Privacy Policy — Witch One

Effective date: 7 August 2026

1. Who we are

Witch One is operated by Fertile Seed IT Solutions Est., a sole establishment licensed by the Dubai Department of Economy and Tourism under commercial licence no. 1112101, Dubai, United Arab Emirates. We are the controller of the personal data described below. For anything in this policy, write to privacy@witchone.ae.

We process personal data under UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the "PDPL"). Where the law of another country applies to a particular visitor, the equivalent protections apply to that visitor in addition. Witch One is directed at shoppers in the United Arab Emirates and prices are shown in UAE dirhams.

2. What Witch One does

You paste a product link. We retrieve the public product listing and look for the same or a similar product at Noon, Amazon.ae, Namshi, 6thStreet and Trendyol, then show you a comparison. We are not a shop. We do not sell products, take payment, hold stock, or become a party to any purchase you make. When you click through to a store, that store's own terms and privacy policy apply.

3. What we collect

Product links you submit. The URL you paste and the comparison built from it. A product link is normally just an address and says nothing about you, but store links sometimes carry tracking codes. Before we build our internal record of a product we remove the tracking parameters we recognise — including utm_ codes, gclid, fbclid, and store-specific share and referral codes. We do not remove every possible parameter, so please don't paste links containing personal information.
Saved comparison pages. Each comparison is saved at a permanent address of the form /c/<code>, where the code is randomly generated. These pages are public to anyone holding the link and are not password-protected. They are excluded from search-engine indexing, so they will not appear in search results, but you should still treat a comparison link as shareable rather than private.
Waitlist email. If you join the waitlist we store your email address, when you joined, the page you joined from, and the referring site if there was one.
Security and abuse-prevention data. To stop a small number of visitors consuming the lookup budget for everyone, we count recent requests against your IP address in a short-lived rate-limiting store. The counter expires automatically within roughly an hour and is not linked to your comparisons, your email, or any profile.
Technical and log data. IP address, browser, device, operating system, referring page and timestamps, collected automatically by our hosting provider to keep the site running and diagnose faults.
Usage analytics and cookies. See section 5 and our Cookie Policy.
Anything you send us. If you email us, we receive your message and your address.

You do not need an account. We never ask for your name, phone number, home address, date of birth or payment details, and we do not process payments. We do not knowingly collect sensitive personal data, and the site is not directed at children under 18.

4. Why we use it, and on what basis

To run the comparison you asked for — fetching listings, matching products, caching and reloading result pages. Necessary to provide the service you requested.
To keep the site working and affordable — rate limiting, abuse prevention, debugging. Our legitimate interest in a service that is not degraded by a few heavy users.
To contact the waitlist — launch and product updates you signed up for. Your consent, withdrawable at any time via the unsubscribe link or by emailing us.
To measure and improve the product — aggregate usage analytics. Our legitimate interest, or your consent where the law requires it.
To fund the site with advertising — Google AdSense. Your consent where the law requires it, through the consent message described in section 5.
To meet legal, tax and regulatory obligations.

5. Advertising and cookies

Witch One is free and is supported by advertising served by Google AdSense. Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this website and other websites. Google's use of advertising cookies enables it and its partners to serve ads to you based on your visits to this site and/or other sites on the Internet.

Opt out of personalised advertising at Google My Ad Center or www.aboutads.info/choices.
How Google uses information from sites that use its services: policies.google.com/technologies/partner-sites.
If you visit from the European Economic Area, the UK or Switzerland you will see a Google-certified consent message before personalised ads are served, and you can refuse or withdraw consent there at any time.

Ads never appear on results. Advertising is not served on the comparison or result pages at all, and advertisers cannot pay to change the Witch Score, the ranking or the verdict. See our Advertising & Affiliate Disclosure.

6. Who we share data with

We do not sell personal data. We share it only with the providers that run the product, under contracts limiting what they may do with it:

Vercel — hosting, content delivery, server logs, and Vercel Web Analytics (aggregate usage measurement, no advertising cookies, no cross-site tracking).
Supabase — database for waitlist entries and saved comparisons.
Upstash — short-lived rate-limiting counters used for abuse prevention.
Apify — retrieval of public store product pages. It processes product data, not your identity.
Scrapfly — retrieval of public store product pages for Noon and Trendyol. Like Apify, it processes product data, not your identity.
Algolia — hosts the product search index we query to find matching items on 6thStreet. It receives the search terms taken from the product you paste, not your identity.
Anthropic and OpenAI — AI models that summarise public review text and draft the verdict shown on a comparison. They receive product titles, prices and public review text. They do not receive your email, your IP address or any identifier for you.
TypeSafe AI (Jev) — when the optional review fast path is enabled, classifies themes in public review text. It receives the product title and sampled public reviews, not your email, IP address or an identifier for you. These decisions can replace calls to the text-generating AI models.
Google — AdSense advertising and Google Analytics, as described in section 5 and the Cookie Policy.

We may also disclose information where a UAE court, regulator or law-enforcement authority requires it, or where necessary to establish, exercise or defend legal claims.

7. International transfers

Our providers store and process data outside the UAE. Where that happens we rely on the safeguards permitted under PDPL Articles 22 and 23 — either a destination offering an adequate level of protection, or contractual protections with the provider. The PDPL's Executive Regulations have not yet been issued; we will align our arrangements with them once they are in force.

8. How long we keep data

Waitlist emails — until you unsubscribe or ask us to delete them.
Saved comparison pages — kept so shared links keep working. We may delete pages that have not been opened for 24 months, and you can ask us to delete a specific page at any time.
Rate-limiting counters — expire automatically within roughly an hour.
Hosting and security logs — retained by our hosting provider on its standard schedule, generally no more than 30 days.
Correspondence — up to 24 months after the matter is closed.

9. Your rights

Under the PDPL you may ask what personal data we hold and get a copy, have inaccurate data corrected, have data deleted, restrict or object to processing, receive your data in a portable format, and withdraw consent at any time without affecting processing already carried out. Write to privacy@witchone.ae and we will respond within 30 days. To delete a comparison page, send us the /c/<code> link. There is no charge unless a request is manifestly excessive or repetitive.

You may also complain to the competent UAE data protection authority, and to your local supervisory authority if one has jurisdiction over you.

10. Security

Data is encrypted in transit, database access is restricted to server-side credentials, and we minimise what we store in the first place — there are no accounts, no passwords and no payment data to lose. No online service can promise perfect security. If a breach occurs that poses a risk to your rights we will notify the competent authority and, where required, affected individuals.

11. Data protection officer

Our processing does not meet the thresholds in PDPL Article 10 that require a data protection officer to be appointed. Privacy questions are handled directly at privacy@witchone.ae.

12. Changes to this policy

If we change this policy we will update the effective date above, and for material changes we will post a notice on the site.

13. Contact

Fertile Seed IT Solutions Est. · Licence no. 1112101 · Dubai, United Arab Emirates · privacy@witchone.ae