Privacy Policy

1. Introduction

Welcome to TenancyDesk ("we," "our," or "us"). We are committed to protecting your privacy and ensuring the security of your personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our tenancy operations and compliance platform and related services (the "Service").

TenancyDesk is a B2B SaaS platform designed for property management companies, real estate agencies, and property professionals in the United Arab Emirates. We process data on behalf of our business customers and their clients (tenants, property owners).

This Privacy Policy describes how we handle your personal data. We process most data based on contractual necessity and legitimate interests (see Section 5). Where we rely on consent, we will obtain it separately and explicitly.

2. Data Controller

For the purposes of UAE Federal Decree Law No. 45/2021 on Personal Data Protection (PDPL) and other applicable data protection laws, the data controller is the operator of TenancyDesk.

When processing personal data on behalf of our business customers (property management companies), we act as a "Data Processor." Our customers remain the "Data Controllers" for their client data.

A Data Processing Agreement is available on request; contact privacy@tenancydesk.com.

If you are a tenant or property owner whose data is managed through our platform by a property management company, that company is the data controller for your information. Please contact them directly for data protection requests related to their use of your data.

3. Data We Collect

We collect and process different categories of personal data depending on your relationship with us:

3.1 Account Information

When you register for TenancyDesk, we collect:

• Your name, email address and, optionally, phone number; your company name, its primary emirate and, optionally, its trade licence number
• Login credentials: password stored only as a salted one-way hash (it cannot be read back, even by us)

3.2 Property & Transaction Data

In the course of using our Service, you may input:

• Property details (addresses, unit numbers, descriptions)
• Owner information (names, contact details)
• Tenant information (names, Emirates ID numbers, passport details, contact information)
• Lease terms and rental agreements
• Payment schedules and transaction records

3.3 Document Data

Our AI-powered document extraction feature processes:

• Emirates ID cards
• Passports and visas
• Tenancy contracts
• Title deeds and property documents
• Ejari certificates

Important: documents you upload are stored in your account so they remain available for your deals and compliance records, and we extract text data from them for the features you use. Uploaded images are not discarded after extraction. They stay in your workspace until you delete them or ask us to delete your company's data (see Data Retention).

3.4 Usage Data

We automatically collect:

• Log data (IP address, browser type, device information)
• Feature usage patterns and interactions
• Performance metrics and error logs
• Session duration and navigation paths

3.5 Communication Data

When you use our WhatsApp notification feature:

• Phone numbers of message recipients
• Message content and delivery status
• Communication timestamps

WhatsApp notifications are sent via Meta's WhatsApp Business API. Recipients must opt-in to receive notifications. Meta may process message metadata in accordance with their own privacy policy. WhatsApp Business API messages are not end-to-end encrypted in the same manner as personal WhatsApp messages.

3.6 Sensitive Personal Data

Our Service processes government-issued identification numbers and identity-document images. Under the UAE PDPL, "Sensitive Personal Data" is a specific category defined in Article 1; government-issued identification numbers and identity-document images fall outside that statutory category and are treated as high-risk Personal Data. Regardless of the label, we apply enhanced safeguards to this data:

• Access restricted to authorized personnel only
• Encryption at rest via AWS storage-layer encryption (AES-256) and in transit (TLS 1.2+)
• Identity numbers (Emirates ID, passport, trade licence) additionally encrypted at the application layer before they are stored
• Identity-document images are deleted when you delete them in the workspace, or with your company's data when you ask us to delete it
• Processing only when strictly necessary for the service you have requested

4. How We Use Your Data

We process your personal data for the following purposes:

4.1 Service Delivery

• Providing access to the TenancyDesk platform
• Processing property and tenancy transactions
• Generating documents, reports, and analytics
• Facilitating Ejari preparation and compliance tracking
• Sending notifications and reminders via email or WhatsApp

4.2 AI-Powered Processing

• Extracting information from uploaded documents
• Auto-classifying documents by type
• Analyzing contract terms for compliance risks

Your data is NOT used to train AI models. OpenRouter, Inc. (USA) routes AI requests for document reading, contract review and the compliance assistant to model providers such as Google. Every request is restricted to providers that neither store nor train on the data (zero data retention). Document data is transmitted via encrypted channels.

4.3 Compliance & Security

• UAE regulatory compliance (RERA, DLD, Ejari)
• Fraud prevention and security monitoring
• Audit trail maintenance
• Legal obligation compliance

4.4 Service Improvement

• Analyzing usage patterns to enhance features
• Developing new functionality based on user needs
• Conducting research and analytics

4.5 Communication

• Customer support and technical assistance
• Service updates and announcements

5. Legal Basis for Processing

Under UAE PDPL and applicable data protection laws, we process your data based on:

Where we rely on legitimate interest, we conduct a balancing test to ensure our interests do not override your rights and freedoms. You may request details of our legitimate interest assessments by contacting us.

6. Data Sharing & Third Parties

We may share your personal data with the following categories of recipients:

6.1 Service Providers

• Cloud Infrastructure & Email: Amazon Web Services (AWS) for hosting, storage, and email delivery via Amazon SES (eu-central-1, Frankfurt)
• Payment Processing (Merchant of Record): Paddle.com Market Limited as Merchant of Record for subscription billing, payment processing, and tax collection
• WhatsApp Messaging: Meta Platforms (WhatsApp Business API) for WhatsApp Business messaging
• AI Processing: OpenRouter, Inc. (USA) routes AI requests for document reading, contract review and the compliance assistant to model providers such as Google. Every request is restricted to providers that neither store nor train on the data (zero data retention).
• SMS: Twilio for SMS notifications
• Network & Security: Cloudflare for DNS, CDN, and web application firewall (WAF)
• Error Monitoring: Sentry for application error tracking and performance monitoring
• Email Failover: Resend as a backup email-delivery provider

We maintain an up-to-date list of sub-processors on this page. We will notify business customers in advance of material sub-processor changes where commercially reasonable, providing them the opportunity to object.

6.2 Business Customers

When acting as a data processor, we only process customer data according to their instructions and our Data Processing Agreement (DPA). Our business customers are the data controllers for their client information and are responsible for obtaining necessary consents from their clients.

6.3 Legal Requirements

We may disclose data when required to:

• Comply with UAE laws and regulations
• Respond to lawful requests from public authorities
• Protect our rights, privacy, safety, or property
• Enforce our terms of service

6.4 Business Transfers

In the event of a merger, acquisition, or sale of assets, your data may be transferred to the acquiring entity with appropriate safeguards.

7. International Data Transfers

TenancyDesk processes data on AWS managed cloud infrastructure with documented data flows. Some data is transferred to our service providers in other jurisdictions as detailed below.

When data is transferred outside the UAE, we rely on the safeguards permitted by UAE PDPL Articles 22-23:

• Where the recipient jurisdiction has been designated as providing an adequate level of protection, we rely on that designation (PDPL Article 22)
• Otherwise, we rely on a contract that binds the recipient to obligations equivalent to the PDPL, or on your explicit consent, as permitted by PDPL Article 23
• Appropriate technical and organizational measures are implemented for every transfer
• Each transfer is assessed and documented before it begins

Transfers to providers outside the UAE are made on a basis permitted by UAE PDPL Articles 22-23 - an adequacy designation where one applies, otherwise a contract binding the recipient to obligations equivalent to the PDPL, or your explicit consent. These are supported by supplementary technical safeguards including encryption in transit (TLS 1.2+) and at rest (AES-256). We assess the legal framework of recipient countries on a risk basis and apply additional measures where necessary.

8. Data Retention

We retain your personal data for as long as necessary to fulfill the purposes outlined in this policy. Targets below are implemented to the extent technically feasible at our current operational scale; where automated deletion is not yet in place, we delete manually on request.

When a subscription ends, the workspace is suspended, not deleted. You can ask us to delete your company's data by writing to privacy@tenancydesk.com; we complete the deletion within 30 days of your request. We keep only the records the law requires us to keep about our own business — our invoices and accounting records, for at least 5 years (Federal Decree-Law No. 50 of 2022, Article 29).

Records you keep in TenancyDesk may carry retention duties of their own — for example, customer due-diligence records for at least 5 years under Federal Decree-Law No. 10 of 2025 — so export what you need before you ask us to delete.

9. Your Rights

Under UAE PDPL and applicable data protection laws, you have the following rights:

9.1 Right to Access

You can request a copy of the personal data we hold about you.

9.2 Right to Rectification

You can request correction of inaccurate or incomplete data.

9.3 Right to Erasure

You can request deletion of your data. Exceptions include data we are required to retain by law (e.g., transaction records under UAE Commercial Transactions Law), data necessary for ongoing dispute resolution, or data needed to fulfill our contractual obligations.

9.4 Right to Restrict Processing

You can request limitation of how we process your data.

9.5 Right to Data Portability

You can receive your data in a structured, machine-readable format.

9.6 Right to Object

You can object to processing based on legitimate interests.

9.7 Right to Withdraw Consent

Where processing is based on consent, you can withdraw it at any time.

9.8 Rights Related to Automated Processing

You have the right not to be subject to decisions based solely on automated processing that produce significant effects. Our AI features assist in data extraction and analysis but do not make autonomous decisions about your tenancy or legal rights.

To exercise your rights, contact us at privacy@tenancydesk.com. We will respond within a reasonable timeframe as required by applicable law. To verify your identity, we may request additional information. If you are a tenant or property owner whose data is managed by one of our business customers, we may redirect your request to the appropriate data controller. You may also lodge a complaint with the UAE Data Office.

10. Security Measures

We implement comprehensive security measures to protect your data:

Technical Safeguards

• AES-256 encryption for data at rest (AWS managed)
• TLS 1.2+ encryption for data in transit
• Multi-factor authentication (MFA) support
• Continuous automated vulnerability scanning (Dependabot, pip-audit, npm-audit)
• Security audits on a risk-based cadence
• Secure development practices and code review

Organizational Safeguards

• Role-based access control (RBAC) across all user accounts
• Principle of least privilege for system access
• Audit logging for sensitive data access and administrative actions

Infrastructure Security

• AWS data centers with ISO 27001 certification (eu-central-1, Frankfurt)
• Single-region hosting with automated backups
• Continuous infrastructure monitoring (CloudWatch)
• DDoS protection via AWS Shield Standard

11. Data Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the UAE Data Office - and, where required, the affected individuals - without undue delay and within any period set by the UAE PDPL (Federal Decree-Law No. 45/2021) and its Executive Regulations.

As an internal operational target - not a statutory deadline - we aim to notify the Data Office within 72 hours of becoming aware of a breach. Our notification will describe the nature of the breach, its likely consequences, and the measures taken to address it and mitigate its effects.

12. Cookies & Tracking Technologies

We use one cookie and your browser's local storage, only for what the Service needs to work. For details, see our Cookie Policy, which is incorporated by reference into this Privacy Policy: Cookie Policy.

In summary, we use:

• Essential cookie: Keeps clients signed in to the tenant and owner portals
• Local storage: Keeps agency staff signed in and remembers language and layout preferences
• Analytics and advertising: We do not use analytics or advertising cookies

13. Children's Privacy

TenancyDesk is a B2B service intended for business use only. We do not knowingly collect personal data from individuals under 18 years of age. If you believe we have collected data from a minor, please contact us immediately at privacy@tenancydesk.com.

14. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last Updated" date. For significant changes, we will notify you via email or in-app notification.

We encourage you to review this policy periodically to stay informed about how we protect your data.

15. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us:

You also have the right to lodge a complaint with the UAE Data Office (dataoffice.ae) if you believe your data protection rights have been violated.