Privacy and terms
Two documents about the Open Mat, the FFL Dojo demonstration at dojo.sulavamea.com: what we know about you, and what we are promising each other. Both written to be read rather than survived.
The short version. Signing in tells us your work email address. The access form asks six things about you. We keep your practice record, because handing it back to you is the demonstration. We hold no key to your Microsoft 365 — not your mail, not your files, not your calendar, nothing in your organisation's tenant. Ask us to delete what we have and we will, and we will tell you when it is gone.
Privacy notice
This notice covers the Open Mat demonstration specifically. The wider Sulava MEA privacy policy governs everything else and applies here too; where this notice is more specific, it is because this demonstration does less.
Who is responsible
Sulava MEA is the data controller.
DIC Building 9, Dubai, United Arab Emirates
gulf@sulava.com · +971 58 895 9260
Write to that address for anything in this notice, including a request to delete what we hold.
What we collect, and why
| What | When | Why |
|---|---|---|
| First name, last name, work email, company name, company size, and the reason you give | Only if you fill in the access form | To decide whether to open the demonstration for your organisation, and to reply to you |
| Your work email address | When you sign in, by either door | To confirm your organisation is invited, and to hold your session |
| What you practise here: the tasks you attempt, what you produce for them, the grading, and any belts or records that result | While you use the demonstration | It is the demonstration — showing your own record back to you is the thing being shown |
| Anything you type into the feedback box, and a screenshot if you choose to attach one | Only if you send feedback | To fix what you told us about |
| The business problem you describe in a workshop, and everything the room produces from it | Only while that browser tab is open | To run the workshop. It is not stored. It is held in your browser for the length of the session, sent to the AI models to be worked on, and gone when you close the tab. We keep whether a workshop passed — never what it was about. The charter is yours to download; we do not keep a copy |
| Counts of activity, held against your organisation's domain and never against you personally | While you use the demonstration | To know whether the demonstration is working and whether it is being used |
The last row is worth spelling out, because it is the one people assume is worse than it is. We count things like how many people from your company signed in this week. We do not keep a record of which named individual pressed what. Where a count needs to distinguish one person from another, it uses a one-way identifier and stores only the number of distinct people, not the list.
What we do not collect
- Nothing from your Microsoft 365. If you sign in with
Microsoft, this application requests three things —
openid,profileandemail— and nothing else. No mail, no files, no calendar, no directory, no Teams. You can confirm this on the consent screen itself before you approve it. - No password. There is nothing to create and nothing for us to store. The email door sends a six-digit code that lasts five minutes.
- No payment details. The demonstration is free.
- No advertising or analytics trackers, and no third-party cookies. There is no advertising network involved in this site at all.
The digital twin, and the pictures
A workshop in Nextshape includes a digital twin of Aki Antman. It is a simulation: an AI model running a written profile of how he reasons, so that it argues the way he would. It is not Aki, it does not speak for him, and nothing it says is evidence that he has seen, reviewed or approved anything. Every contribution it makes is labelled as simulated on screen and again in the document you take away. It is not his recorded voice and it is not his likeness.
The twin can read Microsoft Learn and Wikipedia, and nothing else. It has no access to your data, to our internal documents, or to any mailbox, file or calendar anywhere.
The diagrams drawn on the workshop whiteboard are generated by an AI image model from a description the application writes itself — never from your words directly. They are illustrations of the discussion, they are capped per session, and they are sent straight to your browser rather than being stored.
You can choose to show the room something of yours — a screenshot, a photo or a single frame of your screen. It is sent to the AI model once, for that turn only, and is never stored, logged or shown again: what survives is a one-line written summary on the workshop board. At most three things can be shown per workshop, and nothing is ever captured without your explicit action each time.
Why we are allowed to
Two grounds, and neither is exotic. Your consent, where the law asks for it: you chose to request access, and you chose to sign in. Our legitimate interest in running a demonstration of our own product, learning from how it goes, and keeping it secure. Where a law or a regulator requires us to keep something, we keep it — that one outranks both.
Who else sees it
The people at Sulava MEA who run this demonstration. Our cloud hosting provider, Microsoft, because the demonstration runs on Microsoft Azure. And when you ask the Master Teacher something, your question is sent out as you wrote it — to Microsoft Learn, or to Wikipedia — so that the answer is today's rather than remembered. Only the question goes: not your record, not your progress, and nothing else you have done here. Nobody else. We do not sell it and we do not pass it to anyone for marketing. If we were ever required to disclose something by law, we would.
Where it is
This demonstration runs in Microsoft Azure in the East US 2 region, in the United States, on infrastructure kept separate from any customer system and from Sulava's own. Personal data you give it is therefore processed outside the UAE. Sulava MEA applies the safeguards described in the corporate privacy policy to that transfer.
How long we keep it
An access request is kept while we are deciding on it and afterwards as a record of that decision. Your sign-in address and your practice record are kept while the demonstration runs, so that coming back a week later still shows you your own progress. Session tokens last eight hours. Sign-in codes last five minutes and are destroyed once used.
Ask us to delete it and we will, and we will confirm when it is done. Write to gulf@sulava.com.
Your rights
These are yours, and one email is the whole procedure. Ask us to:
- show you everything we hold about you
- fix whatever we got wrong
- delete it
- stop, or narrow, what we do with it
- take back your consent, where consent was our grounds
- hand it over in a form you can carry elsewhere, where that applies
Write to gulf@sulava.com. And if we ever handle one of those badly, you can go over our heads: the UAE Data Office in the United Arab Emirates, or the Saudi Authority for Data and Artificial Intelligence in the Kingdom of Saudi Arabia.
Terms of use
What this is
The Open Mat is a demonstration of the FFL Dojo, offered free of charge and by invitation, so that you can try the product before deciding anything. It is not a paid service, it carries no service level, and it is not the product as you would run it in your own tenant.
What it issues is marked DEMO
Anything you earn here — a belt, a Proof of Practice, a record of a graded task — is issued by "FFL Dojo Demo" and is marked DEMO. It is a record of practice and not a formal certification, not a qualification, and not Sulava MEA's verdict on how good you are. Show it to your manager by all means; it is not a line for the qualifications section of a CV.
Fair use
Use it for what it is for: finding out whether you want the real thing. Then the short list of things we ask you not to do, each of which would spoil it for everybody else — break into it, hammer it until it falls over, hoover up the exercise library, run somebody else's personal data through it, or upload material that is not yours to upload. Your invitation belongs to you and to your organisation, and it does not travel further than that.
Your work stays yours
What you produce while practising is yours. We keep it only to run the demonstration and to show it back to you, as the privacy notice above describes. The exercises, the grading, the FFL Dojo itself and everything about this site remain Sulava's.
It is a demonstration, so
You get it as it is — we may change it, pause it or take it away at any time, for everyone or for one organisation, without warning, and an evaluation ending is the usual reason. The grading comes from an AI model, and an AI model can be wrong: that is precisely why every mission carries an appeal, and why nothing issued here is a certification. Beyond that, and as far as the law allows, Sulava MEA is not liable for losses arising from your use of the demonstration.
Which law
These terms are governed by the laws of the United Arab Emirates as applied in the Emirate of Dubai, and the courts of Dubai have jurisdiction — except where a mandatory rule of your own local law says otherwise.
Questions
gulf@sulava.com — the same address as everything else on this page.