Privacy Policy
Last updated: 27 July 2026 Data controller: Sensate Origin Design Services-FZCO, DSO-IFZA, IFZA Properties, Dubai Silicon Oasis, Dubai, UAE, Dubai Silicon Oasis (DSO-IFZA), UAE
Read this clause first — it is the one that makes Legible unusual.
Legible works by crawling websites. Most of the time
that is your own site. But you can point it at any URL, and the pages it reads
may belong to somebody else and may contain personal data (staff names, doctor
profiles, contact details). Section 4 sets out what we do about that and what
you are responsible for. Do not skip it.
1. What this covers
This policy explains what Sensate Origin Design Services-FZCO ("Sensate", "we") does with personal data when you use Legible, a product of Sensate Origin Design Services-FZCO, at https://app.legible.sensate.design.
We are the data controller for your account data. For the website content Legible crawls on your instruction, you are the controller and we act as your processor — see section 4.
2. Data we collect about you
Account data. Your name, email address, company name and password are held in Outseta, our authentication and CRM provider. We never store your password ourselves; we receive only a signed token confirming Outseta verified you.
Billing data. Payments are processed by Stripe. Stripe holds your card details. We never see or store your full card number. We receive your subscription status, plan, and the last four digits and brand of the card for your invoices.
Usage data. Which audits you ran, when, and against which sites. We use this to enforce plan limits and to work out what to fix in the product.
Support data. Anything you send us in a support conversation, held in Outseta's help desk.
Technical logs. IP address, browser type and timestamps, kept for security and debugging.
3. Why we are allowed to hold it
- To perform our contract with you — running the product you subscribed to,
billing you, and supporting you.
- Our legitimate interests — keeping the service secure, preventing abuse,
and improving the product.
- Your consent — for marketing email, which you can withdraw at any time.
- Legal obligation — tax and accounting records, which UAE law requires us
to keep.
4. Websites that Legible crawls
This is the part that needs care.
What we do. When you run an audit, Legible requests pages from the URL you give us, in the same way a search engine or any visitor's browser does. It reads only pages that are publicly reachable. It does not log in, does not bypass paywalls or access controls, does not submit forms, and does not attempt to reach anything a normal visitor could not.
What we store. The page content, metadata, structure and images needed to produce your report, plus the findings we derive from them. If those pages contain personal data — a team page with names and emails, a clinician profile — that personal data is stored with the rest of the crawl.
Your responsibility. By running an audit you confirm you own the site or are authorised to analyse it. You are the controller of any personal data on it. Do not point Legible at sites you have no right to analyse.
Rate and respect. Legible limits its own crawl rate and honours a reasonable page cap per audit so it does not burden the sites it reads.
Removal. If you are a third party and believe Legible holds data crawled from your site without a proper basis, email hello@sensate.design. We will locate it and delete it.
5. Who we share data with
We do not sell your data. We share it only with the providers that run the service:
| Provider | What it handles | Where |
|---|---|---|
| Outseta | Accounts, authentication, CRM, help desk | United States |
| Stripe | Card payments and invoicing | United States / global |
| Railway | Application hosting and data storage | United States |
| Resend | Transactional and alert email | European Union (Ireland) |
| Page-speed measurement — we send the address of each page we audit to Google's PageSpeed Insights service, which fetches it and returns timings | United States / global |
Only when you connect them. These receive data solely because you chose to link that account, and only for the site you linked:
| Provider | What it handles | Where |
|---|---|---|
| Google Search Console | Your own search performance — queries, clicks, positions — read with the read-only permission you granted | United States / global |
| Framer, Webflow, GitHub | The platform your website runs on. We send the changes you approve, using the key you supplied | United States / global |
These transfers leave the UAE. We rely on the providers' own contractual data protection terms for that.
We will also disclose data where the law requires it, or to protect our rights or someone's safety.
6. How long we keep it
- Account data: while your account exists, then 30 days.
- Audit and crawl data: while your subscription is active, then 30 days
after it ends, then deleted.
- Invoices and tax records: as long as UAE tax law requires.
- Support conversations: 24 months.
- Technical logs: 90 days.
7. Your rights
You can ask us to give you a copy of your data, correct it, delete it, or stop using it for a particular purpose. You can withdraw marketing consent at any time. Email hello@sensate.design and we will respond within 30 days.
You can export your audit data yourself, at any time, from the dashboard — no request needed.
If you are in the EU or UK, GDPR gives you these rights directly and you may complain to your local supervisory authority. UAE Federal Decree-Law No. 45 of 2021 gives equivalent rights in the UAE.
8. Security
Access to the dashboard requires authentication. Sessions are held in signed, HTTP-only cookies that page scripts cannot read. Client accounts are isolated from one another at the data layer, so one customer's account cannot load another's audits. Traffic is encrypted in transit.
No system is perfectly secure. If a breach affects your personal data, we will tell you and the relevant regulator as the law requires.
9. Cookies
We set three essential cookies, all of them strictly functional. We do not use advertising or cross-site tracking cookies, and we do not run analytics.
| Cookie | Purpose | Lifetime |
|---|---|---|
sie_session | Keeps you signed in. Removing it signs you out. | 12 hours |
sie_claim | Holds the link to an analysis you ran before creating an account, so the report reaches you even if the sign-up email opens a new tab. | 24 hours |
sie_gsc_state | A one-time value that proves a Google Search Console connection was started by you. | 15 minutes |
Our sign-in screen loads a script from our accounts provider, Outseta, so that you can create an account or sign in. That provider sees your IP address, browser and the page you are on, as any embedded script does.
10. Children
Legible is a business product and is not intended for anyone under 18. We do not knowingly collect children's data.
11. Changes
If we change this policy materially we will email account holders before the change takes effect.
12. Contact
hello@sensate.design Sensate Origin Design Services-FZCO, DSO-IFZA, IFZA Properties, Dubai Silicon Oasis, Dubai, UAE