Privacy notice

1. Who this is about

The Internship ROI Simulator ("the Service") is operated by Opportunities Nearby FZE, Sharjah Research Technology and Innovation Park (SRTIP), Sharjah, United Arab Emirates — Licence No. 11131 ("we").

Two different relationships matter here, and they carry different duties:

• For the people who sign up — the administrators who create an account — we decide what is collected and why. We are the controller of that data.
• For the interns and supervisors an organisation adds to a programme, the employer decides what to record and why; we hold and process it on their instructions. The employer is the controller and we act as processor. If you are an intern or supervisor asking why your performance is recorded, your employer is the right first contact — though you can always reach us at the address in section 10.

[To be confirmed with an adviser: whether this controller/processor split holds under the UAE Personal Data Protection Law and any other law that applies to a customer, and whether a separate data-processing agreement should be signed with each customer]

2. What the Service stores

Everything the Service holds falls into five groups.

• Account data. Your email address, a password (stored only as a hash, never in readable form), your display name and an optional profile picture.
• Programme roster. For each intern and supervisor an administrator adds: full name, email address and department. For interns, an administrator may also record whether the person is a UAE national — optional, used only to report the Emiratisation quota saving the employer is claiming, and never inferred by us from a name or an email address. Invitation emails are stored until the invitation is used or withdrawn.
• Work and evidence. The notes interns write when submitting work, any files they attach, and any links they provide.
• Assessment. Supervisors' written feedback, per-criterion ratings, and the KPI measurements calculated from accepted work. This is the most sensitive category the Service holds: it is a named person's performance record.
• Organisation and planning data. Company name and optional logo, programme details, and the cost and value assumptions entered into the ROI wizard. These are business figures, not personal data, but they are stored alongside it.

The Service contains no analytics, advertising or tracking of any kind. There is no third-party script on any page, no cookie used for profiling, and no behavioural data is collected or sold. The only cookies set are the ones that keep you signed in.

3. Where it is stored, and who else touches it

The database and uploaded files are hosted on Supabase in the eu-central-2 region (Zurich, Switzerland). The application itself is served by Netlify from its global edge network. This means personal data about people in the United Arab Emirates is stored outside the UAE.

Switzerland was chosen for this reason. It holds an adequacy decision from the European Commission and appears on the lists of adequate jurisdictions published by the ADGM and the DIFC, and its own Federal Act on Data Protection applies to the data while it is there.

[Still to be confirmed with an adviser: the UAE Data Office has not yet published an adequacy list of its own, so the precise basis for the transfer under the UAE PDPL — and whether customer consent or standard contractual clauses are also required — remains open. This notice will be updated when it is settled.]

Our processors are:

• Supabase — database, authentication and file storage (Zurich, Switzerland).
• Netlify — application hosting and content delivery.
• Resend — delivery of sign-in, invitation and notification emails.

We do not sell personal data, and we do not share it for anyone else's marketing.

4. Who can see what

Access is enforced in the database itself, not only in the interface, so a person cannot reach data by guessing a web address:

• Interns see their own tasks, their own submissions and their own KPI scores. They cannot see other interns, and they cannot see any cost or return figure.
• Supervisors see the interns assigned to them and the work those interns submit. They cannot see the programme's economics.
• Administrators see their own organisation's programmes, people and figures — and nothing belonging to any other organisation.

Uploaded files are held in private storage with no public address. When a file is opened, the Service issues a link that expires after five minutes.

5. Report share links

An administrator can create a link that shows a generated report to someone without an account. Anyone holding that link can read the report until it expires or is withdrawn, so it should be treated as confidential.

A shared report contains programme-level figures — cost, return, delivery counts and KPI results. It does not name individual interns and does not include their submissions, feedback or individual ratings. The Service records when a link is opened and how many times, and keeps that record after the link is withdrawn.

6. How long it is kept — and what cannot be deleted

Some records in the Service are deliberately permanent. Submissions, reviews, ratings, KPI measurements, saved ROI snapshots and the audit log are append-only: the software refuses to delete or rewrite them, so that a performance record cannot be quietly altered after the fact and a report can always be reproduced from what was true when it was generated.

That protection has a cost, and we would rather state it than hide it: a request to erase an individual's assessment history cannot be satisfied by deleting those rows. Where erasure is required by law, it would have to be met by removing the identifying fields that link a record to a person, or by deleting the organisation's account in full.

[To be decided: retention periods for each category, the exact erasure procedure and who executes it, and how it is offered to customers contractually]

7. Your rights

Subject to the law that applies to you, you may ask for a copy of your data, ask for inaccurate data to be corrected, object to or restrict how it is used, or ask for it to be deleted — bearing section 6 in mind. If an employer entered your data, please ask them first; we will help them respond.

You can correct your own name and profile picture at any time on the My account screen.

8. Young people

Interns are often students and may be under 18. The Service has no age gate and never asks a person's date of birth, because an employer — not the software — decides who joins a programme. Where an intern is a minor, the employer is responsible for having a lawful basis to record their performance, including any consent a guardian must give.

[To be confirmed: whether any additional protection or consent is required for participants under 18 in the jurisdictions served]

9. Security

Access rules are enforced by the database on every read and write. Files are private by default and reachable only through short-lived links. Passwords are stored as hashes. Administrative actions are written to an append-only audit log.

No system is perfectly secure. If a breach affects your data we will act on the notification duties that apply to us. [breach-notification timeline and regulator to be confirmed]

10. Contact and changes

Questions about this notice or a request about your data: support@internroi.com, Block B, B55-200, Sharjah Research Technology and Innovation Park (SRTIP), Sharjah, United Arab Emirates. [Whether a Data Protection Officer must be appointed is to be confirmed].

If we change this notice we will update the date at the top and, where the change is significant, tell account holders directly.