Controller: Dynamic Web Lab FZE LLC (trading as WAQOV), Sharjah Publishing City Free Zone, UAE. Licence No. 4426361.01
Contact: [email protected]
Law: UAE Federal Decree-Law No. 45 of 2021 (PDPL)
Last reviewed: 3 October 2026
The Privacy Policy at [/privacy](/privacy) explains these activities in plain language.
1. Accounts and access
| Field | Detail |
|---|
| Purpose | Create and run accounts for the API, website and dashboard |
| Data subjects | Customers and users |
| Personal data | Email, name, password hash (bcrypt), API key hash (SHA-256), plan, sign-up date, terms acceptance |
| Legal basis | Necessary to perform the contract |
| Storage | Contabo GmbH, Germany |
| Retention | Until the account is deleted |
| Recipients | Microsoft Azure (account emails) |
2. Request logs and abuse prevention
| Field | Detail |
|---|
| Purpose | Rate limits, quotas, abuse detection, service security |
| Data subjects | API users |
| Personal data | Key id, IP address, endpoint, status, response time, time of request |
| Legal basis | Necessary to perform the contract (secure, available service) |
| Storage | Contabo GmbH, Germany |
| Retention | 90 days, deleted automatically every day |
| Recipients | Telegram (abuse alerts to our staff; email masked) |
3. Billing
| Field | Detail |
|---|
| Purpose | Paid subscriptions and invoices |
| Data subjects | Paying customers |
| Personal data | Billing name and email, plan, subscription status. Card data is held by Stripe only |
| Legal basis | Necessary to perform the contract; legal obligation (records) |
| Storage | Stripe; account record at Contabo, Germany |
| Retention | 5 years |
| Recipients | Stripe |
4. Marketing emails
| Field | Detail |
|---|
| Purpose | Product updates and market insights |
| Data subjects | Users who opted in |
| Personal data | Email, consent choice |
| Legal basis | Consent, withdrawable in account Settings |
| Storage | Contabo GmbH, Germany |
| Retention | Until consent is withdrawn or the account is deleted |
| Recipients | Microsoft Azure (email delivery) |
5. Support
| Field | Detail |
|---|
| Purpose | Answer questions and requests |
| Data subjects | Anyone who contacts us |
| Personal data | Contact details and message content |
| Legal basis | Necessary to respond to the request |
| Channels | Email, WhatsApp (Meta) |
| Retention | As long as needed to handle the request |
6. DLD broker register (republication)
| Field | Detail |
|---|
| Purpose | Republish the public register of licensed brokers through the API |
| Data subjects | Licensed real estate brokers |
| Personal data | Name, broker number, office, licence dates, phone, gender |
| Source | Dubai Land Department open data |
| Legal basis | Open data published by DLD, republished for the same purpose |
| Safeguards | Use for unsolicited marketing is forbidden in the API policy; correction or removal on request within 15 business days |
| Retention | While published by DLD, unless removal is requested |
7. AI features
| Field | Detail |
|---|
| Purpose | Market reports, analysis, Smart Research |
| Personal data | None in reports and analysis. Smart Research sends the user's typed question, which users are asked not to fill with personal data |
| Recipients | OpenRouter, Google (Gemini), Groq; broker, building and project descriptions are generated on our own servers |
8. Error monitoring
| Field | Detail |
|---|
| Purpose | Find and fix errors |
| Personal data | Technical error details. Sentry's default of not collecting IP addresses or other personal data is kept |
| Recipient | Sentry, EU (Germany) |
| Retention | Up to 90 days |
Cross-border transfers
Data is stored in Germany. Transfers to the providers above follow PDPL Articles 22 and 23: to countries with adequate protection, or where necessary to perform the contract or with consent.
Risk assessment
Reviewed 3 October 2026. Personal data is limited to account, billing and usage data of business users and the public broker register. No sensitive personal data is processed. Main controls: hashed credentials, TLS, restricted server access, 90-day log deletion, masked emails in alerts, and broker removal on request.