Privacy policy

1. Who we are

Rubikal ("Rubikal", "we", "us") is a software development and team augmentation studio with studios in Dubai, United Arab Emirates, Alexandria, Egypt, and Belgrade, Serbia. Rubikal is the controller of the personal data described in this policy, which means we decide why and how it is processed.

• Dubai: Palm Strip Mall, 40 Jumeirah Street, Dubai, United Arab Emirates
• Alexandria: 696 El Horreya Rd, Loran, Alexandria, Egypt
• Belgrade: Takovska 21/1/3, Belgrade, Serbia

You can reach us about anything in this policy at sales@rubikal.com.

2. What this policy covers

This policy applies to rubikal.com, in English and Arabic, and to the ways you contact us through it: the enquiry forms, the project planner, call bookings, WhatsApp and email. It does not cover the products we build for clients, which are governed by the agreements we sign with them, or the third-party sites we link to.

We wrote it to meet the standards of the EU and UK General Data Protection Regulation (GDPR), the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021), the Egyptian Personal Data Protection Law (Law No. 151 of 2020) and the Saudi Personal Data Protection Law (PDPL). Where a local law gives you more protection than this policy describes, the law applies.

3. The data we collect

We collect only what you give us, plus a small amount of technical data needed to run the site.

Enquiry forms

When you use the contact form on this site, including the one on our Saudi Arabia page, we receive the name, email address, company and message you enter, and the service you say you are interested in. The form is relayed to our inbox by Web3Forms, a form-delivery service, and includes a hidden anti-spam field that stays empty for real visitors.

Project planner

The planner on our homepage asks three questions about your product and shows a suggested plan. Your answers are processed in your browser and are not sent to us unless you choose one of the follow-up routes. If you ask us to email you the plan, we receive your name and email address together with your three answers and the plan's name. If you open WhatsApp or book a call from the planner, the plan name travels with that message or booking link.

Booking a call

Call bookings are handled by Cal.com. When you pick a slot you give Cal.com your name, email address and any notes, under Cal.com's own privacy policy, and Cal.com passes the booking details to us. The booking link also carries a tag telling us which part of the site you booked from.

WhatsApp

The WhatsApp buttons open a chat with our Dubai number, sometimes with a prefilled message. Anything you send there is processed by WhatsApp (Meta) under its own terms and reaches our team the same way any WhatsApp message would.

Job applications

If you apply for a role by emailing careers@rubikal.com, we receive whatever you include: typically your name, contact details, CV, portfolio links and the role you are applying for.

Analytics and advertising measurement

Google Tag Manager loads on every page. Before you choose, and if you decline, Google's Analytics and Ads tags run in a restricted, cookie-free mode: they send anonymous measurement signals that contain the page address (including campaign tags such as utm_source), the time, basic browser and device details and your IP address, which Google processes, and they set no cookies or advertising identifiers. If you accept, the tools below load and may set cookies or similar identifiers:

• Google Analytics 4: pages viewed, buttons clicked, forms submitted and where visitors come from. Before you accept it sends only the restricted signals described above.
• Google Ads conversion measurement: after you accept, when you send us an enquiry through a form or open WhatsApp from a button on the site, we tell Google Ads that this action happened, together with a random, single-use reference for that action (it contains no name, email address, phone number or message). Google uses it, with its own advertising identifiers such as the click identifier from an ad you clicked, to report which ad campaigns led to that action. A WhatsApp click shows interest; it is not a confirmed conversation.
• LinkedIn Insight Tag: measures visits from LinkedIn campaigns and the same two actions (an enquiry form sent, a WhatsApp click). Loads only after you accept.
• Hotjar: shows us how pages are used and may show a short feedback poll. Session recordings and heatmaps are switched off. Loads only after you accept.
• HubSpot: website analytics, the chat widget and, because HubSpot's form-capture feature is switched on, the details you type into forms on this site (such as your name and email address), which HubSpot's script can read and send to HubSpot. Loads only after you accept.
• Apollo.io: identifies the company behind a visit, using the network (IP) address, and records which pages were viewed, so our sales team can follow up with businesses that showed interest.

Our own measurement code never sends your name, email address, phone number or message to Google Analytics, Google Ads or LinkedIn. HubSpot is different, as described above. If you decline, these tools set no cookies and send no advertising events. Google may still receive basic, cookieless visit signals, such as the page opened and the campaign that led to it. You can change your mind at any time (see section 5). Google describes how it handles data in its policy at business.safety.google/privacy.

Technical data

Our hosting provider, Cloudflare, processes the IP address, browser type, requested page and time of each request in order to deliver the site and protect it against abuse. On the root address only, the country code Cloudflare derives from your connection decides whether you land on the English or the Arabic homepage. We do not store this country code.

4. How we use your data, and on what basis

• Answering your enquiry and preparing a proposal. Steps you ask us to take before entering a contract, and our legitimate interest in responding to business enquiries.
• Sending the planner output you request. Your explicit request, which is a step before any contract.
• Scheduling and holding calls. Pre-contract steps, and our legitimate interest in talking to prospective clients.
• Considering your job application. Steps before an employment contract, our legitimate interest in recruiting, and your consent where local law requires it.
• Measuring and improving the site, and measuring our advertising. Your consent, given through the cookie banner and withdrawable at any time.
• Basic, cookie-free measurement before you choose. Our legitimate interest in understanding how our campaigns bring visitors to the site, limited to anonymous signals with no cookies or advertising identifiers.
• Keeping the site secure and available. Our legitimate interest in protecting our services.
• Meeting legal obligations, such as accounting and tax records for client contracts. A legal obligation.

We do not sell personal data, and we do not use it for automated decisions that have legal or similarly significant effects on you.

5. Cookies and similar technologies

The site uses very little storage on your device. Entries marked "after consent" are set only if you accept; before you choose, and if you decline, none of them is set, and Google's restricted signals use no cookies at all. This is all of it:

The consent and language entries hold only your own choices, so they run without a banner. You can accept or withdraw at any time with the Cookie settings button, here or in the footer of every page. Withdrawing takes effect straight away, including in other tabs you have open, and your choice applies to both the English and the Arabic versions of the site.

This record is stored only in your browser and is a record of your choices for the site's own use. It is not independently verified, and clearing your browser data removes it.

If you chose before this update. If you accepted before 18 October 2026, that choice covered analytics only and stays in place until you choose again. It does not cover advertising measurement, so we send no conversion events and set no advertising cookies or identifiers for you, and HubSpot, Apollo and LinkedIn stay off, until you accept the updated notice. Google Analytics and Hotjar may keep running for you, and Google's tools may send basic signals that contain no cookies or advertising identifiers. If you declined, your refusal stays in place. We may ask you again because the notice has changed; the new wording is not treated as agreement.

Cookie settings

6. Who we share data with

We share personal data only with the service providers that help us run the site and respond to you:

• Web3Forms: relays form submissions to our inbox.
• Cal.com: call scheduling.
• Google: Tag Manager, Analytics 4 and Google Ads measurement, after consent.
• LinkedIn: campaign measurement, after consent.
• HubSpot: analytics, chat and form details you enter on the site, after consent.
• Apollo.io: company identification of website visits for sales follow-up, after consent.
• Hotjar: usage analytics and feedback polls, after consent.
• Cloudflare: hosting, content delivery and security.
• Meta (WhatsApp): messaging, when you choose it.
• Our email and workplace tools, where your enquiries land.

Each provider processes data for the purpose described here under its own security and contractual commitments. We may also disclose data when the law requires it, to protect our rights, or as part of a merger or acquisition, with notice to you where the law requires.

7. International transfers

Our team works from the United Arab Emirates, Egypt and Serbia, so your data may be stored or accessed there. The providers listed above may process data in the European Union, the United States or other countries. Where data leaves a jurisdiction that restricts transfers, we rely on the safeguards that law provides, such as standard contractual clauses or the provider's certifications.

8. How long we keep data

• Enquiries and planner requests: up to 24 months after our last exchange, unless we go on to work together, in which case they become part of the client record and are kept for the life of the engagement plus any statutory retention period.
• Job applications: up to 12 months after the role closes, so we can contact you about similar roles, unless you ask us to delete them sooner.
• Analytics data: up to 14 months in Google Analytics, then only in aggregate.
• Advertising measurement and cookie-free signals: events and signals are held by Google and LinkedIn under their own retention policies. We keep no copy of the random action reference beyond the browser session.
• Cookie choice record: kept in your browser until you clear it; we do not keep a copy on our servers and cannot see it.
• Server logs: kept by Cloudflare for a short period under its own retention policy.

9. Security

The site is served over encrypted HTTPS connections and hosted on Cloudflare's network. Access to the inboxes and tools where your data lands is limited to the team members who need it. No transmission over the internet is completely secure. If we learn of a breach that affects your data, we will notify you and the relevant authority as the law requires.

10. Your rights

Depending on where you live, you may have the right to:

• access the personal data we hold about you and receive a copy;
• correct data that is inaccurate or incomplete;
• have your data deleted, unless we have a legal reason to keep it;
• restrict or object to processing, including processing based on legitimate interest;
• receive the data you gave us in a structured, commonly used format;
• withdraw consent at any time: for analytics and advertising measurement through Cookie settings, and for anything else by email.

To exercise any of these rights, email sales@rubikal.com. We respond within 30 days and may ask you to confirm your identity before acting. You also have the right to complain to the data protection authority where you live, such as the UAE Data Office, Egypt's Personal Data Protection Centre, the Saudi Data and AI Authority (SDAIA), or your supervisory authority in the EU or UK.

11. Children

This site is aimed at businesses. It is not directed at anyone under 18 and we do not knowingly collect data about children. If you believe a child has given us personal data, contact us and we will delete it.

12. Third-party links

The site links to LinkedIn, X, Facebook, Instagram, YouTube, Clutch and Google Maps. Each has its own privacy policy, and we are not responsible for their practices.

13. Changes to this policy

We will update this page whenever our practices or the law change, and update the date at the top. If a change is material, we will highlight it here for a reasonable period.

14. Contact