Privacy Policy

The Company is the "data controller" under the UAE PDPL for personal data processed in connection with the Service. For data we receive from team-account members (e.g. when an agency owner invites a colleague onto their plan), the agency owner and the Company act as joint controllers for that data, and the Company acts as a processor for any client-CRM data the owner uploads.

• Account data: email, name, optional agency, optional phone number, RERA/ORN if you choose to provide it, hashed password, referral code, custom instructions and AI memories you choose to save.
• Service inputs and outputs: the property details, scenarios, photos, voice recordings, PDF/CSV/TXT documents and questions you submit to our tools and chat; the AI outputs we generate for you; conversation history; saved chats, folders, pinned/shared chats, exported markdown.
• CRM and lead data you upload: lead names, contact details, notes, stage, touchpoints, assignments — for use within your account or shared with your team where you enable team mode.
• Payment data: handled by Stripe (UAE-registered payment processor). We never see your full card number; we store only the last four digits, brand, billing email and Stripe customer ID.
• API and widget data: API keys (hashed in our database — plaintext is shown to you only at creation), API usage counters, widget embed events.
• Communication data: messages you send via email, WhatsApp Business, the in-app chat, or our support channels — including phone number and message content.
• Technical and usage data: IP address, user agent, device type, server logs (retained 30 days), generation history, time-saved counter, team activity feed events; optional anonymised analytics via Microsoft Clarity and Google Analytics (with IP anonymisation), and Meta Pixel for advertising attribution.
• Business contact data of UAE real estate professionals — name, agency, business phone, business email — collected from publicly listed professional directories such as Bayut, Property Finder and Dubizzle for the purpose of legitimate B2B introduction (see section 4).

We process personal data on the following lawful bases under UAE PDPL Article 5:

• Performance of contract: to provide the Service you have subscribed to, including AI generation, chat history, CRM, team features, billing and support.
• Consent: where you have given explicit consent — for example, sending you marketing or newsletter emails, drip-campaign onboarding emails, and product-update announcements. You can withdraw consent at any time.
• Legitimate interest: to secure the Service (fraud detection, abuse monitoring); to perform aggregate analytics; to send a one-time business introduction to UAE real-estate professionals using their publicly listed business contact details, balanced against the recipient's right to opt out at any time.
• Legal obligation: tax records (UAE FTA — Federal Tax Authority — requires 7-year retention), AML/CFT obligations, and lawful requests from UAE regulators or courts.

We do not sell, rent or share personal data with third parties for their own marketing purposes.

The Service uses the WhatsApp Business Platform (provided by Meta Platforms, Inc.) to communicate with users and prospective users. Our use complies with the WhatsApp Business Messaging Policy and the WhatsApp Business Solution Terms.

• To existing users: when you sign up and provide a phone number, we may use WhatsApp Business to send account, support, billing and service-related messages, and to deliver promotional codes on request.
• To prospective users (B2B outreach): we may send a one-time business introduction to UAE real-estate professionals using their publicly listed business phone number. Each message identifies the sender, explains the purpose, and includes an opt-out instruction. We do not message the same number more than once unless they reply to engage further.
• Opt-out: reply STOP, UNSUBSCRIBE, REMOVE, or the Arabic توقف at any time. Opt-out is processed immediately and is permanent across all our campaigns.
• Email opt-out: email hello@hades.ae with subject "WhatsApp opt-out".
• No sharing: we do not share, sell, or transfer WhatsApp contact lists or message content to any third party.
• Meta's role: Meta Platforms, Inc. processes messages transmitted through WhatsApp Business subject to its own privacy policies and data-transfer mechanisms.
• Retention: message records and contact identifiers are retained for 24 months for opt-out enforcement, regulatory compliance and audit, then deleted.

Service inputs you submit to our AI tools and chat (and, where applicable, WhatsApp messages routed to our AI assistant) are sent for inference to xAI Corp's API (a US-based AI service provider, see xAI's privacy policy). Per xAI's API terms, API requests are not used to train their models. xAI may retain inference logs for limited operational purposes per its own policy. Please do not submit highly sensitive personal data (Emirates ID numbers, full bank details, passport scans, biometric data) — use placeholders, descriptions or partially-masked values instead.

Some of our processors and sub-processors are based outside the UAE. We transfer personal data internationally only where: (a) the destination provides an adequate level of protection comparable to UAE PDPL standards; or (b) we have appropriate safeguards in place (contractual commitments equivalent to UAE PDPL); or (c) you have explicitly consented to the transfer for a specific purpose.

Current key processors and their locations:

• Stripe — payment processing (Ireland / USA).
• xAI — AI inference (USA).
• Meta / WhatsApp Business — messaging (USA / Ireland).
• Hostinger — application hosting (Netherlands / EU).
• RapidAPI / Bayut metadata API — third-party UAE real-estate data (UAE / USA).
• Google — analytics with IP anonymisation (USA).
• Microsoft Clarity — anonymised session analytics (USA).

We use a small number of cookies and similar technologies: (a) strictly necessary — authentication, session, CSRF protection; (b) preference — language/locale (en/ar), in-app/native-app detection; (c) analytics — anonymised pageview and engagement signals; (d) marketing/attribution — referral source, Meta Pixel attribution where users have visited via an ad.

You may block non-essential cookies through your browser settings. Blocking strictly-necessary cookies will prevent you from logging in.

We share personal data only with the categories of recipients listed below, and only to the extent necessary for the purposes described:

• Processors and sub-processors listed in section 6, under written processing agreements.
• Team members on your team account (only data you share explicitly — chats marked team-searchable, leads with team_owner_id set, shared templates, agency profile).
• Embedded-widget customers — when you embed our chat widget on a website, conversations made by your visitors are returned to you via the API and may be visible in your account's analytics.
• Professional advisers (lawyers, accountants, auditors) under confidentiality obligations.
• UAE regulators, courts or law-enforcement when legally required.
• A successor entity in the event of a merger, acquisition or sale of all or part of the Company's assets — subject to equivalent privacy commitments.

Subject to the conditions of the UAE PDPL, you have the right to:

• be informed about how we process your data (Article 13);
• access your data and request a copy in a structured, machine-readable format (Articles 13, 14);
• request correction of inaccurate or incomplete data (Article 15);
• request deletion of your data where there is no legitimate ground for further processing (Article 16);
• restrict or object to processing in defined circumstances (Articles 17, 18);
• withdraw consent at any time for processing based on consent (Article 6);
• data portability (Article 14);
• lodge a complaint with the UAE Data Office (Article 23).

To exercise any right, email hello@hades.ae. We respond within 30 days (extendable once by a further 30 days where the request is complex, with notice to you).

• Account profile and chat/CRM history: while your account is active. Deleted within 7 days of account closure, subject to any legal retention obligation.
• Generation history: while active. Aggregated statistics retained for analytics.
• API keys: hashed and retained while active; deleted on revocation or account closure.
• Payment records (tax invoices): 7 years (UAE Federal Tax Authority requirement).
• WhatsApp contact records and message logs: 24 months for opt-out enforcement and audit, then deleted.
• Email send logs (email_log): 24 months for deliverability audit and suppression enforcement.
• Server access logs: 30 days.
• Suppression lists (opt-outs and bounces): permanent, for the limited purpose of honouring opt-out.

We apply technical and organisational measures appropriate to the risk, including encryption in transit (TLS), encrypted database at rest, hashed passwords and API keys, role-based access controls, restricted admin access, regular dependency patching, and segmented production network. We notify affected users without undue delay (and the UAE Data Office where required) of any personal-data breach likely to result in a risk to your rights and freedoms.

The Service is a B2B platform intended for licensed UAE real-estate professionals aged 18 or older. It is not directed to anyone under 18 and we do not knowingly collect data from minors. If you believe a minor has provided us personal data, please contact hello@hades.ae so we can delete it.

If you subscribe or provide your email, we may send transactional emails (account, billing, security, support) and — separately — onboarding drip emails (days 1, 3, 7, 14), weekly digests, and product updates. Marketing/onboarding emails include a one-click unsubscribe link and a List-Unsubscribe header. You can also set unsubscribed_marketing = true on your account profile. Transactional emails remain even after unsubscribe because they relate to the service you are paying for.

We may update this Policy from time to time. The "Last updated" date at the top reflects the latest revision. Material changes are notified by email and via an in-app banner. Continued use of the Service after changes constitutes acceptance.

This Policy is governed by the laws of the United Arab Emirates. The courts of Ajman (and the Ajman Free Zone where applicable) have exclusive jurisdiction subject to mandatory consumer-protection forums under Federal Decree-Law No. 15 of 2020.

Data protection enquiries: hello@hades.ae (subject: "PDPL request"). Postal: Hades Trading FZE, Ajman Free Zone, United Arab Emirates.