Privacy Policy

Who we are (data controller)

The Service is operated by Suvora Technologies FZ LLC, a company established in the United Arab Emirates. Contact details for privacy matters:

• Data protection / privacy enquiries: privacy@nestiq.ae
• Data Protection Officer: dpo@nestiq.ae
• General legal enquiries: legal@nestiq.ae

We process personal data in accordance with Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the "PDPL") and its implementing regulations, together with any other applicable UAE data protection and sector-specific laws.

Personal data we collect

We collect the following categories of personal data:

• Identity & account data: full name, email address, phone/WhatsApp number, password (stored hashed), role (tenant, landlord or property manager/agent), profile photo, emirate and area.
• Property & tenancy data: property address, unit details, building name, tenancy dates, rent amount, Ejari and contract details, and the identity of the counterparty you connect with.
• Documents you upload: tenancy contracts, notices, receipts, cheques and other files you choose to store.
• Condition-record media: move-in and move-out photographs, room notes, furnishings/inventory details, annotations and digital signatures.
• Communications: in-app messages between tenancy parties, maintenance requests, support enquiries, and your interactions with our AI assistant, Nia.
• Payment data: subscription and billing records. Card payments are processed by our payment provider; we do not store your full card number.
• Technical & usage data: device and browser information, IP address, approximate location derived from IP, log data, cookies/session identifiers, and analytics events describing how you use the Service.

You are not required to provide all data, but some features cannot function without the relevant data (for example, a condition record requires photographs).

How we use your data and our legal bases

Under the PDPL we rely on one or more of the following legal bases for each processing purpose:

• Performance of a contract — to create and operate your account, deliver the features you request, share records between tenancy parties, and process payments.
• Your consent — for optional processing such as certain AI features, marketing communications, and any processing that requires consent under the PDPL. You may withdraw consent at any time (see section 11).
• Compliance with a legal obligation — to meet obligations under UAE law and to respond to lawful requests from competent authorities.
• Our legitimate interests — to secure, maintain, debug and improve the Service, prevent fraud and abuse, and understand aggregate usage, where these interests are not overridden by your rights.

We do not sell your personal data, and we do not use it for third-party advertising.

Artificial intelligence and automated processing

NEST IQ is an AI-enabled service. Several features use artificial intelligence, including large language models and computer-vision models provided by our AI sub-processor, Anthropic. It is important you understand what this involves:

• Nia (AI assistant): the text of your questions and the conversation context you provide is sent to the AI provider to generate responses about UAE tenancy topics.
• Condition-record AI: to help you build a record, your condition-record photographs and related text may be sent to the AI provider to detect furnishings and their condition, verify that required shots were captured, and (for move-out) compare move-in and move-out images. These outputs are advisory suggestions that you can review and edit — a human confirms every record.

AI outputs can be wrong. AI-generated content may be inaccurate, incomplete, out of date, or may "hallucinate" — that is, produce confident-sounding information that is false or fabricated. AI outputs do not constitute legal, financial or professional advice and must be independently verified before you rely on them. See our Terms of Service for the full AI disclaimer.

No solely-automated decisions. We do not make decisions that produce legal effects concerning you, or similarly significantly affect you, based solely on automated processing without human involvement. AI is used to assist and suggest; determinations about your tenancy, deposit or disputes are made by people and the competent authorities, not by our AI.

We instruct our AI provider not to use your inputs to train their foundation models where such controls are available to us, and we do not use your personal documents or condition-record photographs to train our own or third-party AI models.

Service providers and sub-processors

We share personal data with a limited number of vetted providers who process it only on our instructions and under contractual confidentiality and security obligations:

• Supabase — database, authentication and encrypted file storage.
• Vercel — application hosting and content delivery.
• Anthropic — AI processing that powers Nia and our condition-record AI features (see section 4).
• Payment provider — processing of card payments and subscriptions (PCI-DSS compliant).
• Communications providers — delivery of transactional email and WhatsApp/SMS notifications you have opted into.

We may also disclose personal data to competent UAE authorities, courts, or the Rental Disputes Centre where required by law or to establish, exercise or defend legal claims. An up-to-date list of sub-processors is available on request from privacy@nestiq.ae.

International data transfers

Some of our providers process data on servers located outside the UAE (for example, in the European Union and the United States). Where personal data is transferred outside the UAE, we do so only in accordance with the cross-border transfer requirements of the PDPL — relying on an adequate level of protection in the destination jurisdiction, appropriate contractual safeguards, or your explicit consent. By using AI features and other functions that depend on these providers, you acknowledge that the relevant data may be transferred and processed outside the UAE for those purposes.

Data shared between tenancy parties

NEST IQ is a two-sided service. When you connect with the other party to a tenancy, certain data is shared with them as an inherent part of the Service — including your name, the property and tenancy details, condition records, messages, maintenance requests and documents you choose to share. Once a condition record is signed, both parties are entitled to a copy. Please only upload information you are willing for the connected party to see.

How long we keep your data

We retain personal data only for as long as necessary for the purposes described in this Policy, or as required by law:

• Account deletion: when you request deletion, your account is scheduled for permanent erasure after a 30-day recovery window, during which you may restore it. After that window, personal data is permanently deleted, except where we must retain it under law.
• Condition records & dispute evidence: signed condition records and their media may be retained for up to 5 years to support potential proceedings before the Rental Disputes Centre. During this period, a signed record may not be deletable, as it forms part of a shared legal record between both parties.
• Financial records: billing and transaction records are retained as required by applicable UAE tax and commercial law.

How we protect your data

We apply technical and organisational security measures appropriate to the risk, including encryption of data in transit and at rest, access controls and row-level security, hashed credentials, and restricted administrative access. No method of transmission or storage is completely secure, and we cannot guarantee absolute security; you are responsible for keeping your login credentials confidential.

Cookies and analytics

We use strictly necessary cookies and similar technologies required for authentication, sessions and security. We also collect limited, privacy-respecting usage analytics to understand and improve the Service. We do not use third-party advertising cookies or sell analytics data. You can control cookies through your browser settings, though disabling essential cookies may prevent you from logging in.

Your rights under UAE data protection law

Subject to the conditions and exceptions in the PDPL, you have the right to:

• Access the personal data we hold about you and obtain information about how it is processed;
• Request correction of inaccurate or incomplete data;
• Request erasure of your personal data ("right to be forgotten");
• Restrict or object to certain processing;
• Request portability of data you provided, in a structured, machine-readable format;
• Withdraw consent at any time, without affecting processing carried out before withdrawal;
• Not be subject to decisions based solely on automated processing that produce legal or similarly significant effects; and
• Lodge a complaint with the UAE Data Office (the competent supervisory authority).

To exercise any of these rights, contact privacy@nestiq.ae. We will respond within the period required by law. We may need to verify your identity before acting on a request.

Children

The Service is intended for adults aged 18 and over and is not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us data, contact us and we will delete it.

Data breaches

In the event of a personal data breach that meets the notification threshold under the PDPL, we will notify the UAE Data Office and affected individuals as required by law and without undue delay.

Changes to this Policy

We may update this Policy from time to time. We will post the updated version here with a new effective date and, for material changes, provide additional notice through the Service. Your continued use after an update constitutes acceptance of the revised Policy.

Contact us

For any privacy question, or to exercise your rights, contact our Data Protection Officer at dpo@nestiq.ae or privacy@nestiq.ae. You also have the right to contact the UAE Data Office directly.