Privacy Notice

How Threshold handles your data.

Last updated 24 June 2026

Who we are

Threshold is a boutique AI governance firm registered in the Dubai International Financial Centre. The data controller is Mustafa Ali, the founder. For all data-related queries, contact hello@thresholdfirm.com.

What we collect

Threshold collects personal data in two situations: when you complete the contact form, and when you complete the AI Readiness Diagnostic. In both cases, the data is provided directly by you.

Contact form. Your name, role, institution, institutional email address, and the message you write describing what you are trying to address.

Diagnostic responses. Your name, role, institution, institutional email address, and the responses you give across the institutional context questions, the six maturity dimensions, and any optional notes. The PDF report generated at completion is also transmitted to Threshold.

Beyond the information you provide directly, we use a limited set of analytics tools that set cookies and collect usage data about how visitors use this website. These are described in the Analytics and cookies section below. We do not otherwise collect technical information about your device beyond what our hosting provider automatically logs for security purposes.

Analytics and cookies

We use a small number of third-party tools to understand how visitors use this website and to measure the reach of our communications. These tools set cookies and collect limited usage data.

Google Analytics. We use Google Analytics 4 to see how many people visit the site, which pages they view, and how they arrive. It collects information such as pages visited, time on site, approximate geographic location, and device and browser type. Google does not store visitors' IP addresses in Google Analytics 4. This data is processed by Google on our behalf and is used only to improve the site. We do not use it to identify individual visitors.

LinkedIn Insight Tag. We use the LinkedIn Insight Tag to measure visits arising from our LinkedIn activity and to show relevant information on LinkedIn to people who have visited this site. It sets a LinkedIn cookie and shares limited visit data with LinkedIn, which processes that data in line with its own privacy policy.

Your choices. You can refuse or delete cookies through your browser settings. You can opt out of Google Analytics using Google's browser add-on, and you can manage advertising preferences in your LinkedIn account settings. Refusing these cookies does not affect your ability to use the site or to contact us.

Diagnostic responses, in particular

The diagnostic is designed as a pre-session preparation tool. Your responses help Threshold understand your institution's current position before any conversation, so that any session we run together is grounded in your reality rather than generic content.

Your diagnostic responses, the answers you give across the context questions, the six dimensions, and any notes, are not shared with anyone outside Threshold. They are not aggregated, benchmarked, sold, or used for marketing. Like the rest of our website, the diagnostic page itself uses the analytics tools described in the Analytics and cookies section above, which record that a visit took place but do not capture the content of your responses. If you choose not to proceed with a session, your responses are deleted from our systems within 90 days of completion. You can request deletion at any time before that.

Why we collect it

We collect this data so that we can respond to your enquiry, prepare a meaningful working session if you choose to book one, and remain in correspondence with you about AI governance matters relevant to your institution. The legal basis under UAE Federal Decree-Law 45 of 2021 (PDPL), and equivalent provisions in other GCC jurisdictions, is your explicit consent at the point of submission combined with our legitimate interest in serving institutional clients.

Where it is stored

Form submissions are stored by Netlify Forms, the managed form-submission service Threshold uses to receive enquiries. Diagnostic PDFs are also stored by Netlify Forms. Email correspondence is held in Threshold's Microsoft 365 mailbox. No data is shared with third parties beyond these processing services. No data is sold, rented, or used for advertising.

How long we keep it

Contact form submissions are retained for up to 24 months from the date of last meaningful correspondence, then permanently deleted. Diagnostic responses are retained for 90 days if no session is booked, or for the duration of the engagement plus 24 months if a session goes ahead. You can request earlier deletion at any time.

Your rights

Under the UAE PDPL and equivalent GCC laws, you have the right to: access the data we hold about you, request correction of inaccurate data, request deletion of your data, object to specific uses, and withdraw consent at any time. To exercise any of these rights, write to hello@thresholdfirm.com and we will respond within thirty days.

Cross-border transfers

Threshold operates from the DIFC, Dubai. Netlify operates servers in multiple international jurisdictions. Microsoft 365 mail data is held according to its standard regional data residency. For healthcare institutions whose data is subject to UAE federal medical-data rules prohibiting transfer outside the country, please note that the diagnostic is designed for institutional self-assessment and should not be used to transmit patient-identifying medical data. The responses captured are about your institution's governance posture, not patient records.

Changes to this notice

If we make material changes to how we handle your data, we will update this notice and change the "Last updated" date above. For substantive changes affecting existing relationships, we will also notify you by email.

Questions

For any question about this notice, your data, or how Threshold operates, write to hello@thresholdfirm.com.