Privacy Policy

1. Introduction

PropertyDynamix ("we", "us" or "our") is based in Dubai, United Arab Emirates. This policy covers the website at propdynamix.com and everything we run behind it: Market Terminal, the Price Prism Engine, Lands & Feasibility, Payment Plans, Pricing Pulse, Promotions Radar, New Launches, MOIRA, the blog and our market review editions. We call all of this "the platform".

The platform is built for businesses and the people who work in them. If you use it on behalf of a company, that company is our customer, and this policy also covers the personal data of its people. The commercial terms live in our Terms of Service.

If anything here is unclear, write to support@propdynamix.com and we will answer in plain English.

2. Information We Collect

Account

• Name, email address, company and role
• Profile photo, if you sign in with Google
• Phone number, if you choose to link one for verification. Verifying it lets a Free trial run to 7 days. When you verify a phone number we keep a scrambled (hashed) record of it, with the account it verified and when, even after the account is deleted, only to stop the same number being used to claim a trial or benefit twice.
• Approval status, plan, usage counters and the time of your last login
• Login history (the time, the sign-in method, whether it succeeded, and your browser and device type) and recent activity events, so we can spot misuse and help with support
• The page you are on, your last activity, and a simple engagement score we use to understand how the platform is used
• If you sign in with a code sent to your email, or a security check asks you for one: the code is for one use and expires after 10 minutes, allows 5 guesses, and we send at most 5 codes an hour. We store only a scrambled (hashed) copy of the code and counters of sends and guesses. The address you type is held only until the code is sent. After you sign in we record when and how you proved it, so you are not asked again for the period our security setting allows (by default 12 hours, never more than 30 days).
• Your password, held only as a secure hash by our sign-in provider. We never see it.

Project and pricing data

• Project details, including the location you place on the map
• Unit inventory you upload, such as unit names, areas, types and floors
• Pricing configurations, versions, simulation results and margin inputs
• Payment plans and feasibility studies
• Saved configurations and the reports you generate

MOIRA conversations and files

• Conversations and messages, together with the tool results MOIRA used to answer
• A memory of your preferences and of each project you discuss, so MOIRA does not start from zero every time
• Files you attach: documents, images and spreadsheets. Spreadsheets are summarised on your device, and only the summary is sent.

Market research queries

• Search queries and parameters you enter in Market Terminal
• A daily count of web research lookups per user, used to apply fair use

Billing

• Your customer reference with our payment processor, your subscription state, invoices and credit notes, and each refund you ask for (the reason you give, who asked for it, and for seats given back, how many)
• A record of each change of plan: who made it, from which plan to which, the seats, the amount charged and whether a discount ended
• For an organisation that buys seats, how many it bought; who holds each seat is the organisation's member list
• Your VAT number and billing address, if you give them
• We keep seat counts and these billing records so we can issue invoices, refunds and credit notes
• Never your card number. Card payments are handled by a PCI DSS Level 1 certified payment processor; card numbers never reach our servers.

Support and contact

• Contact form submissions: name, email, company and message. The form is rate limited to deter spam.
• Anything you write to our support address

Market review subscribers

• Email address, subscription status and whether you have unsubscribed

Security and abuse prevention

• Tokens from a bot protection provider, which scores whether a session looks automated
• Sign-in session tokens
• IP address and device details in our logs

Usage measurement and telemetry

• Usage and cost accounting per feature (MOIRA chats, market views, web checks and exports), so we can meter fair use and understand what the platform costs to run
• If you belong to an organisation account, its billing admin can see your usage counts for today and this month (MOIRA chats, market views and web checks added up), never what you asked
• Service health checks, error logs and administrator audit logs
• Error reports from your browser when something on the page breaks (what failed, the page, and your browser type), kept for 30 days and deleted with your account
• A web analytics provider records page views and basic device information on the public site and in the web app, only if you accept analytics cookies. It runs only where your browser supports it. We use no advertising features and no ad personalisation.

3. How We Use Your Information

• Provide and run the platform: process your projects, inventory and configurations to deliver pricing, simulations, market intelligence, payment plans, feasibility models, reports and MOIRA answers.
• Keep your account secure: approve new accounts, verify sign-ins, detect automated abuse and end sessions when we need to.
• Bill you: manage subscriptions, invoices, credit notes and VAT through our payment processor.
• Apply fair use: count MOIRA chats, market views, web checks and exports on paid plans. We contact you before applying any limit.
• Support you: answer contact form submissions and support requests.
• Improve the service: study anonymised, aggregated usage patterns. We do not use your individual pricing data, configurations, conversations or files to train AI models, and under the paid API terms we use, our processors do not train on them either.
• Score our own recommendations: Pricing Pulse compares each recommendation with what later sold, to tune its weighting and show you how accurate it has been.
• Communicate with you: send service notices, product updates and, if you subscribed, the market review edition. Every market review email carries a one-click unsubscribe, and you can opt out of other non-essential email at any time.
• Meet legal obligations: keep the records the law requires and answer lawful requests under UAE law, including the Personal Data Protection Law (PDPL).

4. Data Sharing & Processors

Who processes your data

• Our cloud hosting and database provider: hosting, sign-in, database, file storage, server-side processing and the storage of market data. It is independently audited against ISO/IEC 27001, 27017 and 27018 and SOC 2.
• Our AI model provider: AI features send prompts, project context and tool results to the AI model to generate responses. Every one of those calls goes through our own cloud account with that provider, authenticated by that account rather than by a shared key. Under those terms, the provider does not use your prompts or responses to train its models. Some scheduled research uses the AI provider's web search, which submits a search string to its search engine.
• Our map provider: maps, geocoding and address look-up for project locations.
• A web analytics provider: page views and basic device information on the public site and in the web app, only with your consent.
• A bot protection provider: abuse prevention. These score whether a session looks automated.
• Our payment processor: payments, invoices and card data. Card payments are handled by a PCI DSS Level 1 certified payment processor; card numbers never reach our servers.
• A third-party web search provider: web research for MOIRA and the Price Prism Engine. It receives the search query text, not your project files.
• Email delivery providers: transactional mail sent from our own domain, and contact form notifications to our support inbox.

Each processor acts on our instructions under its own data protection terms. Do not put into MOIRA, or upload anywhere on the platform, anything you are not permitted to share with a cloud processor.

What we never do

• Sell your personal data or project data to anyone
• Rent or lease access to customer information
• Share one customer's data with a competitor or another market participant
• Use your data for advertising

Aggregated statistics

We may publish anonymised, aggregated statistics that cannot identify any person or organisation.

Legal requirements

We may disclose data when UAE law, regulation, legal process or a lawful request from an authority requires it, or when it is necessary to protect the rights, property or safety of PropertyDynamix, our users or the public. Where the law allows, we will tell you.

5. Public Sources and Third-Party Content

Registered transaction records

Our market data is built from registered transaction records published by the Dubai Land Department (DLD) and the Abu Dhabi Real Estate Centre (ADREC). These records concern property transactions, not people, and we show them in aggregated, benchmarked or comparable form. They can be delayed, mis-keyed or reclassified at source. DLD and ADREC publish their own terms, which may restrict redistribution: exports are for your internal business use, not for resale or republishing as a dataset.

Developer, portal and press pages

Promotions Radar, New Launches and our market research read developer websites, property portals, press and community sites on a schedule. We read publicly available pages only: no accounts, no paywalls, and no attempt to collect personal data. Raw pages gathered this way are kept for 180 days.

Developer names and marks

Developer names and logos appear beside offers and launches for identification only. Marks belong to their owners. Nothing on the platform implies affiliation, sponsorship or endorsement by any developer, by DLD, by ADREC or by any authority. Offers and launches can be wrong, incomplete, changed or withdrawn without notice, so verify against the developer's written terms before relying on or quoting one.

Corrections and removal

A developer, rights holder or anyone named on the platform can ask for a correction or removal at support@propdynamix.com. We act promptly. A New Launches listing can also be disputed through the methodology page.

6. AI Feature-Specific Data Handling

MOIRA conversations

Your conversations, messages and the tool results behind each answer are saved to your account so you can return to them. You can delete a single conversation or your whole history at any time. To produce each answer, MOIRA sends your prompt, the relevant project context and tool outputs to our AI model provider, through our own cloud account. When MOIRA researches the web, the search query text goes to a third-party web search provider; your files do not. MOIRA also keeps a memory of your preferences and of each project you discuss.

MOIRA file uploads

Files you attach (documents, images and spreadsheets) are stored in your account and are deleted 15 days after upload. Documents and images are passed to the AI model for analysis. Spreadsheets are summarised on your device, and only the summary is sent. A structured summary may stay with the conversation after the original is gone. If you refer to an expired file, MOIRA will ask you to attach it again. Do not upload identity documents or files containing personal data about individuals: uploads are for property and market documents.

Reports and exports

Generated report files (PDF, Excel and image) are kept for 30 days so you can download them again, then removed. You can regenerate a report on demand. Once you download a file, it is yours to control, and we cannot recall it.

Pricing Pulse

Pricing Pulse runs on a schedule, currently twice a week, for each project you monitor. Each run reads registered sales, launches and market sentiment, sends your project context (area, tier and unit mix) with derived market aggregates to the AI model, and returns hold, raise or cut with a recommended PSF, inside guardrails. About 30 days later we score each call against what actually sold, and we keep that history to tune the weighting and to show you an accuracy dashboard. Repricing is always your decision.

1-Click Pricing

1-Click Pricing drafts a pricing configuration for your project from registered evidence. Research in this step may use the third-party web search provider, which receives the query text only. Every value is a proposal: you approve each one before it is applied.

Promotions Radar and New Launches

These features work from public developer pages, property portals, press and registered records, read on a schedule and interpreted by an AI model. They do not read your projects or your conversations. Each figure is labelled by how well it has been checked, and any listing can be disputed.

Market review editions

Our monthly market review is written by an AI model from registered records, then reviewed and approved by a person before it is published on the blog with a PDF. Subscribers receive an email only after an administrator has approved and sent it. Every edition email carries a one-click unsubscribe.

MOIRA Majlis

MOIRA Majlis lets an AI assistant you already use, such as ChatGPT or Claude, reach the platform under your own access. You connect it by signing in to PropertyDynamix from inside the assistant and approving the connection. We issue no key, and you never type your password into the assistant.

What the assistant receives is what your plan lets you see: registered DLD and ADREC records and the figures computed from them. It does not receive your projects, your conversations or your documents. What the assistant then does with an answer is governed by that assistant provider's own terms and privacy policy, not by ours.

Every call is logged against your account: which capability was used, a fingerprint of the request rather than its text, any query that ran, how much data was read and returned, and the outcome. You can see your own usage and every connected assistant on the Connect page in your account, and disconnect any of them there. Our administrators can see the same log to support you and to keep the service safe. A daily allowance applies to each plan.

AI can be wrong

Outputs are for information. They are not financial, investment, legal, tax, valuation or brokerage advice. An AI model can invent a figure, use a stale one or misread a table. We build guardrails, citations and missing-value reporting, but we cannot eliminate error. Verify before you rely on an output outside the platform.

Sensitive inputs

Do not paste into MOIRA, or upload anywhere on the platform, personal data about individual buyers, tenants, employees or investors, confidential counterparty terms, or anything you are not permitted to share with our processors. You decide what to submit, and you are responsible for it.

7. Data Storage & Security

• Where data is stored: the database, file storage and market data are held in our cloud provider's Doha region in Qatar (me-central1).
• Where processing runs: most server-side processing runs in that same Doha region. A few endpoints stay in the United States (us-central1), AI model calls go to our AI model provider on its global endpoint, and sign-in and site hosting are our cloud provider's global services. See section 13.
• Encryption: our infrastructure providers encrypt data in transit and at rest. Our cloud hosting and database provider is independently audited against ISO/IEC 27001, 27017 and 27018 and SOC 2. These are our provider's certifications, not ours.
• Per-account isolation: your records belong to your account. A member removed from an organisation loses access to its records. Nobody outside your account can open them, except our administrators for the reasons in section 8.
• Access: Free accounts are reviewed before access. A paid plan is active as soon as the payment is confirmed.
• Audit logs: administrative actions are written to an append-only log that cannot be edited or deleted. We keep it for at least 2 years.
• Sessions: sign-in runs on our cloud provider's authentication service. Session tokens expire, and we can end any session at once if we suspect misuse. Phone verification is protected by a bot protection provider.
• Backups: follow our processors' schedules and expire on their cycles.
• If something goes wrong: if we learn of a breach affecting your personal data, we will tell you and the relevant authority as UAE law requires.

8. Administrator Access

You should know what our administrators can do, because some of it touches your data. They can:

• Approve, reject or suspend accounts. This is how new sign-ups are reviewed and how abuse is stopped.
• End sessions or force a password reset. Used when we suspect misuse, or when you ask us to.
• Impersonate a user for support or audit. This lets an administrator see the platform as you see it, to reproduce a problem. Every such act is logged, and the session is marked as impersonation so it can never be mistaken for your own.
• Delete a user in three tiers. Revoke access, wipe data, or fully purge the account, on your request or for abuse. We use the smallest tier that meets the request.
• Merge or wind up an organisation. Only at the account owner's request. In a merge, the people and their records move to the receiving organisation. In a wind-up, seats are closed and the records stay with the archived account.
• Prune login history and activity events, and read the audit log.

Administrators use these powers only for support, safety and legal compliance. The audit log records who did what, to whom, and when.

9. Your Rights (UAE PDPL)

Under the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021), and where relevant the DIFC and ADGM data protection laws, you have the following rights:

• Access: ask for a copy of the personal data we hold about you.
• Correction: ask us to fix anything inaccurate or incomplete. Much of your account data you can edit yourself in your settings.
• Deletion: ask us to delete your personal data. We delete or anonymise it within 90 days of a valid request, except where the law requires us to keep something longer, such as invoices and audit logs. You can export your data before we delete it.
• Portability: export your data in standard formats such as CSV, Excel and PDF from within the platform, or ask us for a copy.
• Withdraw consent: at any time. For analytics cookies, use Cookie settings in the footer of our public pages. Some features may stop working as a result.
• Object: to processing for a specific purpose, including marketing. Every market review email carries a one-click unsubscribe, and you can opt out of other non-essential email at any time.
• Complain: to us first, so we can put it right. You may also complain to the data protection authority that has jurisdiction over you.

To exercise any of these rights, contact us at support@propdynamix.com. We may ask you to confirm your identity first. We respond to valid requests within 30 days.

10. Data Retention

We keep data for as long as it is useful to you or required of us, and no longer. The figures below are the ones the platform actually applies.

11. Cookies, Local Storage and Analytics

• Analytics cookies, only with consent: if you accept analytics cookies, our web analytics provider sets the _ga and _ga_* cookies to count visits and page views, on the public site and in the web app. Nothing is set until you choose. You can change your choice at any time with Cookie settings in the footer of our public pages; withdrawing deletes these cookies.
• Sign-in session: Our authentication service keeps your session in your browser's own storage so that you stay signed in. This is required to use the platform.
• Bot protection: our bot protection provider may set its own cookies or identifiers under its own terms. It scores whether a session looks automated, which keeps sign-in and forms secure.
• Local storage: your browser holds a few preferences and drafts for convenience: your cookie choice, theme, motion level, MOIRA settings, pricing configuration drafts, view modes, dismissed hints, a per-day count of web research lookups, and a diagnostics switch. These stay on your device. Clearing browser storage removes them and may sign you out.
• No advertising: we serve no advertisements and use no advertising or cross-site tracking technology.

12. Children's Privacy

PropertyDynamix is a business platform for people who work in real estate. It is not intended for anyone under 18, and we do not knowingly collect personal data from anyone under 18.

If we learn that we have collected personal data from someone under 18, we will delete it. If you believe this has happened, contact us at support@propdynamix.com.

13. International Data

Your stored data, including the database, file storage and market data, is held in our cloud provider's Doha region in Qatar (me-central1). Most application processing runs in that same region, including the servers behind MOIRA, the market data service and document processing. Three endpoints stay in the United States (us-central1): the trigger that sets up a new account, the email unsubscribe link and the payment webhook. AI model calls go to our AI model provider on its global endpoint, so the provider decides where a call is processed. Sign-in and site hosting are our cloud provider's global services.

Qatar is outside the UAE, so holding your data in Doha is itself a transfer out of the UAE, as is every step that runs in the United States or on a global endpoint. These transfers rely on our processors' standard contractual protections, consistent with Article 22 of the UAE PDPL and, where relevant, the DIFC and ADGM equivalents. We do not transfer personal data to a jurisdiction that lacks adequate protection without lawful safeguards in place.

14. Changes to This Policy

We may update this policy when our practices, our processors or the law change. You accept this way of updating it once, here, so you are not asked again for every small change. When we update it:

• The "Last updated" date at the top of this page changes, and we tell you in the platform what changed
• Minor change: a clarification, a correction or a change that does not reduce your rights. If you keep using the platform after we have told you about it, you accept it
• Material change: any change to how we use or share your personal data, or to the fees, refunds or liability in our Terms of Service. We announce it at least 30 days before it takes effect, and you can export your data during that period. From the day it takes effect, we ask you to accept it before you continue using the platform, and using the platform alone never counts as accepting it

If you do not accept a material change, you may cancel before it takes effect, as sections 6 and 17 of our Terms of Service describe. If you do not agree with any change, do not accept it and stop using the platform. Write to us at the address below and we will help you export your data and close your account.

15. Contact

If you have a question about this policy, want to exercise a right, or have a concern about how we handle data, contact us: