Compliance: UAE Federal Decree-Law No. 45 of 2021 (PDPL), Art. 22
Effective Date: July 2026
Controller: WAQOV (anomalyco)
Contact: [email protected]
Data Protection Contact: [email protected]
---
| Field | Detail |
|---|---|
| Purpose | Create and manage user accounts for API access |
| Personal Data | Email address, name, API key (SHA-256 hash) |
| Data Subjects | API users (developers, businesses) |
| Lawful Basis | Contractual necessity (Art. 4(1)) |
| Storage Location | Germany (EU) — Hetzner Online GmbH |
| Retention | Until account deletion |
| Security | SHA-256 hashing, TLS 1.3, access controls |
| Recipients | None (data not shared) |
| Field | Detail |
|---|---|
| Purpose | Rate limiting, abuse detection, analytics |
| Personal Data | IP address, user agent, request timestamp, endpoint accessed |
| Data Subjects | API users |
| Lawful Basis | Legitimate interest (Art. 4(3)) — service security and integrity |
| Storage Location | Germany (EU) — Hetzner Online GmbH |
| Retention | 90 days (automatic deletion) |
| Security | Encrypted at rest, restricted database access |
| Recipients | None |
| Field | Detail |
|---|---|
| Purpose | Send product updates and market insights |
| Personal Data | Email address |
| Data Subjects | Users who provided explicit consent |
| Lawful Basis | Consent (Art. 4(2)) — optional opt-in at signup |
| Storage Location | Germany (EU) — Hetzner Online GmbH |
| Retention | Until consent withdrawn or account deleted |
| Security | Encrypted storage, restricted access |
| Recipients | None |
| Opt-out | Email [email protected] or delete account |
| Field | Detail |
|---|---|
| Purpose | Process subscription payments |
| Personal Data | Billing name, email (payment card details handled by processor) |
| Data Subjects | Paid plan subscribers |
| Lawful Basis | Contractual necessity (Art. 4(1)) |
| Storage Location | Processed by payment provider (Stripe) |
| Retention | 5 years (UAE legal requirement) |
| Security | PCI-DSS compliant processor |
| Recipients | Stripe (payment processor) |
| Field | Detail |
|---|---|
| Purpose | Provide AI-powered property analysis, market reports |
| Personal Data | None — AI processes property data only (no PII) |
| Data Subjects | N/A |
| Lawful Basis | N/A |
| Storage Location | AI processing: external AI providers (OpenRouter, Google Gemini) — no personal data is sent, only public DLD registry/market data |
| Retention | N/A |
| Security | Free-text endpoints (research, pitch) use Google Gemini with user input; all prompts audited to contain no broker/owner/tenant/email/phone/national-ID data |
| Recipients | OpenRouter, Google (AI providers — receive only non-personal registry/market data) |
---
A DPIA has been conducted for all processing activities. Key findings:
Under the UAE PDPL (Federal Decree-Law No. 45 of 2021), data subjects have the following rights regarding their personal data:
| Right | Description | How to Exercise |
|---|---|---|
| Right of Access | Request a copy of all personal data we hold about you | Email [email protected] |
| Right to Rectification | Request correction of inaccurate or incomplete personal data | Email [email protected] |
| Right to Erasure | Request deletion of your personal data (subject to legal retention obligations) | Email [email protected] or delete account via dashboard |
| Right to Data Portability | Request your personal data in a structured, machine-readable format | Email [email protected] |
| Right to Withdraw Consent | Withdraw consent for marketing communications at any time | Email [email protected] or unsubscribe link |
| Right to Object | Object to processing based on legitimate interest | Email [email protected] |
Response timeline: We will acknowledge requests within 48 hours and provide a substantive response within 30 calendar days, in accordance with PDPL requirements.
Data Protection Officer: For data protection inquiries, contact [email protected].
This register is reviewed quarterly. Last review: July 2026.