Aguato

    Privacy Policy

    Aguato & Nepti

    Last updated: April 28, 2026

    1. Introduction

    Welcome to Aguato ("we", "our", or "us"). This Privacy Policy explains how we collect, use, disclose, and safeguard information in connection with the Aguato platform at aguato.com, our APIs and applications, and the Nepti data and artificial intelligence system (collectively, the "Platform").

    Nepti is Aguato's proprietary AI and data product. Information collected through the Platform is used to operate Aguato's services and to train, evaluate, and continuously improve Nepti and other Aguato products. References to "Aguato" in this Policy include Nepti and our affiliates unless the context requires otherwise.

    Please read this Privacy Policy carefully together with our Terms and Conditions. If you do not agree, please do not use the Platform.

    Data Controller: Aqueous Solutions FZCO, Premises No. DSO-THUB-G-D-FLEX-G129B, THUB, Dubai Silicon Oasis, Dubai, United Arab Emirates. Trade licence number: 69385. Aguato and Nepti are products of Aqueous Solutions FZCO.

    Data Protection Officer: dpo@aguato.com

    General privacy enquiries: privacy@aguato.com

    EU/UK Representative (GDPR Art. 27): Reachable at cesar@aguato.com.

    Replacement of Prior Versions. This Privacy Policy supersedes and replaces any previous Privacy Policy, Privacy Notice, Cookie Policy, or similar data-protection statement previously published by Aguato, Nepti, or Aqueous Solutions FZCO. Any prior version is of no further force or effect from the effective date above.

    Retroactive Coverage of Past Data and Uploads. This Privacy Policy applies to all personal information and Submitted Data we hold, including information collected and data uploaded prior to the effective date of this Privacy Policy. By continuing to use the Platform after the effective date, you acknowledge this Privacy Policy in respect of past, present, and future personal information and Submitted Data. Where applicable data-protection law requires fresh consent for a specific processing activity, we will seek that consent separately, and you may withdraw consent at any time without affecting the lawfulness of prior processing.

    2. Information We Collect

    2.1 Information You Provide to Us

    We collect information that you voluntarily provide when you register, create or respond to a project, upload documents, communicate through the Platform, request information, or otherwise contact us. This may include:

    • Identity and contact data (name, email, phone, company, role, country)
    • Profile information (company description, services offered, industry focus, certifications, references, portfolio)
    • Account credentials and authentication data
    • Payment and billing information (processed by third-party payment providers)
    • Project content (technical briefs, water and wastewater data, analyses, lab reports, drawings, schematics, specifications, photographs, videos, proposals, quotations, pricing, milestones, deliverables)
    • Communications, messages, feedback, ratings, and support requests
    • Any other information you choose to upload to the Platform

    2.2 Information Collected Automatically

    When you visit or use the Platform, we automatically collect:

    • Device and connection data (IP address, device identifiers, browser, operating system)
    • Usage data (pages viewed, features used, clicks, sessions, referring URLs, timestamps)
    • Cookies, pixels, local storage, and similar tracking technologies
    • Approximate location derived from IP address
    • Logs and diagnostic data
    • Inputs to and outputs from Nepti, including prompts, queries, and AI-generated results

    2.3 Information from Third Parties

    We may receive information about you from publicly accessible sources, business directories, identity-verification services (for example, LinkedIn, where you may share your member ID, name, email, and profile picture), payment processors, fraud-prevention partners, marketing partners, and other Users.

    3. How We Use Your Information

    We use information we collect to:

    • Operate, maintain, and provide the Platform and our brokerage services
    • Create and administer accounts, authenticate Users, and verify identity
    • Match Clients with Providers, structure briefs, generate comparisons, and facilitate proposals, contracting, payments, and milestone tracking
    • Communicate with you (administrative messages, security alerts, transactional updates)
    • Train, fine-tune, evaluate, validate, and continuously improve Nepti and any other Aguato artificial-intelligence, machine-learning, statistical, or analytical models
    • Generate embeddings, indices, knowledge graphs, benchmarks, aggregated statistics, and derivative datasets, all of which are owned by Aguato
    • Power matching, recommendation, comparison, ranking, search, and automation features
    • Develop new products, features, and Aguato or Nepti offerings
    • Detect, prevent, and address fraud, abuse, and security or technical issues
    • Comply with legal obligations, enforce our Terms, and protect our rights
    • Send marketing and promotional communications (with consent where required)
    • Conduct research, analytics, and reporting

    4. Use of Submitted Data and Nepti Training

    Data uploaded to the Platform powers Aguato's services and Nepti. The provisions below summarise the rights you grant Aguato; they apply in addition to, and are reflected in, our Terms and Conditions. Capitalised terms have the meanings set out there.

    • Licence to Aguato. You grant Aguato a worldwide, royalty-free, sublicensable, transferable, non-exclusive licence to host, copy, modify, structure, anonymise, aggregate, and use Submitted Data for: operating and improving the Platform; training, fine-tuning, evaluating, and improving Nepti and other Aguato AI/ML models in non-public form; powering matching, recommendation, and automation features; security, fraud prevention, and legal compliance.
    • Anonymised, Aggregated & Derivative Data.Aguato may create anonymised, de-identified, aggregated, statistical, or otherwise non-identifiable data — including model weights, embeddings, indices, and benchmarks ("Derivative Data") — from Submitted Data. Derivative Data is the exclusive property of Aguato and may be retained, used, shared, and commercialised perpetually, including with third parties.
    • Identifiable Raw Data. Aguato does not externally publish, distribute, or commercially license identifiable raw Submitted Data outside the Platform, except as authorised by you, to sub-processors under confidentiality, to Users participating in the relevant project, or as required by law.
    • Assignment of Original Works. To the extent Submitted Data contains original works of authorship in which you hold transferable IP rights, you assign those rights to Aguato to the maximum extent permitted by applicable law.
    • Survival.The licence and Aguato's rights in Derivative Data survive termination of your account. Identifiable raw Submitted Data is retained for the periods set out in Section 7 and remains subject to your statutory data-subject rights, including the right of erasure and the right to withdraw consent.

    Lawful bases (where applicable data-protection law applies): performance of the contract between us for Platform operation and project facilitation; your consent for marketing and, where we rely on it, for AI training (which you can withdraw at any time); our legitimate interests in operating, securing, and improving Aguato and Nepti, balanced against your rights and freedoms; and compliance with legal obligations.

    5. Sharing Your Information

    We may share information as follows:

    • With other Users: When you post a project, submit a proposal, or interact on the Platform, certain information is shared with the relevant counterparties.
    • Within the Aguato group: Across Aguato, Nepti, and our affiliates for operating and improving the Platform and our products.
    • With service providers: Hosting, cloud infrastructure, analytics, AI infrastructure, payment processors, communication tools, identity verification, fraud prevention, customer support, and similar vendors acting on our instructions.
    • With professional advisors: Lawyers, auditors, insurers, and accountants under duties of confidentiality.
    • For business transfers: In connection with a merger, acquisition, financing, reorganisation, or sale of assets.
    • With your consent: Where you have authorised us to share information.
    • For legal reasons: To comply with applicable law, lawful requests, court orders, or to protect the rights, property, or safety of Aguato, our Users, or others.
    • Anonymised or aggregated data: May be shared with any party without restriction.

    6. Cookies and Tracking Technologies

    We use cookies, pixels, local storage, and similar technologies — both session and persistent — to operate the Platform, remember your preferences, analyse usage, and improve our services.

    • Strictly necessary: authentication, session management, security, fraud prevention, and load balancing. Required for the Platform to function; cannot be disabled.
    • Functional: language, layout, accessibility, and other preferences that improve your experience.
    • Analytics: usage statistics, performance monitoring, and debugging. Loaded only with your consent where required by applicable law.
    • Marketing: campaign attribution and measurement. Loaded only with your consent.

    You can grant or withdraw consent at any time via our cookie banner, your account preferences, or your browser controls. Refusing non-essential cookies will not prevent you from using the Platform, but some features may not be available. A current list of cookies used by the Platform is available through the cookie banner.

    7. Data Retention

    We retain personal information for as long as your account is active and as long as necessary to provide the Platform, comply with legal, accounting, or reporting requirements, resolve disputes, and enforce our agreements. The table below summarises our standard retention periods. Where multiple periods apply, the longer one prevails.

    Data categoryRetention period
    Account profile and credentialsTerm of account + 7 years (UAE accounting and commercial-record requirements)
    Payment, invoice, and tax records10 years from transaction
    Project briefs, proposals, deliverables, and milestone recordsTerm of project + 5 years
    Marketing data (lists, preferences, campaign engagement)3 years from last interaction (or earlier on opt-out)
    Server logs, security events, and audit trails12 months
    Identifiable raw Submitted Data used for AI/Nepti trainingLifetime of the relevant model + 1 year
    Anonymised / aggregated / Derivative Data, model weights, embeddings, indices, benchmarksIndefinite, where the data has been irreversibly anonymised such that re-identification is not reasonably possible

    Upon account closure, we delete or anonymise identifiable personal information once the applicable retention period has elapsed, save where retention is required to comply with law, defend a legal claim, or maintain the integrity of an active dispute. Anonymised, aggregated, and Derivative Data is not deleted on account closure.

    8. Data Security and Breach Notification

    We implement appropriate technical and organisational measures to protect personal information, including access controls, encryption in transit, network segregation, least-privilege provisioning, audit logging, and monitoring. However, no system is perfectly secure, and we cannot guarantee absolute security. You are responsible for keeping your credentials confidential and for the security of any device you use to access the Platform.

    If we become aware of a personal data breach affecting your information, we will:

    • Notify the UAE Data Office in line with PDPL Article 9(6) without undue delay
    • Notify you without undue delay where the breach is likely to result in a high risk to your rights and freedoms
    • For users in the EU or UK, notify the relevant supervisory authority within 72 hours of becoming aware of the breach (GDPR Articles 33–34)
    • For users in California or other US states with breach-notification laws, provide notice in accordance with applicable state law
    • Document the breach, its effects, and the remedial actions we have taken

    To report a suspected breach or security vulnerability, please contact dpo@aguato.com.

    9. Your Privacy Rights

    Depending on your location, you may have the following rights with respect to your personal data:

    • Access: Request a copy of the personal information we hold about you
    • Correction: Request that we correct inaccurate or incomplete information
    • Deletion: Request deletion of your personal information, subject to applicable legal exceptions
    • Objection: Object to certain processing, including direct marketing
    • Restriction: Request that we restrict processing in certain circumstances
    • Portability: Request transfer of your information to another service
    • Withdraw consent: Where we rely on consent, withdraw it at any time without affecting the lawfulness of prior processing
    • Complain: Lodge a complaint with your local data-protection authority

    To exercise these rights, contact privacy@aguato.com. Note that the rights above apply to identifiable personal data and do not extend to anonymised, aggregated, derivative, or model-trained data, which cannot be reversed and cannot be tied back to you.

    10. International Data Transfers

    Aguato is headquartered in the United Arab Emirates and uses cloud and AI infrastructure located in multiple countries. Your information may be transferred to, stored in, and processed in jurisdictions outside your country of residence, including jurisdictions whose data-protection laws may differ. Where required by law, we put in place appropriate safeguards (such as standard contractual clauses) to protect cross-border transfers. By using the Platform, you consent to such transfers.

    11. Automated Decision-Making & Nepti AI

    The Platform uses Nepti and other automated systems to surface recommendations, ranked proposals, summaries, comparisons, and similar AI Outputs. These outputs are decision support, not binding decisions: a human ultimately determines which proposals are presented, accepted, or contracted. Where automated processing produces legal or similarly significant effects on you, you may request human review by contacting privacy@aguato.com.

    12. Third-Party Websites

    The Platform may link to third-party websites or services. We are not responsible for the privacy practices of those third parties, and we encourage you to review their privacy policies before sharing personal information with them.

    13. Children's Privacy

    The Platform is not directed to, or intended for use by, children. We do not knowingly collect personal information from anyone under 18 years of age. If you believe a child has provided us with personal information, please contact us and we will take steps to delete it.

    14. Updates to This Policy

    We may update this Privacy Policy from time to time. We will post the updated version on this page and update the "Last updated" date. Material changes will be communicated by reasonable means. Your continued use of the Platform after the effective date of any update constitutes acceptance.

    15. Contact Us

    If you have questions, requests, or complaints about this Privacy Policy or our handling of your information, please contact us:

    This Privacy Policy is effective as of the date stated at the top. Your continued use of the Platform after any changes indicates your acceptance of the updated policy.