Privacy Policy

1. Who this policy applies to

This policy applies to: (a) visitors to our website; (b) people who register for or use the Service, including owners, administrators, managers, viewers and staff of a Company; (c) tenants and property owners who are given access to the Service by a Company; (d) people who contact us for support; and (e) people whose details are entered into the Service by a Company, such as tenants, landlords, guarantors, contractors and other contacts, even though they have no account and may never have heard of us.

2. Who is responsible for your data

2.1We are the controller of the personal data we collect for our own purposes: to run the website and the Apps, to create and secure accounts, to bill and support customers, to keep the Service safe and reliable, to measure how it is used and to meet our legal obligations.

2.2For the information that a Company records in its own workspace (its Customer Data, which includes personal data about its tenants, owners, staff and contacts), the Company is the controller and we are its processor. We process that data on the Company’s instructions to provide the Service, and the Company decides what is recorded, who in its team sees it, how long it is kept, and what you are told about it.

2.3If your landlord or property manager has recorded your details in UAESY and you want to see, correct or delete them, please contact them first. If you cannot reach them, write to us at support@uaesy.com and we will pass your request on to the Company or help you directly where we can.

3. What we collect

3.1Account and identity data. Name; email address; password (stored only as a salted Argon2 hash, never in readable form); phone number; date of birth; nationality; Emirates ID number; profile photograph; preferred language and colour theme; your role and Company membership; and, if you link a sign-in provider, the identifier that Google, Apple or UAE PASS gives us for you, the email address on that account and, for UAE PASS, the profile information the provider releases to us. You provide most of this yourself; some is optional.

3.2Authentication and security data. The public part of your passkeys; one-time verification codes; refresh and session tokens; the times and results of sign-in attempts; a one-way hash of the IP address used to limit repeated failed sign-ins (not the address itself); and records of sensitive actions on your account.

3.3Customer Data entered by you or your Company. Buildings, properties and units, including addresses and map pins; tenancy contracts, rent schedules, terms, renewals and terminations; tenants’, owners’ and contacts’ names, phone numbers, email addresses, nationalities and identity details; cheques (bank, number, amount, dates, status) and payments, deposits, and balances; expenses, suppliers and maintenance requests; comments and activity within the Company; and the photographs, scans and documents you attach, which may include Emirates ID or passport copies, title deeds, tenancy contracts, cheque images, receipts and invoices.

3.4Billing records. The Plan, billing cycle, extra units and users, Modules, amounts, dates and invoice numbers for your subscription. We do not currently collect or store payment-card numbers. If we enable card payments we will use a payment provider and update this policy before we do.

3.5Communications. Your messages to our support team by chat or email; your conversations with the AI assistant, including the questions you ask and the answers returned; and the content of notifications we send to you.

3.6Device and app data (mobile Apps). If you allow push notifications, we receive a device push token from Apple or Google, a random identifier generated by the App for your installation, the time of installation, the device model, operating-system and App version and build, your language and time zone, whether notifications are authorised on your device, which kinds of notifications you have turned on and which sounds you chose, your App-icon choice, whether you use the App lock, the lock delay, whether the App is hidden in the app switcher, the type of biometric your device supports (for example Face ID) and the times at which the App was opened. We use this to deliver the right notifications to the right device and to keep the Apps working. We do not receive your fingerprint or face data: biometric unlocking is done by your device.

3.7Website and usage data. For each page request: your IP address, the page address, the referring address, browser and device type (user agent) and language. For signed-in users, an in-app record of the screens visited, which we use to understand how the product is used and to help with support. This record does not store your IP address.

3.8Diagnostic data. Server logs and error reports. When a request to our servers fails, an automated alert is sent to our team through a business messaging service (Telegram). The alert may include the address and method of the request, the error, the technical details of the failure, the signed-in user and Company, the app platform and version, your IP address and your browser or device type, and the details of the request. We use it to find and fix faults quickly.

3.9Information from others. Your Company or colleagues may enter information about you. Our service providers and sign-in providers send us the information described in clause 3.1 when you use them to sign in. Map services return location suggestions for the addresses that are entered.

3.10Sensitive data. We do not ask you to give us sensitive categories of personal data (such as health, religion or criminal records) and the Service is not built for them. Identity documents and financial information that you upload are personal data that deserve special care: please upload them only where you need to, and note that they are visible to everyone in your Company whose role permits access to the record.

4. Why we use your data, and on what basis

We use personal data only for specific purposes and only where we have a lawful basis to do so under UAE data-protection law:

(a)To provide the Service: to create and operate your account, store your records, calculate balances and schedules, send reminders, generate reports and exports, and provide support. Basis: performance of our contract with you or your Company, and, for Customer Data, the Company’s instructions.

(b)To keep the Service secure: to verify your identity, prevent fraud and abuse, enforce rate limits, investigate incidents, and keep audit records. Basis: our legitimate interests in protecting the Service and our users, and our legal obligations.

(c)To send you notices: security and account messages and, where you have not turned them off, notifications about activity in your Company. Basis: performance of the contract and, for optional notifications, your consent, which you can withdraw in the Service or in your device settings.

(d)To operate AI Features when you choose to use them. Basis: your consent and the instructions you give by using the feature. See clause 5.

(e)To bill and administer subscriptions and to meet tax, accounting and regulatory requirements. Basis: performance of the contract and legal obligations.

(f)To understand and improve the Service: to measure usage, find faults, test changes and plan capacity, usually with aggregated or de-identified data. Basis: our legitimate interests in developing a reliable product.

(g)To respond to legal requests and to establish, exercise or defend legal claims. Basis: legal obligations and our legitimate interests.

We do not use personal data for advertising or for profiling that produces legal or similarly significant effects on you, and we do not sell personal data.

5. Artificial-intelligence features

5.1When you use the invoice scanner, the photograph that you take or choose is sent over an encrypted connection to OpenAI, which reads the text and returns the details for you to review. When you use the AI assistant, your question and a selection of the Company’s current figures and records that is relevant to the question (which may include property names, contracts, tenant names, payments and expenses) are sent to OpenAI to produce an answer. We send these only when you use the feature.

5.2OpenAI acts as our service provider, processes the data only to return the result to us, and under our arrangement does not use it to train its models. The answers are generated automatically and are not decisions that have legal effect; they are suggestions that you review.

5.3The AI Features are optional. If you or your Company do not wish for this data to be sent to OpenAI, do not use them. Your messages to the assistant and its replies are stored with your account so that the conversation can continue.

6. Who we share data with

6.1Within your Company. Customer Data is visible to members of the Company according to their role. Owners and administrators can see the members, their roles and their activity in that Company. Tenants and property owners who have been given portal access see only the records that relate to them.

6.2Service providers (sub-processors). We use carefully chosen providers who process data on our behalf and only on our instructions, under written contracts that require confidentiality and security: cloud hosting and infrastructure for storage and processing; Resend for the delivery of email; the Apple Push Notification service and the push-notification service of the device maker for push messages (they receive the device token and the notification content); OpenAI for the AI Features; Google for sign-in and maps; Apple for sign-in; the UAE PASS service for sign-in; and Telegram for internal alerts and support messages as described in clause 3.8. Where a provider offers its own controls we use them. We review the list when our services change and you can ask us for its current version.

6.3Authorities and advisers. We may disclose data if we are legally required to, for example under a court order or a request of a competent UAE authority, or where necessary to protect rights, safety or property, to prevent fraud, or to establish or defend a legal claim. We will, where lawful and practical, tell you first. We may also share data with professional advisers (lawyers, auditors, insurers) bound by confidentiality.

6.4Business changes. If we are involved in a merger, acquisition, financing or sale of assets, personal data may be transferred to the successor, which will be bound to protect it in line with this policy, and we will inform you before it becomes subject to a different policy.

6.5With your consent or on your instructions, for example if you ask your Company to give an accountant access to a report.

7. International transfers

Some of our providers and their servers are located outside the United Arab Emirates, for example in the European Union and in the United States. Where personal data leaves the UAE we transfer it only in ways that UAE law allows, for example to a jurisdiction that provides an adequate level of protection or under contractual commitments that require the recipient to protect the data to a comparable standard, and we limit what is sent to what the service needs. You can ask us for information about the safeguards that apply to a particular transfer.

8. How long we keep data

8.1Accounts and Customer Data are kept for as long as the account or Company is active, because the Service exists to keep this history for you.

8.2When you delete your account, it is deactivated immediately and held for 30 days so that you can change your mind by signing in again. After 30 days your account and the personal data in it are permanently deleted. When an Owner deletes a Company, its properties, contracts, tenants, owners, files and other Customer Data are permanently deleted. Records that a user deletes inside a Company may be held for a short time in a recovery area before they are removed permanently.

8.3Some data is kept for shorter, defined periods: session tokens until they expire (access tokens are valid for 15 minutes and refresh tokens for up to 30 days) or until you sign out; one-time codes until they expire; records of failed sign-in attempts only for as long as the rate-limit window needs; and trial and demonstration accounts, which are removed automatically.

8.4We keep billing and invoice records, and the information needed to show that we complied with tax, accounting and other legal obligations, for the period those laws require, which for tax and accounting records is generally at least five years.

8.5Backups and logs may keep copies of data for a limited period after deletion until they are overwritten in the ordinary cycle. During that time they are protected in the same way and are not used for any other purpose.

8.6When we no longer need personal data, we delete it or irreversibly anonymise it.

9. How we protect data

9.1We use technical and organisational measures that are appropriate to the risk. They include: encryption of data in transit with TLS; passwords stored only as salted Argon2 hashes; optional passkeys and email-based verification; short-lived access tokens with refresh tokens that we can revoke, including from all devices at once; secure, HTTP-only cookies; rate-limiting of sign-in attempts; confirmation of your password before sensitive actions; role-based access controls inside each Company and separation of data between Companies; private file storage that is available only to authorised signed-in users; an optional App lock with biometric or passcode protection on your device; and logging and monitoring of failures.

9.2Access by our staff to Customer Data and personal data is limited to those who need it for their work, is subject to confidentiality duties, and is used to provide support or investigate faults and abuse.

9.3No system is completely secure, and you also play a part: choose a strong, unique password or a passkey, keep your devices locked, and sign out on shared devices. If a personal-data breach occurs that is likely to harm you, we will notify you and the competent authority as the law requires, and without undue delay.

10. Your rights and choices

10.1Subject to the law and to limited exceptions, you have the right to: be informed about how your data is used; obtain a copy of your personal data and information about how it is processed; ask us to correct data that is inaccurate or incomplete; ask us to delete your data; ask us to restrict processing or object to it, including to processing that is based on our legitimate interests or that is used for marketing; ask to receive your data in a structured, commonly used format and to have it transferred to another provider, where technically feasible; withdraw a consent you have given (this does not affect the earlier processing); and not to be subject to a decision based only on automated processing that significantly affects you.

10.2Many of these choices are in the Service: you can edit your profile, change language and theme, switch notification types and sounds on or off in the Service and in your device settings, remove passkeys, sign out of devices, delete your account, and export records.

10.3To use a right that the Service does not offer directly, write to us at support@uaesy.com from the email address of your account, or, if you do not have an account, tell us what you need and which Company recorded your data. We may need to confirm who you are before we act, to protect you against someone else pretending to be you. We aim to respond within 30 days; if the request is complex we will tell you why more time is needed. We do not charge a fee unless a request is clearly unfounded or excessive.

10.4We may refuse or limit a request where the law allows or requires, for example where we must keep a record for legal reasons, or where meeting it would reveal personal data about someone else. We will explain our reasons.

10.5If you are not satisfied with how we have handled your data, please tell us first so that we can put it right. You also have the right to complain to the competent data-protection authority in the United Arab Emirates, the UAE Data Office.

11. Mobile app permissions and features

11.1Camera: to photograph cheques, receipts and documents for attaching and, if you ask, reading with the AI Features. Photos and files: to attach existing images and documents. Notifications: to deliver the reminders and alerts that you enable. Face ID, Touch ID or Optic ID: only to unlock the App if you turn on the App lock; the result of the check stays on your device. Location: the App does not use or collect your location; the notice shown by the operating system comes from the map component that lets you place a property’s address on a map.

11.2Share extension and widgets. If you send a file to UAESY from another app using the share sheet, it is sent to your Company when you choose to send it. The home-screen and lock-screen widgets show figures from your Company, such as expected amounts, overdue payments or recent notifications, on the device. They are visible according to your device settings, so choose the widgets you display with that in mind and use your device’s lock settings.

11.3You can turn off any permission in your device settings at any time; the feature that depends on it will stop working, but the rest of the App will continue to do so.

12. Cookies and similar technologies

We use a small number of cookies and local storage on our website and web app, mainly to sign you in, to keep your session secure, to remember your language and theme, and to remember your list and filter preferences. We do not use advertising cookies. The Cookie Policy explains which ones we use and how you can control them.

13. Children

The Service is intended for adults who manage property. It is not directed at anyone under 18 and we do not knowingly collect personal data from children. If you believe that a child has given us personal data, please write to us and we will delete it.

14. Links and third-party sign-in

When you sign in with Google, Apple or UAE PASS, that provider also processes your data under its own privacy policy, and we receive only the information described in clause 3.1. Links from our website or app to other websites are not covered by this policy.

15. Changes to this policy

We may update this policy from time to time, for example when we add features or providers, or when the law changes. We post the current version here with its “last updated” date. If a change is material we will tell you in the Service or by email before it takes effect, and where the law requires your consent to the change we will ask for it.

16. Contact

Privacy questions, requests and complaints: support@uaesy.com. Please include the email address of your account and describe your request, and tell us which Company recorded your data if you are not a UAESY user.