Privacy Policy

This Privacy Policy is issued by HomeHub Portal, trading as HomeHub, a sole establishment licensed on the Dubai mainland by the Dubai Department of Economy and Tourism under trade licence number 1629357, with its registered address at P.O. Box 70834, Dubai, United Arab Emirates ("HomeHub", "we", "us"). It is written to align with Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the "PDPL") and applies to the personal data we handle in operating the HomeHub website and the HomeHub service across all seven emirates of the United Arab Emirates.

HomeHub does not claim any certification or approval under the PDPL. No certification scheme currently exists. This Policy describes what we actually do.

1Definitions

1.1"Customer" means the licensed real estate broker or brokerage that holds a HomeHub account and submits Listing Content to us.

1.2"Kit" means the bilingual marketing kit we produce for one property listing: a portal listing description formatted for Property Finder and Bayut, an Instagram carousel with captions, a reel or TikTok script with a shotlist, story frames, a print ready PDF brochure and a WhatsApp broadcast message, in English and Arabic.

1.3"Listing Content" means everything a Customer submits to us for the production of a Kit: the unstructured text describing the property and the batch of photographs of the property, together with the advertising permit number, broker registration number (BRN), brokerage registration number (ORN), registered telephone number and any other particulars the Customer supplies for inclusion on the Kit.

1.4"Account Data" means the personal data described in clause 3.

1.5"Incidental Personal Data" means the personal data described in clause 4.

1.6"UAE Data Office" means the federal data protection authority established by Federal Decree-Law No. 44 of 2021.

2The two roles we hold

2.1The PDPL distinguishes between a controller, who decides why and how personal data is processed, and a processor, who processes personal data on a controller's instructions. HomeHub holds both roles at the same time, for different data, and this Policy is split accordingly.

2.2HomeHub as controller. We are the controller of Account Data. We decide why and how it is processed, for the purposes set out in clause 6.

2.3HomeHub as processor. We are a processor of the personal data contained in Listing Content, including all Incidental Personal Data. For that data the Customer is the controller. We process it only to produce and deliver the Kit for that Customer, on the documented instructions constituted by our Terms of Service and the Customer's act of submitting the listing. The Customer, as the controller of Listing Content, is responsible for ensuring it has the right to submit that data to us and to publish the resulting Kit. Our Data Processing Addendum with each Customer governs that relationship in detail.

2.4A Customer's own name, BRN, ORN, telephone number and email address can fall under both roles depending on the purpose. When we use them to run the Customer's account, bill it and support it, we act as controller. When we reproduce them onto the Kit assets in the manner the Real Estate Regulatory Agency requires, we act as processor on the Customer's instruction.

2.5This Policy is a notice. It is not the contract between HomeHub and a Customer. Where we process personal data as processor, the Data Processing Addendum accepted by the Customer governs that processing, and if any period or commitment stated in this Policy differs from the Data Processing Addendum, the Data Processing Addendum applies as between HomeHub and that Customer.

2.6This Policy applies to the free first Kit, produced without charge and without a payment card, in the same way as it applies to Kits produced under a paid plan.

3Account Data we collect as controller

3.1We collect the following categories of Account Data:

(a)Identity and licensing data. The Customer entity's legal name and trade licence number, its ORN, and for each individual user the name, job title, BRN and RERA registered telephone number.

(b)Contact data. Business email address, business telephone number and business address.

(c)Billing data. Plan selected, billing frequency, invoices, payment status and the limited card metadata our payment service provider passes back to us (such as card brand and last four digits). Full card numbers are collected and processed by the payment service provider identified at checkout and never touch our systems.

(d)Contract and acceptance records. The version of the Terms of Service and Data Processing Addendum accepted, the identity of the accepting user, the date, time and IP address of acceptance, and the Customer's per-asset approval records.

(e)Usage and technical data. Log data generated when the website and service are used, including IP address, browser type, pages viewed and timestamps.

(f)Support correspondence. Emails and messages exchanged with us.

3.2We collect Account Data directly from the Customer and its users. We may check BRN and ORN details against the public registers published by the Dubai Land Department, or the equivalent public records of another emirate where those exist, and where we carry out that check we record the fact and date of it. We are not obliged to perform the check, and performing it does not transfer to us any responsibility that the Terms of Service place on the Customer.

4Personal data inside Listing Content, including Incidental Personal Data

4.1This clause is the most important part of this Policy, and we state it plainly. Property photographs and pasted listing text routinely contain personal data about people who have no relationship with HomeHub and may not know their data has been submitted.

4.2Listing Content may contain:

(a)Identifiable people in photographs. Occupants, tenants, domestic staff, children, neighbours on balconies or in windows, passers-by, and faces visible in mirrors, reflections, framed photographs or screens.

(b)Vehicles and number plates. A readable vehicle number plate is treated by us as personal data.

(c)Neighbouring property. Interiors or exteriors of properties other than the advertised property.

(d)Seller, landlord and owner details in pasted text. Names, telephone numbers, sale motivations, price expectations and similar details that a Customer pastes into the listing text, sometimes without noticing.

(e)The Customer's own broker details supplied for reproduction on the Kit assets.

4.3We process this data as a processor, on the Customer's instructions, solely to produce and deliver the Kit. The Customer warrants to us that it holds all rights, consents and authorisations needed to submit it. Publishing an identifiable person's image without consent can be a criminal offence in the UAE under Federal Decree-Law No. 34 of 2021 on Combatting Rumours and Cybercrimes, and the Customer remains responsible for every asset it publishes.

4.4What we do about it. Every Kit is reviewed by a human being before delivery. That review includes a reasonable-endeavours visual check for obviously identifiable people and readable number plates. Where we find them we blur them or flag them back to the Customer before delivery. We do not promise detection of every identifiable element, because faces appear in reflections and other places a careful reviewer can miss. The Customer's own pre-publication review remains the final control.

4.5What we refuse, and how that refusal actually works. Emirates ID numbers, passport numbers, bank or financial account details, and any sensitive personal data as defined in the PDPL (such as data revealing health, religious belief or criminal record) must not be submitted. That is a requirement we place on the Customer and a term of the Data Processing Addendum. We want to be exact about what enforces it, because the two are different things. Nothing in our intake scans a submission for that data and nothing removes it automatically. What we have is a person: every Kit is reviewed by a human being before delivery, and where that reviewer finds data of this kind we delete it from the submission, keep it out of the Kit, and tell the Customer. A reviewer can miss it, and anything in the pasted text will already have been processed as described in clause 5.1 before anyone looked at it. We also ask Customers to remove seller and landlord contact details from pasted text before submission. We reserve the right to redact, blur or delete any personal data in Listing Content that is unnecessary for the Kit, and to decline to produce a Kit, as a compliance safeguard.

4.6What we never do with Listing Content. We do not use Listing Content or Kits to train, fine-tune or improve any AI model. We do not build any database of property owners, landlords or leads from Listing Content. We do not scrape property portals. We do not source listings from third parties. We do not use seller or landlord details found in pasted text for any purpose other than producing the Kit, and we never use them for marketing or outreach of any kind.

5Where processing happens and how Kits are made

5.1Who sees your listing and your photographs. Each Kit is produced from a machine we control in the United Arab Emirates. The model that writes the copy does not run on that machine. The listing text you paste in and the photographs you upload are sent in full to Anthropic PBC in the United States, which runs the model that reads them and returns the drafted English and Arabic copy to us. This happens for every Kit, and again for any section our reviewer sends back to be rewritten.

5.1AAnthropic is engaged as a sub-processor under a written contract. It may use your Listing Content only to run the model and return the draft, together with the security and abuse monitoring it performs on its own service. It may not use your Listing Content to train, fine-tune or improve any model, and we keep the account setting that governs this switched off. It deletes what it receives after the limited period stated in its own published terms. It is named in our Sub-Processor Register with its processing location and transfer basis, and the transfer to the United States is covered by clause 8.

5.1BEverything else happens on our machine in the United Arab Emirates: the correction and resizing of your photographs, which is arithmetic on the pixels and never generates, adds or removes anything in a picture; the design and layout of every slide and of the brochure; the human review; and the decision to deliver.

5.2Every Kit is reviewed by a human being before it is delivered. Customers never receive raw, unreviewed model output.

5.3No decision producing legal effects concerning any individual is made by automated means alone. The service produces draft marketing materials that a human reviews and that the Customer must itself review and approve before publication.

5.4The machine used for generation and review is dedicated to that work, protected by full-disk encryption, accessible only to named HomeHub personnel, and configured so that consumer cloud synchronisation services do not copy working directories off the device.

6Purposes and lawful bases

6.1As controller of Account Data, we process for the following purposes on the following bases:

6.2As processor of Listing Content, we do not select a lawful basis of our own. The Customer, as controller, is responsible for the lawful basis for the personal data inside its Listing Content and for the lawfulness of publication.

7Sub-processors and service providers

7.1The authoritative list of our sub-processors, with their locations, functions and transfer bases, is the HomeHub Sub-Processor Register published on our website. The description below is a summary of that register and does not replace it. If the two differ, the register governs.

7.2The sub-processors currently engaged are:

(a)Website and application hosting, and storage of submissions and delivered Kits: Vercel Inc., United States. Uploaded listing text and photographs, and delivered Kit files, are stored with this provider and served from it, including the private results page. The same provider counts page views on our public pages, as described in clause 14.2; it does not do so on the private results page.

(b)Transactional email delivery, including the email that carries the delivery link: Resend, Inc., United States. The delivery email contains the link to the results page. Kit files and photographs are not attached to the email itself.

(c)Card payment processing: Stripe, Inc. and the Stripe group entity identified at checkout and on the invoice, United States and Ireland. Full card numbers are collected directly by that provider and never touch our systems. That provider handles cardholder data under its own privacy notice and under its own responsibilities as a controller of that data, and to that extent clause 7.5 does not apply to it.

(d)The application database: Neon Inc., United States. It holds accounts, seats, plan and billing state, order and acceptance records, and the index of Kits that makes your own Kits reachable from your dashboard. Listing photographs and Kit files are not stored there.

(e)AI drafting of Kit copy: Anthropic PBC, United States. It receives the submitted listing text and photographs in full, for the step described in clause 5.1, on the terms described in clause 5.1A.

7.3One hosted AI model provider processes Listing Content, and it is the one named in clause 7.2(e). No other third-party model, translation, transcription or image service processes Listing Content, and none will be engaged unless it is first named in the Sub-Processor Register and notice has been given under clause 7.4.

7.4We give Customers at least 30 days' written notice before adding or replacing a sub-processor, with a right to object as set out in the Data Processing Addendum. Where a provider must be replaced urgently for reasons outside our reasonable control, we will notify Customers as soon as reasonably practicable and the objection right then runs from the date of that notice.

7.5Each sub-processor is bound by a written contract imposing data protection obligations equivalent to those we owe, and we remain responsible to the Customer for our sub-processors' performance.

7.6Other recipients. We may also disclose personal data: to our professional advisers, who are bound by confidentiality; to the card schemes and the acquiring bank where a chargeback or other payment dispute is raised, to the extent needed to respond to it; where a UAE court, regulator or other competent authority requires it; and, on a reorganisation or sale of the business, to the successor entity on terms no less protective than this Policy. We do not sell personal data and we do not share it for any third party's own marketing.

8Cross-border transfers

8.1Photograph processing, human review, design and the decision to deliver take place in the UAE. Every service in clause 7 sits outside it, and so does the drafting step, and this includes Listing Content. In practice: the listing text and photographs are sent to our AI model provider in the United States for the drafting step described in clause 5.1; uploaded listing text and photographs, and delivered Kit files, are stored with our hosting provider in the United States and served from its network, including the private results page; account, billing, order, acceptance and Kit index records sit with our database provider in the United States; the delivery email and the link it carries pass through our email provider in the United States; website logs, and the page view counts described in clause 14.2, sit with our hosting provider in the United States; and payment data is processed by the payment service provider in the United States and Ireland in accordance with its own notice.

8.2The UAE Data Office has not yet published an adequacy list or official standard contractual clauses under the PDPL. Pending that, we rely on the grounds available under the PDPL for transfers in the absence of an adequacy decision: contractual safeguards, in the form of data protection terms with each named provider imposing obligations equivalent to those required of us, together with the express consent of the Customer to the named transfers, recorded in the Data Processing Addendum.

8.3When the UAE Data Office issues Executive Regulations, an adequacy list or official transfer clauses, we will bring our transfer arrangements into conformity and update this Policy and the Data Processing Addendum accordingly.

9Retention

9.1We retain personal data for the following periods and no longer, subject only to clause 9.2 and to records we are required by UAE law to keep:

9.2On termination of a Customer's account, we delete or return Listing Content and Kits in accordance with the Data Processing Addendum and will certify deletion on request, subject to the backup cycle in the table above and to records we are legally required to keep.

10Security

10.1We apply the following measures, and we describe them specifically rather than in generalities:

(a)Kit generation and review on HomeHub-controlled hardware in the UAE, protected by full-disk encryption;

(b)access to customer data limited to named HomeHub personnel, each bound by a written confidentiality undertaking that survives the end of their engagement;

(c)a dedicated working environment for customer data, with consumer cloud synchronisation disabled for working directories, and no storage of customer data on personal devices or personal cloud accounts;

(d)no forwarding of customer photographs over consumer messaging apps;

(e)delivery by emailed link to a private results page. The link carries a 128 bit random token and that token is the credential. It is not tied to the recipient's email address and there is no second check, so anyone who obtains the link can open the Kit until it expires. The link expires no later than 30 days after delivery, as described in clause 9, and clause 16.5 of the Data Processing Addendum requires the Customer not to forward it beyond its own personnel;

(f)encryption of data in transit to and from the website;

(g)access logging on systems holding customer data; and

(h)full card data handled solely by the payment service provider and never stored by us.

10.2No system is perfectly secure and we do not represent that ours is. We do not use terms such as bank-level or military-grade, and we make no certification claims.

11Personal data breaches

11.1If we become aware of a personal data breach affecting personal data we hold, we will act without undue delay. Where we are the processor, we will notify the affected Customer without undue delay, describing the nature of the breach, the categories and approximate volume of data affected, the likely consequences and the measures taken, and we will assist the Customer in meeting its own notification duties. Where we are the controller, we will notify the UAE Data Office and, where required, affected individuals, in accordance with the PDPL and any procedure prescribed under it.

11.2The PDPL standard is notification on becoming aware of the breach. No fixed statutory hour count applies at the effective date of this Policy, because the prescribed procedure and timing are to be set by the Executive Regulations to the PDPL, which have not yet been issued. Separately from that legal standard, we have committed to Customers in the Data Processing Addendum, as a contractual service commitment, to use all reasonable endeavours to give the initial notification of a breach affecting their data within 48 hours of becoming aware of it.

12Your rights

12.1Under the PDPL, individuals have the right to: request access to and a copy of their personal data; request transfer of their data in a machine-readable format; request correction of inaccurate data; request erasure; request restriction of processing; withdraw consent at any time where processing is based on consent, without affecting processing carried out before withdrawal; object to processing, including for direct marketing; and object to decisions based solely on automated processing that produce legal effects, noting that we make no such decisions (clause 5.3).

12.2To exercise any right, contact us at the address in clause 17. We respond within 30 days of a verified request. We may ask for information reasonably needed to confirm the identity of the requester before acting.

12.3If your data appeared in a listing. If you are a person whose image or details were contained in a Customer's Listing Content, for example you appeared in a photograph of a property or your details were included in listing text, the Customer that submitted the listing is the controller of that data. Because we act as processor, we will forward your request to that Customer within 5 business days and assist it in responding. We will tell you which Customer that is where we are lawfully permitted to do so and where you need that information to exercise your rights; we may be unable to do so where disclosure would itself breach a duty of confidentiality or another person's rights.

12.4You also have the right to lodge a complaint with the UAE Data Office, as described in clause 16.

13Marketing communications

13.1We send marketing emails about HomeHub only with consent, captured separately from account creation and from the delivery of the service. Every marketing email contains a working unsubscribe mechanism, and consent can be withdrawn at any time with effect for future messages. Withdrawing marketing consent does not affect service emails needed to deliver Kits, invoices and account notices.

13.2We never use personal data found inside Listing Content for marketing. In particular, we never contact property owners, sellers or landlords whose details appear in pasted listing text.

14Cookies and analytics

14.1The website uses cookies that are strictly necessary for it to function, including session and security cookies and, for logged-in Customers, authentication cookies.

14.2We count page views on the public pages, and only there. Those pages are the homepage in both languages, our United States and United Kingdom pages, the guides, the legal pack and the error pages. The tool is Vercel Web Analytics, supplied by the same company that hosts this website, named at clause 7.2(a) and at row 1 of the Sub-Processor Register. It records the page you opened, the page you came from, and the country, browser type and device type that can be read from the request. It sets no cookie and stores nothing on your device. So that one person reading three pages is counted once rather than three times, it derives a value from the request that changes every day and cannot be turned back into you, linked to your reading on any other day, or linked to you on any other website. We use it to learn which of our guides people find useful, which is the legitimate interest recorded in clause 6.1.

14.3We place no measurement of any kind on the private results pages that carry Kit content. The same is true of the signed-in portal, the sign-in page and the checkout. This is not a setting that could be switched the wrong way: the measurement is written into the footer that only the public pages carry, those pages carry no footer, and an automated test refuses to let the website build if that ever stops being true.

14.4We use no session recording, no error tracking that processes personal data, no advertising technology, and no advertising or cross-site tracking cookies. If we introduce a tool of that kind, or any analytics tool that sets a cookie, stores an identifier on your device or measures a page carrying Kit content, we will add it to the Sub-Processor Register and to clauses 7 and 8, and where the cookie or tool is not strictly necessary we will ask for consent before setting it and the website will work without it.

15Children

15.1The service is a business tool for licensed real estate professionals. It is not directed at children and we do not knowingly collect personal data from children. If a photograph submitted by a Customer contains an identifiable child, we treat that under clause 4.4 and we ask Customers not to submit such photographs. If you believe we hold personal data of a child, contact us at the address in clause 17 and we will address it promptly.

16Complaints

16.1If you are unhappy with how we have handled personal data, contact us first at the address in clause 17 and we will respond within 30 days.

16.2You have the right to complain to the UAE Data Office, the federal authority established under Federal Decree-Law No. 44 of 2021, regarding our processing of personal data. Where your complaint concerns data submitted or published by a Customer, the complaint may also lie against that Customer as controller.

17Contact

17.1Data protection contact: hello@myhomehub.ae. Postal address: HomeHub Portal, P.O. Box 70834, Dubai, United Arab Emirates. Please mark correspondence for the attention of the data protection contact.

18Changes to this Policy

18.1We may update this Policy from time to time, including to bring it into conformity with the Executive Regulations to the PDPL when they are issued. We will post the updated version on our website with a new effective date, and where a change materially affects Customers we will notify account holders by email before it takes effect. We keep an archived copy of each version.

19Governing law

19.1This Policy and any dispute arising from it are governed by the federal laws of the United Arab Emirates as applied in the Emirate of Dubai, and the courts of Dubai (onshore) have jurisdiction over any dispute between HomeHub and a Customer arising from it.

19.2Nothing in clause 19.1 affects the right of any person to complain to the UAE Data Office under clause 16, or any right or remedy available to an individual under UAE law that cannot be excluded or restricted by agreement.

20Language

20.1This Policy is published in English. An Arabic version may be published for convenience. If it is, the Arabic version is a translation of this English text, and any document submitted to a UAE court must in any event be accompanied by a translation prepared by a legal translator approved by the UAE Ministry of Justice.

Annex A. United Arab Emirates

For a customer or a visitor in the United Arab Emirates, this Policy already states the position in full: personal data is handled under Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, the PDPL, as clause 1.6 and clause 12 above set out. A question about your data, or a request to exercise a right this Policy gives you, goes to hello@myhomehub.ae.

Annex B. United Kingdom

For a customer or a visitor in the United Kingdom, personal data is handled under the UK General Data Protection Regulation, the UK GDPR. The supervisory authority is the Information Commissioner's Office, the ICO. A representative for the United Kingdom under Article 27 of the UK GDPR has not yet been appointed. This Annex will name one, with contact details, once that happens. Until then, a UK question or a rights request goes to hello@myhomehub.ae.

Annex C. United States

For a customer or a visitor in the United States, a California resident holds the rights the California Consumer Privacy Act gives a consumer: to know what personal information is collected, to request its deletion, to correct it, and to opt out of its sale or sharing. HomeHub does not sell personal information. A rights request goes to hello@myhomehub.ae.