Skip to content
legible
See what machines see

Legal

Privacy Policy

Last updated: 9 November 2026
Data controller: Sensate Origin Design Services-FZCO, DSO-IFZA, IFZA Properties, Dubai Silicon Oasis, Dubai, UAE

Read this clause first — it is the one that makes Legible unusual. Legible works by crawling websites. Most of the time that is your own site. But you can point it at any URL, and the pages it reads may belong to somebody else and may contain personal data (staff names, doctor profiles, contact details). Section 4 sets out what we do about that and what you are responsible for. Do not skip it.

1. What this covers

This policy explains what Sensate Origin Design Services-FZCO ("Sensate", "we") does with personal data when you use Legible, a product of Sensate Origin Design Services-FZCO, on the Legible home page.

We are the data controller for your account data. For the website content Legible crawls on your instruction, you are the controller and we act as your processor — see section 4.

2. Data we collect about you

Account data. Your name, email address and company name are held in your Legible account. Account sign-in is provided by Supabase, which receives your email address and session. We never store your password ourselves; we receive confirmation that Supabase verified you.

Billing data. Payments are processed by Stripe. Stripe holds your card details. We never see or store your full card number. We receive your subscription status, plan, and the last four digits and brand of the card for your invoices.

Usage data. Which audits you ran, when, and against which sites. We use this to enforce plan limits and to work out what to fix in the product.

Support data. Anything you send us in a support conversation.

Technical logs. IP address, browser type and timestamps, kept for security and debugging.

3. Why we are allowed to hold it

  • To perform our contract with you — running the product you subscribed to, billing you, and supporting you.
  • Our legitimate interests — keeping the service secure, preventing abuse, and improving the product.
  • Your consent — for marketing email, which you can withdraw at any time.
  • Legal obligation — tax and accounting records, which UAE law requires us to keep.

4. Websites that Legible crawls

This is the part that needs care.

What we do. When you run an audit, Legible requests pages from the URL you give us, in the same way a search engine or any visitor's browser does. It reads only pages that are publicly reachable. It does not log in, does not bypass paywalls or access controls, does not submit forms, and does not attempt to reach anything a normal visitor could not.

What we store. The page content, metadata, structure and images needed to produce your report, plus the findings we derive from them. If those pages contain personal data — a team page with names and emails, a clinician profile — that personal data is stored with the rest of the crawl.

Your responsibility. By running an audit you confirm you own the site or are authorised to analyse it. You are the controller of any personal data on it. Do not point Legible at sites you have no right to analyse.

Rate and respect. Legible limits its own crawl rate and honours a reasonable page cap per audit so it does not burden the sites it reads.

Removal. If you are a third party and believe Legible holds data crawled from your site without a proper basis, email hello@sensate.design. We will locate it and delete it.

5. Who we share data with

We do not sell your data. We share it only with the providers that run the service. Hosted in the EU (Stockholm, Sweden) on AWS.

  • Supabase
    What it receives
    account sign-in: email address, session
    When
    sign-up / sign-in
  • Stripe
    What it receives
    payment and billing details
    When
    checkout, billing portal
  • Resend
    What it receives
    email address and email content
    When
    every email Legible sends
  • Anthropic
    What it receives
    site text and business facts for reading, the Advisor and Studio drafts
    When
    reading, Advisor, Studio
  • Google
    What it receives
    Search Console connection (OAuth), page addresses for page speed, AI requests
    When
    owner connects Search Console; reading; Studio
  • Firecrawl
    What it receives
    public page addresses and their content
    When
    reading a website
  • OpenAI
    What it receives
    buyer questions with business category and city (AI-answer checks); the owner's voice recordings and uploaded audio (transcription); approved podcast scripts (voice)
    When
    owner buttons; a scheduled 30-day re-check
  • Perplexity
    What it receives
    buyer questions with city (AI-answer checks)
    When
    owner buttons; scheduled re-check
  • xAI
    What it receives
    buyer questions with city (AI-answer checks)
    When
    owner buttons; scheduled re-check
  • SerpApi
    What it receives
    business name, site address, town, people's names with company, category and city searches, map place IDs
    When
    automatically on each reading of an owned site; owner buttons
  • HeyGen
    What it receives
    approved video script, title, brand colour
    When
    owner presses "make video"
  • Higgsfield
    What it receives
    owner-uploaded photos of the presenter (a person's face), brand presenter name, scene prompts; image prompts when other image services fail
    When
    owner makes a UGC video
  • Bing Webmaster
    What it receives
    the customer's site address and changed page addresses
    When
    owner presses Validate after a confirmed live fix
  • LinkedIn
    What it receives
    sign-in exchange; LinkedIn returns the member's name and email and the owner's company pages
    When
    owner "Connect LinkedIn"; community sign-in
  • Meta
    What it receives
    sign-in exchange; Meta returns the owner's page list
    When
    owner "Connect Facebook/Instagram"

These transfers leave the UAE. We rely on the providers' own contractual data protection terms for that.

We will also disclose data where the law requires it, or to protect our rights or someone's safety.

6. How long we keep it

  • Account data: while your account exists, then 30 days.
  • Audit and crawl data: while your subscription is active, then 30 days after it ends, then deleted.
  • Invoices and tax records: as long as UAE tax law requires.
  • Support conversations: 24 months.
  • Technical logs: 90 days.

7. Your rights

You can ask us to give you a copy of your data, correct it, delete it, or stop using it for a particular purpose. You can withdraw marketing consent at any time. Email hello@sensate.design and we will respond within 30 days.

You can export your audit data yourself, at any time, from the dashboard — no request needed.

If you are in the EU or UK, GDPR gives you these rights directly and you may complain to your local supervisory authority. UAE Federal Decree-Law No. 45 of 2021 gives equivalent rights in the UAE.

8. Security

Access to the dashboard requires authentication. Sessions are held in protected cookies that page scripts cannot read. Client accounts are isolated from one another at the data layer, so one customer's account cannot load another's audits. Traffic is encrypted in transit.

No system is perfectly secure. If a breach affects your personal data, we will tell you and the relevant regulator as the law requires.

9. Cookies

We set three essential cookies, all of them strictly functional. We do not use advertising or cross-site tracking cookies, and we do not run analytics.

  • Sign-in
    Purpose
    Keeps you signed in. Removing it signs you out.
    Lifetime
    12 hours
  • Report handoff
    Purpose
    Holds the link to an analysis you ran before creating an account, so the report reaches you even if the sign-up email opens a new tab.
    Lifetime
    24 hours
  • Search Console connection
    Purpose
    A one-time value that proves a Google Search Console connection was started by you.
    Lifetime
    15 minutes

10. Children

Legible is a business product and is not intended for anyone under 18. We do not knowingly collect children's data.

11. Changes

If we change this policy materially we will email account holders before the change takes effect.

12. Contact

Email hello@sensate.design. The data controller is named at the start of this policy.