Privacy Policy

1. Who we are

PropertySuite is operated by Propertysuite L.L.C-FZ, a Limited Liability Company registered in the Meydan Free Zone, Dubai, United Arab Emirates (Licence No. 2649715.01), with registered address Meydan Grandstand, 6th Floor, Meydan Road, Nad Al Sheba, Dubai, U.A.E. (“PropertySuite”, “we”, “us”). We are the data controller responsible for the personal data processed through the PropertySuite platform and its related suites (Owner Portal, Tenant, Partner, Agent and Developer portals), through our public websites, including our careers pages, and through our referral partner programme.

This policy explains what personal data we collect, how we use it, who we share it with, and the rights you have under the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021, the “PDPL”). Most of our users live outside the UAE. If you are in the European Economic Area, the United Kingdom or Switzerland, the data protection law applicable to you (including the GDPR) applies to our processing of your data alongside the PDPL, and the rights in section 10 are available to you under that law as well.

2. What data we collect

• Identity and contact data: name, email address, phone number, language preference, and (where you choose to provide it) your country of residence, nationality, postal address and date of birth.
• Identity documents: where a service legally requires it (for example KYC checks on property transactions, tenancy registration, or the verification of a referral partner), copies of your passport, Emirates ID or visa and the details they contain, including document type and expiry date.
• Property and account data: details about the properties you own or rent, documents you upload or that our team files for you, tenancy and payment records, service requests and support requests.
• Booking and transaction data: services you request or book, quotes, invoices, and the status of work performed.
• Payment data: payments are processed by our payment provider (Stripe). We do not store full card details on our own systems; we retain only the transaction reference and status.
• Bank details: where we pay money out to you (for example rental proceeds to owners, invoices to partners, or commissions to referral partners), the account details you provide, such as your IBAN.
• Communication data: messages you exchange with us by email, in-app chat or WhatsApp, including the content of those conversations. Emails you exchange with members of our team can be stored and linked to your customer record (see section 6).
• Referral partner data: if you join our referral programme, your legal form, company and registration details, address, tax status, an identity document, your bank details, the signed partner agreement, the IP address from which you signed it, and a running count of clicks on your referral links.
• Technical data: IP address, device and browser information, and basic server logs needed to operate the service securely (for example to limit abusive requests).
• Usage data (only with your analytics consent): if you accept analytics in the cookie banner, we record which pages of the portal you visit, how long you stay, your device and browser type, your country and city, and the page you came from. We do not store your IP address in these usage records.
• Waitlist, enquiry and subscription data: if you request access, book a consultation, subscribe to our blog newsletter, unlock deal updates or use our property valuation tool, the name, email, phone number, property details and any message you submit, together with a record of the consent you gave or declined.
• Job applicant data: if you apply for a role, your name, contact details, CV, links you share (such as LinkedIn or an intro video), your answers to application questions, and the AI-assisted assessment described in section 11.

3. How we use your data

• To create and manage your account and portal access.
• To provide, coordinate and deliver the services you book, including communication about your bookings and cases.
• To process payments, issue invoices and meet tax obligations.
• To carry out identity and compliance checks where UAE law requires them (for example KYC/AML checks on property sale transactions), and to verify referral partners before paying commissions.
• To keep your identity documents on file for the services that need them and to remind you and our team before a passport or Emirates ID expires.
• To send you operational notifications by email, in-app and, where you have provided your number, WhatsApp.
• To send you marketing messages you opted in to (for example monthly market value updates), and to stop sending them when you withdraw.
• To keep our correspondence with you in one place by linking emails exchanged with our team to your customer record.
• To power the AI-assisted features described in section 5, such as reading documents you upload and helping our team respond to you faster.
• To attribute bookings to the referral partner who introduced you and to pay that partner a commission.
• To understand how the platform is used and improve it (only with your analytics consent).
• To run our recruitment process when you apply for a role.
• To secure, maintain and improve the platform.
• To comply with applicable UAE laws and regulatory requirements.

4. Legal basis

We rely on the following legal bases, in each case as permitted under the PDPL and, where it applies, the GDPR:

• Performance of a contract with you (or steps you ask us to take before one): your account and portal, bookings, quotes, invoices and payments, tenancy records, partner and referral-partner payouts, and the operational messages that go with them.
• Compliance with a legal obligation: KYC/AML checks on property sale transactions, tax and accounting records, consumer protection record-keeping, and responding to lawful requests from authorities.
• Your consent: analytics and marketing cookies, monthly value updates, deal updates, the blog newsletter, and the submission of a job application. You can withdraw consent at any time (section 10); withdrawal does not affect processing that happened before it.
• Our legitimate interests, balanced against yours: securing and monitoring the platform, preventing fraud and abuse, keeping the correspondence you have with our team linked to your record, using AI tools to read documents and draft replies for the services you asked us for, and measuring the reach of our own content. You can object to processing on this basis (section 10).

5. AI-assisted features

Some features of the platform use artificial intelligence models provided by Anthropic and OpenAI, both based in the United States. When one of these features runs, the data described below is sent to the provider to generate the result. We want to be transparent about exactly where this happens:

• Document reading: when you or our team upload a document such as a tenancy contract, an AI model (Anthropic) reads it to extract key details (names, dates, amounts) so they do not have to be typed in manually.
• Identity document reading: identity documents filed in your personal or KYC folder (passport, Emirates ID, visa) are read by an AI model (Anthropic) to record the document type and expiry date. This runs automatically overnight for newly filed documents. The result is a type and a date on the document record; it is used for expiry reminders and does not by itself change anything about your account.
• Email support: when you email our support team, a member of our team may ask an AI model (Anthropic) to read the email thread and suggest a draft reply. A person reviews every draft before it is sent; nothing is sent automatically.
• WhatsApp assistant: messages you send to our WhatsApp number may be answered by an AI assistant (Anthropic). The assistant sees your name, phone number and conversation history to respond, and stops as soon as a team member takes over the conversation. To find relevant answers, the text of messages is also converted into search embeddings using OpenAI.
• Investment suggestions: if you use deal recommendations in the Owner Portal, an AI model (Anthropic) processes your portfolio data to suggest matching opportunities.
• Help chat: questions you type into the in-app help chat are answered with the help of an AI model (Anthropic). A question the assistant cannot resolve is handed to a person.
• Job applications: see section 11.

None of these features makes a decision about you that has legal or similarly significant effects. AI output is either a convenience (extracting text from a document you provided) or a suggestion that our team reviews. The WhatsApp assistant and the help chat send conversational replies automatically, but decisions about your account, bookings, payments, verification or applications are always made by people. AI output can be wrong; verify important values against the original document.

6. Emails you exchange with our team

Members of our team can connect their work mailbox (Google Workspace) to the platform. When they do, emails between that mailbox and addresses already stored in our customer records (owners, tenants, partners and contacts) are copied into the platform and shown on the matching record, so that whoever handles your case sees the full history. Only messages exchanged with an address we already have on file are stored; all other mail in that mailbox is left out. Messages are stored as plain text without tracking elements, attachments are counted but not copied, and a stored email is visible only to the mailbox owner and to team members who are already allowed to see your record. This synchronisation is not read by AI unless a team member explicitly asks for a draft reply (section 5).

7. Who we share data with

We do not sell your personal data. We share it with:

• Certified Partners: the UAE-licensed providers who perform a service you book, and only the information strictly needed to deliver that service.
• Blonds Real Estate LLC (Dubai): our affiliated RERA-licensed brokerage. Blonds carries out the parts of a booked service that require a RERA licence, for example tenancy contracts, Ejari registration or rental management. Some of the team members who work on your record are employed by Blonds rather than by Propertysuite L.L.C-FZ. Blonds is also a possible employing entity for job applicants (section 11).
• Referral partners: if a partner or agent introduced you to a service, that partner sees the status of the booking they referred (whether it was placed, paid and completed) so their commission can be calculated. They do not see your documents, identity checks or payment details.
• Authorities: where required by UAE law, regulation or a valid legal request.

And with the service providers (processors) below, who act on our instructions:

• Platform infrastructure: Supabase (database, login and file storage; hosted in the EU, Frankfurt region), Vercel (website hosting and delivery; global network, USA-based), and a second Supabase instance used for our support knowledge base.
• Payments and accounting: Stripe (payment processing; USA-based, with EU entities) and Intuit QuickBooks (invoicing for partner commissions; USA).
• Email, newsletter and messaging: Resend (transactional email delivery, including attachments such as invoices, and the blog newsletter list; USA) and Meta WhatsApp Cloud API (WhatsApp message delivery and verification codes; USA). WhatsApp conversations are stored in our own database; there is no separate messaging provider.
• AI providers: Anthropic and OpenAI (USA), for the features described in sections 5 and 11.
• Google Workspace: our team mailboxes and calendars (section 6) and the shared Drive folders in which our team files customer documents; documents filed there are imported into the platform so they appear on your record (USA-based provider).
• Analytics and advertising (only with your consent): Google Analytics 4 and Meta (Pixel and Conversions API), as described in the Cookies section.
• Internal operations: Slack (internal notifications to our team, which can include your name and request details; USA), Airtable (operational syncing of selected lead data; USA), and Sentry (error monitoring; configured to minimise personal data; USA).
• Content and maps: Google Maps and Mapbox (showing property locations; only property addresses are shared) and Cloudflare Stream (video hosting).
• Lead sources: Property Finder (UAE), from which we receive enquiries you submitted there about our listings.
• Backups: Cloudflare R2 (encrypted off-site backups of our database and files).

8. International transfers

Our platform and database are hosted in the European Union (Frankfurt region). As the list above shows, several of our service providers (including our AI, email, analytics and messaging providers) process data in the United States. Where personal data leaves the UAE or the EEA, we rely on the providers' data-processing terms, which incorporate the EU Standard Contractual Clauses, and, where the provider is certified under the EU-US Data Privacy Framework, on that certification, as safeguards recognised under the PDPL and the GDPR.

9. How long we keep it

We keep personal data for as long as your account is active. Some records must be kept after that because the law requires it, and we do not delete them even if you ask us to close your account:

• Invoices, payment records, bookings and commission statements: at least 5 years after the end of the year they relate to, under UAE tax and commercial law.
• KYC/AML records (identity documents and declarations collected for a property sale transaction): at least 5 years after the transaction or the end of the business relationship, under UAE anti-money-laundering rules.
• Consent records (what you accepted or declined, and when): for as long as we could have to prove that we had your consent.
• Referral partner agreements and the identity document verified for them: for the life of the partnership and the retention period of the commission payments made under it.

For everything else we do not yet delete data automatically when a period ends. In practice this means that waitlist and enquiry data, correspondence, documents you uploaded, WhatsApp conversations and application data stay on file until you ask us to remove them or we remove them during a review. If you want specific data removed, contact us and we will handle it individually (section 10). Our encrypted backups run on a rolling schedule: daily backups expire after 30 days; monthly snapshots are currently kept without a fixed end date while we set one. Backups are used only to restore the service after a failure, never to bring back or reprocess data that was deleted.

10. Your rights

You may request to access, correct, or delete your personal data; restrict or object to processing based on our legitimate interests; receive a copy of the data you provided in a portable format; and withdraw consent at any time without affecting earlier processing. You can correct most of your profile data and manage notification preferences yourself in your portal settings, and every marketing email carries an unsubscribe link. For everything else, contact us at info@propertysuite.ae and we will handle your request personally.

You can delete your account yourself. Open your profile and use “Delete account” at the bottom of the page; the account deletion page describes the process in full. Deletion takes effect immediately: your sign-in stops working and cannot be restored, and your name, email address, phone number, nationality, date of birth, bank details, passport and Emirates ID scans, profile photo and your contact record in our CRM are erased. Your identity documents are permanently removed from storage.

What deletion does not do is remove the records we are required to keep (section 9). Your bookings, invoices, payment records, support tickets and case files remain in our books, but after your deletion they no longer carry your name, contact details or bank information; they stay only as anonymised entries. We keep the account record itself in an anonymised form for the same reason, so those entries continue to add up correctly. You are free to register again later with the same email address, which starts a fresh account.

Requests for access, correction, export or the deletion of specific data short of closing your account are still handled manually rather than through a self-service tool, so they can take some time; we will respond within the timeframes required by law. Deleted data also persists in our encrypted backups until those expire (section 9). You may lodge a complaint with the UAE Data Office and, where the GDPR applies to you, with the data protection authority of your country of residence.

11. Job applicants

If you apply for a role with us, we process your application data (name, contact details, CV, links and answers) to run the recruitment process. Roles are advertised by PropertySuite; the employing entity for a role may be Propertysuite L.L.C-FZ or our affiliated brokerage Blonds Real Estate LLC (Dubai), and your application is shared between the two for that purpose. Three things we specifically want you to know:

• AI-assisted ranking. Our team uses an AI model (Anthropic, USA) to produce a first assessment of applications against the published criteria for the role. The model receives your CV, your answers and the links you shared, but not your name. It produces a score and a short summary that order the list our reviewers work through. A team member may additionally ask the model for a written assessment of a single application; that assessment includes your name and is likewise only a suggestion. None of this is automatic: the ranking is started by a member of our team, not by your submission; no application is rejected, archived or ranked out of sight automatically; and every decision, including a decline, is made and sent by a person. You can ask us for the assessment made about you, and for a review by a person who has not seen it.
• Advertising measurement. If you accepted marketing cookies on our site, we send a conversion signal to Meta when you submit an application (a hashed version of your email address, never plain text), so we can measure whether our job ads work. This never includes your CV or application content.
• Retention. Application data, including your CV and the AI assessment, is kept while the recruitment process runs and is not deleted automatically afterwards; you can request deletion at any time via info@propertysuite.ae, and we delete the application together with the CV file.

12. Referral partners

If you join our referral programme, we collect the details needed to conclude the partner agreement and to pay you: your legal form, company and registration details, address, tax status, bank details and an identity document, which a member of our team verifies before the first payout. When you accept the agreement, we generate a signed copy with your details and record the IP address and time of acceptance as proof. Referral links carry a running click counter; no per-click record of the visitor is stored. How the referral cookie works is described in the Cookies section. The separate Affiliate Terms govern the commercial relationship.

13. Cookies

We use cookies for four purposes: keeping you signed in, remembering your cookie choice, attributing a visit to the referral partner whose link brought you here, and, only if you consent, measuring how our platform and advertising perform. Nothing outside the essential category loads until you actively accept it.

• Essential, always on. Sign-in and session cookies from our authentication provider (Supabase), and ps_consent, which stores your cookie choice for 12 months. Required to operate the platform securely. Not subject to the choice below.
• Referral attribution, first party. If you arrive through a referral partner's link, ps_ref stores that partner's code for 30 days so that a booking you make in that time can be credited to them. It is set and read only by us, is not shared with any third party, and contains no information about you.
• Analytics, only with your consent. Google Analytics 4 sets _ga and related cookies to measure how the platform is used, so we can improve it. Provider: Google. Legal basis: your consent. Retained for the period set by Google, and only for as long as you keep the analytics choice switched on.
• Marketing, only with your consent. Meta (Facebook Pixel and Conversions API) sets _fbp and _fbc, and for some events receives a hashed version of your email address, never in plain text, to measure and improve our advertising. Provider: Meta. Legal basis: your consent. Retained for the period set by Meta, and only for as long as you keep the marketing choice switched on.

Analytics and marketing cookies are blocked by default and only load after you accept them in the cookie banner. You can change or withdraw your choice at any time via Cookie Settings below. Your choices, and any marketing opt-in or unsubscribe, are recorded in a consent register so we can prove what you agreed to and honour what you declined.

14. How we protect your data

Data is encrypted in transit, access is restricted by row-level security so each user can only see their own records, identity and KYC documents are stored in private storage that is not publicly accessible and is served to authorised users only through time-limited links, and we maintain encrypted off-site backups whose restore procedure is tested on a schedule. We continually review our security measures, but no system can be guaranteed completely secure.

15. Children

PropertySuite is intended for users aged 18 and over and is not directed at children.

16. Changes to this policy

We may update this policy from time to time. Material changes will be communicated through the platform, and the “last updated” date above will reflect the latest version. This version (10 September 2026) adds the email correspondence sync, identity document reading, the AI-assisted ranking of job applications, referral partner data, the referral cookie, the affiliated brokerage as a recipient, and a plainer description of what we keep and what we delete.