Privacy Policy

1. Who we are

This policy explains what eHive (“we”, “us”) collects, why, and your rights over it. eHive operates ehiveglobal.com and the eHive member portal from Dubai, United Arab Emirates, for the eHive Circle founder community. For any privacy question, email info@ehiveglobal.com — that inbox acts as our data-protection contact.

2. What we collect

We collect only what the Services genuinely need:

• Account details — name, email address, phone number, and a password stored only as a salted hash. You may also enable two-factor authentication.
• Application answers — what you tell us in membership and programme applications (about you and your business), used to review and process your application.
• Verification (KYC) details — where the membership requires it, a national ID or passport number. These numbers are encrypted at rest (AES-256-GCM) and are only decrypted when an authorised team member needs to verify them.
• Membership activity — the things the portal tracks so the community works: event RSVPs and attendance, pod sessions, one-to-ones, directory visibility preferences, and engagement signals such as Hive Score events.
• Payment records — invoices, amounts, currency and payment status, recorded by our team when you pay by bank transfer, or automatically once card payments are enabled. Your card details themselves never reach us (see section 4).
• Enquiries and forms — leads you send through contact, partner, franchise, or scorecard forms. Open-text answers you give in our assessment tools (such as the Brand Check or Clarity Scorecard) may also be processed by an AI provider to generate your report — see section 5.

3. What we use it for

• Reviewing applications and admitting members
• Operating your membership: renewals, events, pods, directory, notifications, and member support
• Keeping the community safe and the Code of Conduct enforced
• Complying with legal, tax, and accounting obligations in the UAE
• Replying to your enquiries and sending what you asked for

We do not sell your data, buy lists, or run advertising trackers. We do not email you about things you didn’t ask for.

4. Payments and card data

At launch we collect membership fees by bank transfer, recorded manually against your membership. When card payments are enabled, they are processed by our payment provider (Stripe) through its hosted checkout. Your full card number is processed by the provider on its own pages — eHive never sees it, never stores it, and has no card data on its servers. We keep only the payment record: reference, amount, currency, status, and provider reference.

5. Who processes data for us

We use a small set of service providers, each under appropriate safeguards, and only for the service they provide to us:

• Hosting — the application and its MySQL database run on Railway (with managed database backups).
• Email — transactional and notification mail is delivered through Zoho (ZeptoMail) over HTTPS, or SMTP from the same provider family.
• Payments — Stripe, when card payments are enabled (see section 4).
• AI narrative generation — when you request a report from our assessment tools, your assessment answers (dimension scores and the open-text context you typed) are sent to Moonshot AI (Kimi API) over HTTPS solely to generate the written analysis in your report. Your contact details (name, email, phone, company) are not sent, the content is processed only to produce your report, and Moonshot’s API terms prohibit using customer content to train their models. If this provider is not configured, your report is generated from our own templates instead.
• Web-push notifications — if you opt in, your browser’s push subscription (an endpoint URL and keys) is stored so we can send you portal notifications; you can revoke it at any time from your browser or device settings.
• Backups — database dumps and snapshots are stored with our hosting provider and, where configured, encrypted off-platform object storage, so we can recover from incidents.

6. Retention

We keep personal data no longer than needed for the purposes above:

• Leads and enquiries are kept while they are active; a retention schedule in our systems anonymises lead personal data (name, email, payload) once it passes the configured retention age.
• Membership records are kept for the life of the membership and a period afterwards to handle renewals, disputes, and legal claims.
• Financial records (invoices, payments) are kept as required by UAE accounting and tax law, even where other personal data has been deleted or anonymised.

7. Cookies and similar technologies

We use the minimum needed to run the site and portal — no advertising cookies, no third-party trackers, no analytics cookies:

• Session cookie — when you log in, the portal sets a signed session cookie (__Host-eh_sid) so it knows who you are between pages. It is HttpOnly, Secure, and SameSite=Strict, and it expires when you log out or after a short inactivity period.
• Browser storage — some pages use sessionStorage or localStorage for lightweight on-device state, such as remembering you dismissed a notice or the cookie-banner acknowledgement flag. These never contain personal data.
• Cookie notice — a small banner asks visitors to acknowledge this policy on first visit. Accepting stores the acknowledgement in your browser so it is not shown again.

8. Your rights under UAE law

Under the UAE Federal Decree-Law No. 45 of 2021 on Personal Data Protection (“PDPL”), you have the right to access, correct, delete, and object to the processing of your personal data, and to request a copy of it in a portable form. You can exercise these rights in two ways:

• In the portal — the Membership page has “Request data export” and “Request deletion” actions that send the request straight to our fulfilment queue. Export produces a copy of your data; deletion anonymises your record and removes your personal content, keeping only the financial records the law requires.
• By email — write to info@ehiveglobal.com from the email address on your account and tell us what you need. We respond within one working day and fulfil verified requests without undue delay.

Where deletion is restricted (for example, financial records we must keep), we will tell you what is kept and why. You may complain to the UAE Data Office if you believe your data has been misused.

9. International transfers

Our hosting and service providers may process data outside the UAE. Where that happens, we rely on appropriate safeguards — contractual protections, encryption in transit, and the providers’ own compliance programmes — and we transfer only what the service requires.

10. Security

Access to the portal requires a password (stored as a salted, computationally-hard hash) with optional two-factor authentication. Sessions are signed, short-lived, and scoped to your device. ID numbers and similar sensitive fields are encrypted at rest. Traffic is encrypted in transit (HTTPS with HSTS), administrative actions are audit-logged, and access to member data inside the team is limited to those who need it to operate the Services.

11. Changes to this policy

When this policy changes meaningfully, we update the “Effective” date above and, for material changes, tell members by email or in the portal before the change takes effect. The version you accepted when you joined is recorded with your account as evidence of consent.

12. Contact

Privacy questions, rights requests, and anything else: info@ehiveglobal.com or through Contact us. A human replies within one working day.