Privacy Policy

Effective: 8 October 2026 · Version 2026-10-08

1. Who we are and what this policy covers

This policy explains how PropTool handles personal data when you use the platform at proptool.org, its mobile application and Telegram bot, and when people visit pages that our users publish. We process personal data in accordance with Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data of the United Arab Emirates and other applicable law.

2. Two roles: your data and your clients' data

2.1 Your account data

For data about you as a user of the platform, we decide how it is used and act as the controller.

2.2 Data in your materials and from your clients

For personal data that you put into your materials or collect through your published pages — for example, clients who leave a request on your storefront — you are the controller and we process the data on your behalf to provide the platform. The Terms of Service set out your obligations for this data. If you visited a broker’s page and want to exercise your rights, contact that broker; if you write to us, we forward the request.

3. Data we collect

3.1 Account and profile

name and email address; your password is handled by Firebase Authentication and we never see it;
if you sign in with Google: the name, email address and photo of your Google account;
details you add to your profile: phone or WhatsApp number, photo, company, position, biography, links;
settings: language, currency, units, theme;
if you belong to an agency: the agency, your role and permissions.

3.2 Your materials

Property records, photos, videos, documents, texts, landing pages, presentations, selections, reports and saved calculations that you create or upload.

3.3 Subscription

Plan, status, billing period and the Whop membership identifier. Card details are collected by Whop and never reach us.

3.4 Acceptance of our documents

When you accept the Terms of Service, the Payment Policy and this Privacy Policy, we record the document version, the date and time, your IP address and your browser’s user agent, as evidence of acceptance.

3.5 Usage and technical data

sign-in sessions: session start and end and a periodic activity signal while you are signed in;
clicks on announcements inside the platform;
error reports from any page, including published pages: page address, error text, browser user agent and IP address;
records of payment events received from Whop.

3.6 Visitors of published pages

When someone opens a page you have published, we record for your statistics:

views and interactions with the page;
a random session identifier kept in the visitor’s browser for 30 minutes;
the domain of the referring site and campaign parameters in the link (for example utm tags);
in selections and on storefronts, reactions to properties, linked to an anonymous identifier kept in the browser.

For this statistics we do not record visitors’ IP addresses, device data or location.

3.7 Requests left by visitors

storefront request form: name, phone number, liked properties, language, and a record of consent with the browser user agent — passed to the broker by email and shown in the broker’s account;
early access form on our website: name, email and phone number.

3.8 Telegram bot

Your Telegram chat identifier and the texts, photos and files you send to the bot to create a guest page.

3.9 Correspondence

Messages you send to support and our replies.

4. How we use data

to provide the platform and the features you use — performance of our agreement with you;
to process subscriptions and payments — performance of the agreement;
to send service emails: email verification, password reset, invitations, notifications about client requests — performance of the agreement;
to keep the platform secure, prevent abuse and fix errors — our legitimate interest;
to show you statistics on your own published materials — performance of the agreement;
to record acceptance of our documents and to comply with the law — legal obligation and legitimate interest.

We do not sell personal data, do not show advertising, do not use advertising trackers and do not make decisions with legal effects about you by automated means. We send marketing emails only with your consent.

5. AI features

When you use an AI feature — writing or translating a description, extracting data from text or a file, generating a document — the text and files you submit are sent to Google through the Gemini API to produce the result. Do not submit personal data of other people to AI features unless the task requires it.

6. Who receives data

We share data only with the services that run the platform, each for its own function:

Google Cloud and Firebase	hosting, sign-in, database, file storage, server functions, verification and password emails
Google Gemini API	AI features: the text and files you submit to them
Whop	subscriptions and payments
Resend	delivery of service emails: invitations and client request notifications
Mapbox	maps in the platform and on published pages; receives the viewer’s IP address
Telegram	the PropTool bot
RapidAPI (Bayut location directory)	location search queries, without personal data
OpenStreetMap Nominatim	address search in the page editor
unpkg	delivery of the PDF viewer library; receives the viewer’s IP address
YouTube, Vimeo, Google Maps	only when a user embeds them in a page; receive the viewer’s IP address and may set their own cookies

Data also becomes available to others in these cases:

pages and files you publish or share are visible to anyone who has the link;
properties you post to Open Market are visible to other users of the platform;
if you belong to an agency, its administrator sees your account data and materials;
authorities, when the law requires it;
a company that takes over the operation of the platform, under this policy.

7. Transfers outside the UAE

Our service providers store and process data outside the United Arab Emirates, including in the United States and in Asia. We use providers that apply contractual and technical safeguards to the data they process for us.

8. How long we keep data

account data — while the account exists;
after a verified request to delete the account — deleted or anonymised within 30 days, except records we must keep: payment records, acceptance records and security records;
property records you delete — kept for a short recovery period, then deleted;
detailed view events on published pages — 180 days; daily view totals — while the account exists;
guest pages created through the Telegram bot and their files — 90 days from creation;
client requests from a storefront — in the broker’s account until the broker deletes the account;
acceptance and payment records — as long as needed to prove acceptance and meet legal obligations;
error reports and activity records — as long as needed for security and troubleshooting.

9. Your rights

Under the law that applies to you, you may:

obtain information about and a copy of the personal data we hold about you;
have inaccurate data corrected;
have your data deleted;
restrict or object to processing, and stop processing based on consent by withdrawing it;
receive your data in a structured format and have it transferred.

Write to support@proptool.org from the email address of your account. We reply within 30 days and may ask you to confirm your identity. You may also lodge a complaint with the UAE Data Office.

10. Cookies and browser storage

Firebase Authentication keeps your sign-in session in the browser’s storage (IndexedDB);
local storage keeps your settings — language, currency, units, theme — and unsaved drafts;
session storage keeps the 30-minute session identifier for page statistics;
on published pages, local storage keeps the anonymous identifier for reactions and a note that a request has been sent;
one cookie remembers the state of the side panel in the agency workspace.

We do not use advertising or analytics cookies from third parties. Embedded content from other services, such as maps and videos, may set its own cookies under those services’ policies. You can clear browser storage at any time; you will then need to sign in again.

11. Security

We use encryption in transit (TLS), database access rules, role-based permissions and request rate limits. No system is fully secure. If a breach affects your personal data, we will notify you and the competent authority as the law requires.

12. Children

The platform is not intended for persons under 18. We do not knowingly collect their data.

13. Changes to this policy

We update this policy when the way we handle data changes. Each version carries an effective date and a version number. When a change affects your rights, we notify you and ask you to accept the new version when you next sign in.

14. Contact

Questions and requests about personal data: support@proptool.org.

Privacy Policy

Effective: 8 October 2026 · Version 2026-10-08

1. Who we are and what this policy covers

2. Two roles: your data and your clients' data

2.1 Your account data

For data about you as a user of the platform, we decide how it is used and act as the controller.

2.2 Data in your materials and from your clients

3. Data we collect

3.1 Account and profile

name and email address; your password is handled by Firebase Authentication and we never see it;
if you sign in with Google: the name, email address and photo of your Google account;
details you add to your profile: phone or WhatsApp number, photo, company, position, biography, links;
settings: language, currency, units, theme;
if you belong to an agency: the agency, your role and permissions.

3.2 Your materials

Property records, photos, videos, documents, texts, landing pages, presentations, selections, reports and saved calculations that you create or upload.

3.3 Subscription

Plan, status, billing period and the Whop membership identifier. Card details are collected by Whop and never reach us.

3.4 Acceptance of our documents

3.5 Usage and technical data

sign-in sessions: session start and end and a periodic activity signal while you are signed in;
clicks on announcements inside the platform;
error reports from any page, including published pages: page address, error text, browser user agent and IP address;
records of payment events received from Whop.

3.6 Visitors of published pages

When someone opens a page you have published, we record for your statistics:

views and interactions with the page;
a random session identifier kept in the visitor’s browser for 30 minutes;
the domain of the referring site and campaign parameters in the link (for example utm tags);
in selections and on storefronts, reactions to properties, linked to an anonymous identifier kept in the browser.

For this statistics we do not record visitors’ IP addresses, device data or location.

3.7 Requests left by visitors

storefront request form: name, phone number, liked properties, language, and a record of consent with the browser user agent — passed to the broker by email and shown in the broker’s account;
early access form on our website: name, email and phone number.

3.8 Telegram bot

Your Telegram chat identifier and the texts, photos and files you send to the bot to create a guest page.

3.9 Correspondence

Messages you send to support and our replies.

4. How we use data

to provide the platform and the features you use — performance of our agreement with you;
to process subscriptions and payments — performance of the agreement;
to send service emails: email verification, password reset, invitations, notifications about client requests — performance of the agreement;
to keep the platform secure, prevent abuse and fix errors — our legitimate interest;
to show you statistics on your own published materials — performance of the agreement;
to record acceptance of our documents and to comply with the law — legal obligation and legitimate interest.

5. AI features

6. Who receives data

We share data only with the services that run the platform, each for its own function:

Google Cloud and Firebase	hosting, sign-in, database, file storage, server functions, verification and password emails
Google Gemini API	AI features: the text and files you submit to them
Whop	subscriptions and payments
Resend	delivery of service emails: invitations and client request notifications
Mapbox	maps in the platform and on published pages; receives the viewer’s IP address
Telegram	the PropTool bot
RapidAPI (Bayut location directory)	location search queries, without personal data
OpenStreetMap Nominatim	address search in the page editor
unpkg	delivery of the PDF viewer library; receives the viewer’s IP address
YouTube, Vimeo, Google Maps	only when a user embeds them in a page; receive the viewer’s IP address and may set their own cookies

Data also becomes available to others in these cases:

pages and files you publish or share are visible to anyone who has the link;
properties you post to Open Market are visible to other users of the platform;
if you belong to an agency, its administrator sees your account data and materials;
authorities, when the law requires it;
a company that takes over the operation of the platform, under this policy.

7. Transfers outside the UAE

8. How long we keep data

account data — while the account exists;
after a verified request to delete the account — deleted or anonymised within 30 days, except records we must keep: payment records, acceptance records and security records;
property records you delete — kept for a short recovery period, then deleted;
detailed view events on published pages — 180 days; daily view totals — while the account exists;
guest pages created through the Telegram bot and their files — 90 days from creation;
client requests from a storefront — in the broker’s account until the broker deletes the account;
acceptance and payment records — as long as needed to prove acceptance and meet legal obligations;
error reports and activity records — as long as needed for security and troubleshooting.

9. Your rights

Under the law that applies to you, you may:

obtain information about and a copy of the personal data we hold about you;
have inaccurate data corrected;
have your data deleted;
restrict or object to processing, and stop processing based on consent by withdrawing it;
receive your data in a structured format and have it transferred.

Write to support@proptool.org from the email address of your account. We reply within 30 days and may ask you to confirm your identity. You may also lodge a complaint with the UAE Data Office.

10. Cookies and browser storage

Firebase Authentication keeps your sign-in session in the browser’s storage (IndexedDB);
local storage keeps your settings — language, currency, units, theme — and unsaved drafts;
session storage keeps the 30-minute session identifier for page statistics;
on published pages, local storage keeps the anonymous identifier for reactions and a note that a request has been sent;
one cookie remembers the state of the side panel in the agency workspace.

11. Security

12. Children

The platform is not intended for persons under 18. We do not knowingly collect their data.

13. Changes to this policy

14. Contact

Questions and requests about personal data: support@proptool.org.