Privacy Policy

Account data: name, email, hashed password.

Profile data you choose to give us: purpose (living/relocating/investing), budget range, timeline, residency status, and optional persona details (household size, bedrooms needed, lifestyle priorities, financing method, risk appetite) used to generate recommendations.

Role-specific data: if you become an Agent, your agency name, license number, bio, coverage areas, and public profile details; if you become a Developer, your company name and listing submissions.

Usage data: pages viewed, searches, and which features you use, so we can improve the Platform and — where relevant — measure whether a safeguard tool (like our handover-competition indicator) is actually helping people.

To operate the Platform: show you research, run your ROI calculations, generate recommendations, and let you manage your account.

To communicate with you: service messages (always sent), and — unless you opt out — updates about Keyva features and relevant third-party real estate offers we think you'd want to know about (our "cross-sell" communications). You can opt out at any time; this never blocks core Platform access.

To improve the Platform: aggregated, and where practical de-identified, analysis of how features are used.

To comply with legal obligations.

The UAE PDPL is built on consent. Unlike some other regimes it does not recognise a general “legitimate interest” basis, so we do not rely on one, and where we have no consent and no specific statutory basis, we do not process.

Consent: you give it when you create an account, and separately when you agree to analytics. You may withdraw either at any time — analytics from the cookie settings page, marketing from Your details — and withdrawal is as easy as giving it. Withdrawing does not affect processing already carried out.

Necessary to perform our contract with you: running the account you asked for, delivering a report you purchased, and sending service messages about it. These are not marketing and cannot be switched off while your account is open.

Necessary to comply with a legal obligation, or to establish, exercise or defend a legal claim.

Public and registered records — Land Department transactions, tenancy registrations, the broker register — are published by government as open data and are not personal data of yours. Where such a record names an individual we publish only what the register itself publishes, and we publish no figure about a named private individual.

With Agents — only if you turn on "Open to agent contact" in your profile, and only your first name until you accept a specific offer from a specific agent; your full name and email are revealed in-app only after you accept, never emailed to the agent directly.

With service providers who process data on our behalf under contract: our hosting provider (Vercel), database provider (Neon), and transactional email provider (Resend). These providers may only use your data to provide their service to us.

With commercial partners for cross-sell purposes — only where you haven't opted out of marketing, and only in aggregate or in a form that doesn't hand over your raw contact details without a separate, specific consent step.

We do not sell your personal data to data brokers.

You have the right to: be informed how your data is used; obtain access to it and a copy in a structured, machine-readable form; have inaccurate data corrected; have your data erased; restrict or object to processing, including for marketing; withdraw consent; and object to an automated decision that produces a legal effect for you.

Two of these you can exercise yourself, immediately, without asking us: marketing can be switched off, and your account can be erased, both from Your details in your profile. We would rather you did not have to write to us for something a button can do.

For anything else, write to us using the details below. We will respond within 30 days. If we decline a request we will tell you why, and you may complain to the UAE Data Office.

Erasing your account removes what identifies you — email, name, phone, location, photo, bio, links and password — and permanently prevents sign-in. It is not reversible.

Two things are deliberately retained, and we would rather say so than surprise you. Where you submitted a property listing, the record that a submission was made and declared is kept: it is evidence about what was published to the public, not information about you, and it no longer carries your name. Where we are required to keep a record for a legal or tax obligation, we keep the minimum for as long as that obligation lasts.

Aggregated statistics that cannot identify anyone are not personal data and are not deleted.

Account and profile data: while your account is open. Analytics events: 24 months. Emails we have sent you: 24 months. Records of a purchased report and its invoice: as long as tax and accounting law requires. Anything else is kept only as long as the purpose that justified collecting it.

Passwords are hashed, not stored in plain text. Access to production data is restricted. No system is perfectly secure, and we can't guarantee absolute security, but we take reasonable technical and organizational measures appropriate to the sensitivity of the data.

Your data is processed outside the UAE. The database is hosted in the United States (AWS US-East-2, Ohio), the application is served from our hosting provider's global network, and email is sent through a third-party provider.

Article 23 of the PDPL permits such a transfer where it is necessary to perform a contract with you, or where you have given explicit consent. Both apply here: the Platform cannot run without hosting, and account creation asks for your agreement to this policy. Each provider acts as our processor under a contract requiring it to process only on our instructions and to protect the data.

If you would rather your data were not processed outside the UAE, do not create an account. The research pages need no account and set no identifier until you agree — that is a real option, not a formality.

The Platform isn't directed at anyone under 18, and we don't knowingly collect data from them.

We ask before we count you. Until you answer, no identifier is created and no page view is recorded — ignoring the banner is a no, not a yes.

If you agree, we store a random identifier for your browser so that returning next week reads as one person rather than two, and we record which pages you opened, roughly how long you stayed, and the website you arrived from (its name only, never the search terms that brought you). The identifier is generated at random. It is not derived from your name, your email, your device, or your IP address, and it is not sold or shared with advertisers.

We use this to decide what to write next and to see which tools are actually used. If you are signed in when you agree, a page view is also tagged with your account id, so that signed-in use can be told apart from anonymous traffic. We report on it only in aggregate, and we do not use it to build a profile of you as a person or to decide what to show you.

If you say no, the site behaves exactly the same. Nothing is withheld, and any identifier previously stored in your browser is deleted at that moment rather than merely ignored.

Your answer is remembered in a single cookie holding one word — "granted" or "denied" — for six months, after which we ask again. That cookie is necessary to honour your choice without asking on every page. You can change your mind at any time on this page.

Signing in sets a session cookie, which is required for the site to know you are signed in and cannot be declined while you remain signed in.

We'll update the version number and effective date here when this policy changes, and ask for renewed consent where the change is material.

Privacy questions or rights requests: privacy@dubaikeyva.com [contact address to be confirmed].