Privacy Policy

1. Information We Collect

We collect data necessary to operate TheBrokers platform and deliver our services to brokerages and their authorised team members.

Account and Organisation Data

• Name, work email address, and phone number provided during registration or invitation.
• Organisation name, RERA licence number, trade licence number, and brokerage details.
• Role and permissions within your organisation (e.g., Admin, Agent, Manager).
• Profile photograph if uploaded voluntarily.

Client and Property Data

• Client contact information entered or imported by your brokerage, including names, phone numbers, email addresses, and nationality.
• Property records including unit numbers, project names, developer details, purchase prices, payment schedules, and handover dates.
• Off-plan investment data: payment milestones, SPA details, EOI records, and lifecycle stage.
• Lease agreements, renewal dates, rent amounts, and tenant correspondence.
• Documents uploaded to the platform such as SPAs, NOCs, title deeds, and passport copies.

AI and Interaction Data

• Lead scoring inputs: interaction history, response patterns, and engagement signals used to generate AI lead scores.
• WhatsApp message content sent or received through TheBrokers WhatsApp Business API integration, where your brokerage has enabled this feature.
• Content generated using TheBrokers AI tools (listing descriptions, social media posts, follow-up messages).
• Queries submitted to the AI Assistant feature.

Usage and Technical Data

• Log data including IP addresses, browser type, operating system, pages visited, and timestamps.
• Session and navigation data collected via server-side analytics.
• Device identifiers and approximate geolocation (country/city level) derived from IP address.
• Feature usage patterns to improve platform performance and prioritise development.

2. How We Use Your Information

Service Delivery

We use your data to operate TheBrokers platform: managing your CRM pipeline, tracking payment schedules, generating client portal access, processing document storage, and coordinating notifications and reminders on your behalf.

AI Processing and Automation

TheBrokers uses AI to provide lead scoring, client matching, content generation, and predictive payment tracking. Client and interaction data is processed by our AI systems to produce these outputs. AI-generated actions (such as WhatsApp messages or viewing confirmations) require explicit approval from an authorised user before sending. No automated decisions with legal or significant financial consequence are made without human review.

Communications

• Sending transactional emails such as account invitations, payment reminders, and system alerts.
• Delivering WhatsApp notifications where you have enabled the WhatsApp integration and obtained consent from the relevant recipient.
• Sending product updates, feature announcements, and important service notices to registered administrators.

Platform Improvement

Aggregated, anonymised usage data is used to identify performance issues, improve features, and understand how the platform is used across different brokerage segments. We do not sell individual usage data to third parties.

Legal and Compliance

We may process and retain data to comply with applicable UAE laws, respond to lawful requests from regulatory authorities, enforce our Terms of Service, and protect the rights, property, or safety of TheBrokers, its customers, or third parties.

3. Data Storage and Security

All TheBrokers platform data is stored in encrypted cloud databases hosted on infrastructure that meets international security standards. We implement the following protections:

• Encryption at rest (AES-256) and in transit (TLS 1.2 or higher) for all data.
• Row-level security (RLS) enforced at the database layer, ensuring that users can only access data belonging to their own organisation.
• Multi-tenant isolation: each brokerage's data is logically separated and inaccessible to other tenants on the platform.
• Role-based access control (RBAC) limiting data access to authorised personnel within your organisation.
• Regular automated backups with point-in-time recovery capability.
• Security monitoring, anomaly detection, and incident response procedures.

While we apply rigorous security measures, no system is completely immune to risk. In the event of a data breach that affects your personal data, we will notify affected parties in accordance with applicable UAE regulatory requirements.

4. UAE Data Protection

TheBrokers is incorporated and operates in the United Arab Emirates. We process personal data in compliance with UAE data protection legislation, including:

• UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL), which governs the collection, processing, and transfer of personal data of individuals within the UAE.
• DIFC Data Protection Law (DIFC Law No. 5 of 2020, as amended), applicable to any processing activities within the Dubai International Financial Centre.
• Relevant provisions of UAE Federal Law No. 2 of 2019 on the Use of Information and Communication Technology in Health Fields (where applicable to health data incidentally processed).

Legal Basis for Processing

We process personal data on the following legal grounds: (a) performance of a contract — processing is necessary to provide TheBrokers service you have subscribed to; (b) legitimate interests — processing for fraud prevention, platform security, and service improvement where these interests are not overridden by your rights; (c) legal obligation — processing required by applicable UAE law or regulatory authority; and (d) consent — where you have given explicit consent, such as for optional communications or AI processing of WhatsApp messages.

Cross-Border Data Transfers

Some of our infrastructure and third-party service providers operate outside the UAE. Where personal data is transferred internationally, we ensure adequate protections are in place through contractual arrangements, including standard data processing agreements that reflect UAE PDPL requirements. We do not transfer personal data to jurisdictions without adequate data protection frameworks without implementing appropriate safeguards.

5. Third-Party Services

TheBrokers integrates with third-party services to provide platform functionality. Each provider processes data under its own terms and privacy policy. The primary third-party services we use are:

Supabase (Database and Authentication Hosting)

Supabase provides our core database infrastructure, authentication services, and file storage. Your organisation's data — including client records, property data, and documents — is stored on Supabase-hosted infrastructure. Supabase operates in compliance with GDPR and maintains SOC 2 Type II certification. Data is stored in the region selected during your account setup.

WhatsApp Business API (Meta)

Where your brokerage has enabled WhatsApp messaging, message content and recipient phone numbers are transmitted through the WhatsApp Business API operated by Meta Platforms, Inc. You are responsible for ensuring that WhatsApp communication with your clients complies with applicable messaging consent requirements and Meta's Business Policy. TheBrokers does not store message content beyond what is required to display conversation history within the platform.

Google Calendar

If you connect a Google account to TheBrokers for viewing scheduling or calendar synchronisation, TheBrokers will access your Google Calendar data solely to create, update, and retrieve events on your behalf. We do not read or store calendar data beyond what is needed for scheduling functionality. You may revoke this access at any time through your Google account settings or TheBrokers integrations page.

Email Delivery

Transactional emails (invitations, reminders, notifications) are delivered via a third-party email infrastructure provider. Recipient email addresses and message content are transmitted to this provider for delivery purposes only and are not used for any other purpose.

We do not sell your data — or your clients' data — to any third party. We do not permit our service providers to use your data for their own commercial purposes.

6. Data Retention

We retain personal data for as long as your organisation's subscription is active and for a reasonable period thereafter to allow for account recovery, dispute resolution, and legal compliance. Specific retention practices are as follows:

• Active account data (user profiles, client records, property data) is retained for the duration of your subscription.
• After subscription termination, data is retained for a maximum of 90 days in a recoverable state to allow for reactivation or export requests.
• Following the 90-day period, data is permanently deleted from production systems, with backup deletion completed within a further 30 days.
• Data subject to a legal hold or regulatory investigation will be retained until the hold is lifted, regardless of subscription status.
• Aggregated, anonymised analytics data that cannot identify individuals or organisations may be retained indefinitely for platform improvement purposes.
• Audit logs (access records, permission changes, document events) are retained for 12 months to support security investigations.

You may request early deletion of your data at any time by contacting us through the platform. Data deletion requests will be processed within 30 days, subject to any legal retention obligations.

7. Your Rights

Depending on your location and the applicable data protection law, you may have the following rights in relation to your personal data:

Right of Access

You may request a copy of the personal data we hold about you. We will provide this in a structured, commonly used format within 30 days of receiving a verified request.

Right to Correction

If any personal data we hold about you is inaccurate or incomplete, you have the right to request correction. Many data fields can be updated directly through your account profile or by your organisation's administrator.

Right to Deletion

You may request deletion of your personal data. Where we are legally required to retain certain data, we will inform you of the applicable retention period and delete all other data promptly.

Right to Data Portability

You may request an export of your organisation's data in machine-readable format (CSV or JSON). This includes client records, property data, and payment schedules. Export functionality is available directly within the platform for administrators, or by request via our support team.

Right to Restrict Processing

You may request that we restrict the processing of your personal data in certain circumstances — for example, while a correction request is being resolved, or where you contest the legal basis for processing.

Right to Object

Where we process data on the basis of legitimate interests, you have the right to object. We will cease such processing unless we can demonstrate compelling legitimate grounds that override your interests, or unless the processing is required for legal claims.

8. Cookies and Tracking

TheBrokers uses essential cookies and session tokens to operate the platform. These are strictly necessary for authentication, maintaining your session state, and security. We do not use third-party advertising cookies or cross-site tracking technologies.

The following categories of cookies are used on TheBrokers platform:

• Session cookies: temporary cookies used to maintain your authenticated session. These are deleted when you close your browser.
• Persistent authentication tokens: stored securely in your browser to keep you signed in between sessions, if you choose "remember me". These expire after 30 days of inactivity.
• Preference cookies: used to remember your in-app settings such as language, table column visibility, and display preferences.

For full details on how we use cookies, including how to manage your cookie preferences, please refer to our Cookie Policy.

9. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. When we make material changes, we will notify registered administrators by email and display a notice within TheBrokers platform at least 14 days before the changes take effect.

The "Last updated" date at the top of this page indicates when this policy was most recently revised. Continued use of the platform after the effective date of any changes constitutes your acceptance of the revised policy. If you do not agree to the updated terms, you should discontinue use of the platform and contact us to request data deletion.

Previous versions of this Privacy Policy are available upon request.

10. Contact Information

If you are not satisfied with our response, you have the right to lodge a complaint with the UAE Personal Data Protection Office or the relevant supervisory authority in your jurisdiction (such as the DIFC Commissioner of Data Protection for matters arising within the DIFC).