Privacy Policy
Effective date: 3 October 2026
This policy explains what personal data WAQOV handles, why, who it is shared with, how long it is kept and what your rights are. It follows the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL).
1. Who we are
Dynamic Web Lab FZE LLC (trading as WAQOV) is the controller of the personal data described here.
Business Centre, Sharjah Publishing City Free Zone, Sharjah, United Arab Emirates. Licence No. 4426361.01.
Privacy contact: [email protected] or WhatsApp +971581812436.
WAQOV is an independent service. It is not operated by, affiliated with or endorsed by the Dubai Land Department (DLD).
2. Whose data this covers
- Customers and users who create an account, use the API, the website or the dashboard
- People who contact us by email or WhatsApp
- Licensed real estate brokers listed in the public DLD broker register that the API republishes (section 5)
3. What we collect
| Category | Data | Source |
|---|---|---|
| Account | Email address, name, password (stored as a bcrypt hash), API key (stored as a SHA-256 hash), plan, sign-up date, terms acceptance | You |
| Marketing choice | Whether you agreed to product emails | You (sign-up form, account Settings) |
| Usage and security | API request logs: key id, IP address, endpoint, status, response time, time of request; AI feature usage (provider, model, time) | Our systems |
| Billing | Billing name and email, plan, subscription status. Card details are collected and held by Stripe, never by us | You, Stripe |
| Support | What you write to us by email or WhatsApp | You |
| Website | A sign-in token and, after sign-up, your new API key, kept in your browser's local storage so you stay signed in. No tracking or advertising cookies | Your browser |
| Broker register | Broker name, broker number, office, licence dates, phone and gender as published by DLD | DLD open data |
We do not collect buyer, seller, owner or tenant identities. DLD transaction and Ejari records published as open data do not contain them.
4. Why we use it and our legal basis
| Purpose | Legal basis under the PDPL |
|---|---|
| Creating and running your account, the API and the dashboard | Necessary to perform our contract with you |
| Rate limits, abuse prevention and keeping the service secure | Necessary to perform our contract with you (a secure, available service) |
| Billing, invoices and tax records | Necessary to perform the contract; compliance with UAE law |
| Answering your messages | Necessary to respond to your request |
| Product updates and market insights by email | Your consent, which you can withdraw at any time |
| Publishing the DLD broker register through the API | The data is published as open data by DLD; we republish it for the same purpose, transparency about licensed brokers (section 5) |
We do not sell personal data. We do not make decisions about you based solely on automated processing.
5. Brokers listed in the API
Broker details served by the API (name, broker number, office, licence dates, phone and gender) come from the Dubai Land Department's public broker register, published as open data. Our API policy forbids customers from using them for unsolicited marketing, bulk messaging or cold calling.
If you are a broker and want your entry corrected or removed from WAQOV, email [email protected] or WhatsApp +971581812436 with your broker number. We will correct or remove it within 15 business days. Changes to the official register itself are made with the Dubai Land Department.
6. AI features
- Reports and analysis (market reports, project and transaction analysis) send public market and registry data to our AI providers. They contain no personal data.
- Smart Research sends the question you type to Groq to understand it. Please do not include personal data in questions.
- Descriptions and translations of brokers, buildings and projects are generated by a model running on our own servers.
7. Who we share data with
We use these service providers. Each receives only what it needs for its task.
| Provider | Purpose | Location |
|---|---|---|
| Contabo GmbH | Servers and databases | Germany |
| Cloudflare, Inc. | Network, security and bot protection (Turnstile) | Global network |
| Stripe | Payments and subscriptions | Stripe's global infrastructure |
| Microsoft Azure | Sending account emails | Microsoft cloud |
| Sentry (Functional Software, Inc.) | Error monitoring | EU (Germany) |
| OpenRouter, Google (Gemini), Groq | AI features, as described in section 6 | United States and other regions |
| Telegram | Internal alerts about suspected API abuse (email shown masked) | Telegram's infrastructure |
| WhatsApp (Meta) | Only if you choose to message us there | Meta's infrastructure |
We may also disclose data where UAE law requires it.
8. Transfers outside the UAE
Your data is stored in Germany and some providers above process it in other countries. We transfer personal data abroad only as Articles 22 and 23 of the PDPL allow: to countries with adequate data protection, or otherwise where the transfer is necessary to perform our contract with you or you have consented.
9. How long we keep data
| Data | Kept for |
|---|---|
| Account data | Until you delete your account |
| API request logs and AI usage logs | 90 days, then deleted automatically |
| Error reports | Up to 90 days |
| Billing and payment records | 5 years, as UAE tax and commercial law requires |
| Marketing choice | Until you change it or delete your account |
| Broker register entries | While DLD publishes them, unless the broker asks us to remove them |
10. Your rights
Under the PDPL you can ask us to:
- tell you what personal data we hold and how we use it, and give you a copy
- send your data to you or another provider in a machine-readable format
- correct inaccurate or incomplete data
- delete your data
- restrict or stop processing, including withdrawing marketing consent at any time
How: delete your account, change your password or stop product emails yourself on the Settings page of your dashboard (https://dldapi.waqov.com/account/settings). For anything else, email [email protected] or WhatsApp +971581812436. We acknowledge requests within 5 business days and answer within 30 days. Deleting your account cancels any paid plan first.
11. Security
- Passwords and API keys are stored only as one-way hashes
- All connections use TLS 1.2 or higher
- Access to servers and databases is limited to authorised staff
- Request logs are deleted after 90 days
If a breach puts your personal data at risk, we will notify the UAE Data Office and affected users as the PDPL requires.
12. Children
The service is for businesses and professionals and is not intended for anyone under 18. If we learn that we hold data about a child, we delete it.
13. Changes
We will post changes on this page. If a change materially affects how we use your data, we will also email account holders before it takes effect.
14. Complaints
If you think we have not handled your data lawfully, contact us first at [email protected]. You can also complain to the UAE Data Office.
15. Processing register
Our record of processing activities is published at [/data-processing](/data-processing).