Privacy Policy

CodeX FZ LLC, trading as Shootless (“Shootless,” “we,” “us”), is the controller of the personal data described in this policy. Our business address is Al Shohada Road, Al Hamra Industrial Zone-FZ, SBAM0066 Compass Building, Ras Al Khaimah, United Arab Emirates.

You can contact us or exercise a privacy right at support@shootless.io.

• Waitlist information: your name, email address, submission time, and basic anti-abuse signals such as a short-lived IP-based rate-limit record.
• Contact information: your name, email address, message, submission time, and basic anti-abuse signals when you contact us.
• Analytics information: only after you choose “Allow analytics,” Google Analytics may receive page views, referral source, approximate location, and device/browser information. We do not send waitlist details or contact messages to Google Analytics.
• Technical and security information: our hosting and security systems may process IP address, request time, requested URL, browser/user-agent information, and error or security logs needed to deliver and protect the website.
• Local website preferences: your analytics choice and a session-only record used to avoid repeatedly showing the early-access prompt.

We do not knowingly collect payment details, garment uploads, account credentials, or generated images on this website.

• Waitlist: to record your request for early access and send the early-access or launch updates you requested. We rely on your affirmative request and consent. You may withdraw at any time.
• Contact: to answer your message, keep a reasonable record of the conversation, and prevent abuse. We rely on your request and, where applicable, our legitimate interest in responding and operating a secure website.
• Analytics: to understand website usage and improve the site. Analytics remains off until you affirmatively allow it, and you can change your choice at any time.
• Security and legal compliance: to prevent spam, diagnose faults, protect our systems and rights, and comply with applicable law.

Where a particular law requires consent, we process on consent unless another lawful exception applies. If you withdraw consent, that does not affect processing that was lawful before withdrawal.

We disclose personal data only as needed to operate this website:

• Twenty CRM: stores and manages waitlist names, email addresses, and product/source tags.
• Email and SMTP providers: transmit contact-form messages to our support inbox and deliver requested communications.
• Hosting, network, and security providers: deliver the website and process operational logs.
• Google Analytics: receives analytics data only after you allow analytics.
• Authorities or advisers: where disclosure is required by law or reasonably necessary to establish, exercise, or defend legal rights.

These providers may process data only for the services they provide to us. We do not sell personal data or share it for cross-context behavioural advertising.

Some providers may process personal data outside the United Arab Emirates, including in countries where they or their infrastructure operate. Before making a restricted transfer, we use a mechanism permitted by applicable law, such as a transfer to a jurisdiction recognised as providing adequate protection, contractual protections with the recipient, or your explicit consent where that is an available basis. You may contact us for information about the safeguard used for a particular transfer.

• Analytics choice: sl_analytics_consent stores whether you allowed or declined analytics, the choice time, and the notice version. It expires for our purposes after 180 days, when we ask you to choose again.
• Early-access prompt: a session-only value prevents the exit-intent prompt from appearing repeatedly in the same browser session.
• Google Analytics: if you allow analytics, Google may set first-party cookies such as _ga and _ga_<measurement-id>. We configure these cookies for up to 180 days.

Advertising storage, advertising user data, and ad personalisation remain disabled. If you decline analytics, the Google tag is not loaded. Use Privacy settings in the footer to change your choice; when you withdraw consent, we disable analytics and remove the Google Analytics cookies available to this site.

• Waitlist: until you withdraw, or for no longer than 24 months after your last interaction. We review the list when general availability opens and delete or anonymise entries no longer needed.
• Contact messages: normally for up to 24 months after the conversation ends, unless a longer period is reasonably needed for a legal claim, security matter, or legal obligation.
• Rate-limit records: approximately one minute for waitlist submissions and 15 minutes for contact submissions in the application process.
• Operational logs: according to the hosting or security provider’s configured schedule and only as long as reasonably necessary for security and diagnostics.
• Analytics: the local consent record is valid for 180 days. Our Google Analytics property is configured for a 14-month user and event data-retention period.

We may retain limited records longer where necessary to comply with law or establish, exercise, or defend legal claims.

Depending on the law that applies to you, you may request information about our processing and a copy of your data; correction, deletion, transfer, or restriction; or object to processing. You may also withdraw consent. We may need to verify your identity and may retain information where the law permits or requires it.

Send a request to support@shootless.io. You may also complain to the UAE Data Office or another competent privacy regulator where you live. If the GDPR applies, you may complain to a supervisory authority in the EEA or UK.

We use measures appropriate to the current website, including encrypted connections, access controls, anti-abuse controls, restricted server-side credentials, and service providers selected to handle data on our behalf. No internet service is completely secure. If a personal-data breach creates a risk requiring notice, we will notify the competent authority and affected people as required by applicable law.

The website and waitlist are intended for business users aged 18 or older. We do not knowingly collect personal data from children. If you believe a child has submitted data, contact us so we can delete it.

We do not use the website data described here to make decisions that produce legal or similarly significant effects. Waitlist communications concern requested early access and launch information. You can opt out at any time by using an unsubscribe method in the message or emailing us. We do not add contact-form users to the waitlist unless they separately ask to join.

We may update this policy as the website, providers, or legal requirements change. We will post the revised policy with a new “last updated” date and provide additional notice where required. Materially new processing that requires consent will not begin until the required choice is obtained.

Questions or requests can be sent to support@shootless.io.