Privacy policy.

Mulki is a property portfolio management platform operated from Dubai, United Arab Emirates. 'We', 'us', and 'our' refer to Mulki. 'You' and 'your' refer to the individual whose Emirates ID is linked to a Mulki account. Mulki is the data controller for the personal data described here. For any privacy question, write to [email protected]. We aim to reply within one business day. This policy will continue to evolve as the product does, and we will tell you when it changes in a way that affects you.

This policy covers personal data processed through the Mulki web app, our mobile apps for iOS and Android, our APIs, and any message exchanged with our team. It does not cover third-party services you reach from within Mulki. Those have their own policies.

Identity: your full name, a hashed reference to your Emirates ID, your nationality, and your preferred language, returned by UAE PASS when you sign in. Property: title deeds, transactions, ownership status, and Ejari registrations linked to your Emirates ID, retrieved from the Dubai Land Department. Plus anything you add yourself: rental terms, expenses, mortgages, payment plans, and documents you upload. Financial: service booking history and payment records (reference, amount, status). Card numbers are held by Stripe under PCI-DSS Level 1; Mulki never sees them. Technical: device model, OS version, app version, push notification token, IP address, and your language and region. Usage: aggregated, anonymous analytics about which features get used. Not tied back to your identity.

Your UAE PASS password: UAE PASS handles authentication on its own infrastructure. Your biometrics: if you enable Face ID, fingerprint, or PIN, the check happens on your device. Your biometrics never leave it. Your card numbers or bank credentials: payments are tokenised by Stripe. Your location: beyond the coarse coordinates Mapbox needs to render a map you have opened. We never sell personal data. Ever.

From UAE PASS when you sign in. From the Dubai Land Department, using your Emirates ID hash to retrieve records officially linked to you. From you, as you add and edit content. Automatically, through standard request logs and the analytics described above.

We process your personal data under UAE Federal Decree-Law No. 45 of 2021 (the 'PDPL'). Consent is the default basis (Article 4); the PDPL also sets out cases in which consent is not required (Article 5). Consent: to receive the identity attributes UAE PASS returns when you sign in. Marketing emails are sent only with separate opt-in. You can withdraw consent at any time. Contract: to deliver the service to you under our Terms. Legitimate interest: to keep the service secure, prevent fraud, improve the product through anonymous analytics, and reach you about important account matters. Legal obligation: to retain certain financial records as required by UAE commercial and tax law, and to respond to lawful requests from UAE authorities.

To build and display your portfolio from official records. To compute indicative valuations and rental yields. To relay service requests to vetted providers and pass payment details to Stripe. To send you transactional notifications. To localise the app into English or Arabic. To keep the platform secure. To improve features through anonymous usage data. To answer you when you write to us. If we ever need to process your data for a new purpose, we will tell you first and ask for consent where required.

Each provider below is bound by a data processing agreement and may only use your data on our instructions. UAE PASS (operated jointly by Digital Dubai, the Telecommunications and Digital Government Regulatory Authority (TDRA), and the Department of Government Enablement): identity verification. UAE. Dubai Land Department (Government of Dubai): official property records and service charge data (including the Mollak system). UAE. Supabase: database, file storage, backend hosting. EU region. Convex: push notification delivery. USA. Stripe: payment processing. USA, PCI-DSS Level 1. Mapbox: maps and geocoding. USA. OpenAI: optional AI features, invoked only when you use them. USA. Resend: transactional email. USA / EU. Vercel: web hosting. USA with global edge nodes. Zoho Mail: operational email. India / UAE. This list will be updated as we add or change providers in any material way.

Some of our sub-processors are based outside the UAE. When we transfer personal data abroad, we rely on the safeguards permitted under Article 22 of the PDPL: primarily the standard contractual clauses incorporated into each processor's data processing agreement, together with supplemental measures such as encryption in transit and at rest. Where applicable, we also evaluate independent certifications (for example Stripe's PCI-DSS Level 1 and SOC 2 attestations) as part of our processor review. For EU residents, we extend GDPR-equivalent protections regardless of where data is processed.

While your account is active, we keep the personal data needed to deliver the service. Property records refresh from official sources and replace previous snapshots. If you close your account, we delete your personal data from active systems within 30 days. Encrypted backups roll off within a further 30 days. Financial and booking records are retained for the period required by UAE commercial and tax law, kept in a minimised form (reference, amount, date, counterparty) without identity attributes that aren't needed. Anonymous, aggregated analytics may be kept indefinitely. By definition, this data cannot be tied back to you.

Personal data is encrypted at rest with AES-256 and in transit with TLS 1.2 or higher. UAE PASS enforces multi-factor authentication, so we never see or store your password. On mobile, your session lives in the device keychain; on web, in HTTP-only, Secure, SameSite cookies. Optional biometric unlock runs entirely on your device. We only ever receive a yes or no result. Access to production systems is restricted, logged, and gated by hardware-backed authentication. Backups are encrypted. If we ever discover a personal data breach likely to result in risk to you, we will notify the UAE Data Office within 72 hours of becoming aware of the breach, and tell you without undue delay, in line with Article 9 of the PDPL and its Executive Regulations. If you find a security issue, write to [email protected]. We read those first.

Access (Article 12): know what we hold about you and obtain a copy. Correction (Article 15): fix data that is inaccurate or incomplete. Deletion (Article 15): ask us to delete your personal data, subject to legal retention obligations. Restriction of processing (Article 16): pause processing in certain situations. Portability (Article 17): receive your data in a structured, machine-readable format. Objection (Article 18): object to processing carried out under legitimate interest. Withdrawal of consent (Article 6): at any time, where processing relies on it. Complaint: to the UAE Data Office if you believe your rights have been infringed. For EU residents, equivalent rights under the GDPR apply.

Most of these rights are built into the app. You can view, export, edit, and delete your data, or close your account, from your settings. Closing your account revokes UAE PASS consent for Mulki and removes your data within 30 days. For anything that isn't self-serve, write to [email protected] from the email linked to your UAE PASS account. We will verify your identity and respond within 30 calendar days. We do not charge a fee, unless a request is manifestly unfounded or excessive.

Mulki is not intended for, and may not be used by, anyone under 18. UAE PASS enforces its own minimum age requirement at sign-in. If we become aware that we have collected personal data from a person under 18, we will delete it.

Transactional messages (booking confirmations, security alerts, document reminders, account changes) are part of the service and are always sent. Marketing emails are sent only with your explicit opt-in. You can unsubscribe at any time using the link at the foot of every marketing message, or by writing to [email protected]. Unsubscribing from marketing does not affect transactional messages.

We may update this policy as the product evolves, the law changes, or we add new sub-processors. The date at the top reflects the current version. If a change materially affects how we handle your data, we will tell you at least 30 days before it takes effect, by email and in the app.

For any privacy question, request, or complaint, write to [email protected]. We aim to resolve substantive requests within 30 calendar days. If you are unhappy with our response, you may complain to the UAE Data Office, established under UAE Federal Decree-Law No. 44 of 2021. EU residents may also complain to the supervisory authority in their country of residence.