPR).

8. International transfers

We are based in the UAE. Our database is hosted by Neon on Amazon Web Services in the European Union (Frankfurt, Germany). The server behind the investor app runs on Render in the United States (Ohio). The website and web application are served by Vercel, and our other providers, such as e-mail delivery, payments, push notifications and the AI model provider, operate in other countries, including the United States. When personal data leaves the UAE, we use the safeguards the UAE data protection law requires, such as contracts with the provider or your consent. For data covered by EU or UK GDPR we use the EU Standard Contractual Clauses and the UK Addendum (or the UK International Data Transfer Agreement) where a transfer needs them. Where we are the processor, the mechanism is the one named in our data processing agreement with the organisation. You can ask us for a copy of the safeguards.

9. How long we keep data

• Unsubmitted drafts: deleted 60 days after your last activity, or at once if you discard or submit them.
• People an organisation invites: contact data is kept for up to 90 days.
• Records addressed to an organisation that has not joined: until it joins, or for 6 months at most.
• Records and accounts: while your account is active and the record exists. When you delete your account or ask us to delete data, we delete or anonymise it, except what the law requires us to keep. Records shared with an organisation are also kept by that organisation under its own policy.
• Consent records (time and wording version): while the record exists, and afterwards only as long as needed to show what you agreed to.
• Website enquiries: 12 months after the last contact, unless you become a customer.
• Billing records: as long as UAE tax and accounting law requires.
• Security logs: a limited period, as needed for security and troubleshooting.
• AI-assisted capture: we keep no text, only counts of units processed and cost.
• Blockchain fingerprints: they cannot be removed, and they contain no personal data.
• Anonymised statistics: they are not personal data and may be kept.

10. Your rights

You may ask us to: tell you what data we hold and how we use it; give you a copy, in a commonly used format; correct it; delete it; restrict its use; stop using it for direct marketing or on other grounds you object to; and withdraw your consent. We do not score or rank individual investors, and we make no decision about you based solely on automated processing.

To use a right, write to support@smart-loi.com with "Privacy" in the subject line. We may ask you to confirm your identity. We aim to answer within 30 days and do not charge unless a request is clearly excessive. Where an organisation is the controller of the data, we will pass your request to it or help it respond.

Deleting your account. You can delete your account in the app, or by writing to us at the same address. When you do, your account and the data we hold for you in the app are deleted, and each record you shared is shown as withdrawn to the organisation that received it. That organisation keeps its own copy under its own privacy practices; to have it deleted, ask the organisation, or ask us and we will pass the request on.

If you are unhappy with our answer, you may complain to the competent data protection authority in the UAE. If EU or UK GDPR applies to you, you may complain to your local supervisory authority, or in the UK to the Information Commissioner's Office.

11. Cookies and similar technologies

Cookies. Our websites set only strictly necessary cookies. They are protected (HttpOnly, SameSite and Secure settings) and are used to keep you signed in to a workspace, to keep our own administrators signed in, and to keep an organisation's claim of its directory listing in progress. We use no marketing or advertising cookies or code, and no third-party scripts that follow you across websites. Fonts are served from our own site. If we ever add cookies that are not strictly necessary, we will ask for your consent first and update this policy.

The app. The mobile app sets no cookies. Your session, profile and push-notification token are kept in your device's secure storage.

Visit measurement. On this website and on our corporate site we measure page views in aggregate with Vercel Web Analytics. It sets no cookies and does not track you across websites. It tells visits apart for up to 24 hours using a short-lived hash built from the request, which is then discarded, and records the page, referrer, approximate location, device type, operating system and browser. We see only aggregate figures. If you prefer your visits not to be counted, your browser's tracking protection or a content blocker will stop the measurement script, and the website will work as normal.

12. Children

Smart-LOI is for adults and organisations. It is not directed at anyone under 18, and we do not knowingly collect their data. If you think a child has given us data, write to us and we will delete it.

13. Security

We use encrypted connections, keep each organisation's data separate from the others, limit access to people who need it and who are bound by confidentiality, and test these measures. No system is perfectly protected, and we cannot promise that data will never be accessed without authorisation. We tell you and the authorities about a data breach where the law requires it.

14. EU and UK

If EU or UK GDPR applies to our processing, the roles in section 2 apply as the GDPR defines controller and processor, your rights in section 10 are read consistently with it, and transfers to us are covered as set out in section 8. Where the law requires us to have a representative in the EU or the UK for this service, we appoint one and publish its contact details on this page.

15. Changes to this policy

We may update this policy. We will say so on this page and change the date above, and for a material change we will also tell you through the service or by e-mail.

16. Contact

Questions about this policy or your data: support@smart-loi.com, with "Privacy" in the subject line.