Privacy policy.

Mulki is a property portfolio app for Dubai property owners, operated by Mulki Tech F.Z.E, a company registered in the Ajman Free Zone, United Arab Emirates. 'We', 'us', and 'our' refer to Mulki Tech F.Z.E. 'You' and 'your' refer to the person who holds a Mulki account. Mulki Tech F.Z.E is the data controller for the personal data described here. For any privacy question, write to [email protected]. We aim to reply within one business day. This policy will change as the product does, and we will tell you when it changes in a way that affects you.

This policy covers personal data processed through the Mulki mobile apps for iOS and Android, the servers and APIs behind them, the quote page our service providers use to price a job, and any message you exchange with our team. Mulki has no web app. It does not cover third-party services you reach from within Mulki, which have their own policies.

Identity from UAE PASS: if you sign in with UAE PASS, it returns your full name in English and Arabic, your Emirates ID number, nationality, gender, email address, and mobile number. We store these with your account. The Emirates ID number is stored as UAE PASS provides it. Identity from Apple, Google, or email: if you sign in with Apple, with Google, or with a one-time code sent to your email, we receive your email address, an account identifier from that provider, and your name if the provider shares it. Mobile number: if you did not sign in with UAE PASS, we ask for a UAE mobile number when you request a service and confirm it with a code sent by SMS. Property: the details you add or scan, and the title deeds and tenancy contracts you choose to share from UAE PASS. Rent, cheques, expenses, mortgages, and payment plans you enter. We add public Dubai Land Department data that matches your properties, such as transactions and service charges. Service requests and payments: what you ask for, your notes, quotes, bookings, and payment records (reference, amount, status). Card details go to Stripe and never reach us. Device and technical: your push notification token, app version, device platform, the result of the device integrity check described below, and your IP address in request logs and rate limits. Usage: anonymous analytics about which features get used, described below. Messages: feedback you send in the app and anything you write to us by email or WhatsApp.

Your UAE PASS, Apple, or Google password. Those services handle sign-in on their own systems, and Mulki has no passwords of its own. Your biometrics. If you lock the app with Face ID or your fingerprint, the check happens on your device and never leaves it. Your card numbers or bank credentials. Payments are handled by Stripe. Your location. The app never asks for access to your device location. Advertising or tracking data. Mulki contains no advertising SDKs and no crash-reporting SDKs, and does not track you across other apps or websites. We never sell personal data.

From the service you sign in with: UAE PASS, Apple, Google, or our email code. From documents you choose to share from UAE PASS. From you, as you add and edit details or scan a document. From public Dubai Land Department data, which we match to the property details you give us. We do not look up your records with your Emirates ID. Automatically, through request logs, the device integrity check, and the anonymous analytics described below.

You can photograph a title deed, an initial sale contract, or a tenancy contract to fill in a property's details. The photo is sent to OpenAI, which reads the printed fields and returns them to the app for you to check. We do not store the photo, and only the details you confirm are saved to your account.

To protect your data from scraping and fake requests, the app uses Apple App Attest on iOS and Google Play Integrity on Android. These confirm that a request comes from a genuine copy of the Mulki app on a real device. We use the result only for that purpose and store only what is needed to recognise your device's app key.

We use PostHog to count which features get used. The analytics are anonymous: we do not link them to your name, email, or account, PostHog does not look up your location from your IP address, and session recording is turned off.

We process your personal data under UAE Federal Decree-Law No. 45 of 2021 (the 'PDPL'). Consent is the default basis (Article 4); the PDPL also sets out cases in which consent is not required (Article 5). Consent: to receive the identity attributes UAE PASS returns when you sign in, and the documents you share from it. Marketing messages are sent only with separate opt-in. You can withdraw consent at any time. Contract: to deliver the service to you under our Terms, including passing your request to a service provider. Legitimate interest: to keep the service secure, prevent fraud, improve the product through anonymous analytics, and reach you about important account matters. Legal obligation: to retain certain financial records as required by UAE commercial and tax law, and to respond to lawful requests from UAE authorities.

To build and show your portfolio. To compute indicative valuations and rental yields. To pass service requests to providers and payments to Stripe. To send notifications you have chosen. To show the app in English or Arabic. To keep the platform secure. To improve features through anonymous usage data. To answer you when you write to us. If we ever need to process your data for a new purpose, we will tell you first and ask for consent where required.

Service providers: when you request a service, the provider handling it receives what they need to quote and do the job. That means the property and the request details, and for the job itself your name, mobile number, and the property's address. Our team: new service requests and enquiries are posted to a private Discord channel our team works from. The post includes your name, mobile number, email address, the property, and the details of your request. The providers listed in the next section, each for its own task. We share nothing else, and we never sell personal data.

Each provider below receives only what it needs for its task and may use it only to provide that task to us. Hetzner Online: servers and the database that holds your account. Germany. LightNode: a server in Dubai that runs our property data service and relays UAE PASS sign-in. UAE. Cloudflare: network security and delivery, and storage for floor plan images. Global network. Stripe: payment processing. USA. Mapbox: maps. Your device requests map images from Mapbox when you view a map. USA. PostHog: anonymous product analytics. USA. OpenAI: reading the fields of a document you scan. USA. Apple and Google: Sign in with Apple, Google sign-in, push notifications (Apple Push Notification service and Firebase Cloud Messaging), and the device integrity checks. USA. Expo: delivering push notifications and app updates. USA. Message Central and Twilio: sending SMS verification codes. WhatsApp (Meta): delivering WhatsApp updates you switch on, sent through a WhatsApp gateway we run ourselves. Global. Resend: transactional email, including sign-in codes. USA / EU. Zoho Mail: our team mailboxes. India / UAE. Discord: internal team alerts about new requests. USA. UAE PASS (operated jointly by Digital Dubai, the Telecommunications and Digital Government Regulatory Authority (TDRA), and the Department of Government Enablement) and the Dubai Land Department are sources of data, not processors: UAE PASS for identity and the documents you share, the Dubai Land Department for public property records and service charge data (including the Mollak system). This list will be updated as we add or change providers in any material way.

Your account data is stored in Germany, and several providers above are based outside the UAE. When we transfer personal data abroad, we rely on the safeguards permitted under Article 22 of the PDPL, including the data protection terms these providers offer, together with encryption in transit. For EU residents, we extend GDPR-equivalent protections regardless of where data is processed.

While your account is open, we keep the personal data needed to deliver the service. When you delete your account, the process described in the next section applies. Records of payments and bookings are kept for the period UAE commercial and tax law requires. Photos you scan are not stored. Anonymous analytics may be kept indefinitely, because they cannot be tied back to you.

You can delete your account in the app: Profile, then Account details, then Delete account. You are signed out on every device straight away, and your push notification tokens are removed. If you signed in with Apple, we revoke Mulki's access to your Apple ID. For 30 days you can restore the account by signing in again. After 30 days, we delete any documents and files stored with your account, your sign-in identities and login codes, push tokens, notifications, and notification preferences, and we blank the identity details on the account (name, Emirates ID number, nationality, gender, email, and mobile). We do keep some records after that. A copy of your account details, including your Emirates ID number, is moved to a restricted archive, and your property and booking history is retained, as are the records of any documents you shared through UAE PASS. We keep these for legal, accounting, fraud-prevention, and dispute purposes, and access to them is limited to what those purposes need. Write to [email protected] if you want to ask about them.

Data between the app and our servers travels over encrypted HTTPS connections. On your phone, your session is kept in the device's secure storage (the iOS Keychain or Android Keystore). The app never talks to our database directly: every request goes through our API, which checks who you are and returns only your own data. Device integrity checks block requests that do not come from the genuine app. The optional Face ID or fingerprint lock runs entirely on your device. Access to production systems is restricted to the people who need it. If we ever discover a personal data breach likely to result in risk to you, we will notify the UAE Data Office within 72 hours of becoming aware of the breach, and tell you without undue delay, in line with Article 9 of the PDPL and its Executive Regulations. If you find a security issue, write to [email protected]. We read those first.

Access (Article 12): know what we hold about you and obtain a copy. Correction (Article 15): fix data that is inaccurate or incomplete. Deletion (Article 15): ask us to delete your personal data, subject to legal retention obligations. Restriction of processing (Article 16): pause processing in certain situations. Portability (Article 17): receive your data in a structured, machine-readable format. Objection (Article 18): object to processing carried out under legitimate interest. Withdrawal of consent (Article 6): at any time, where processing relies on it. Complaint: to the UAE Data Office if you believe your rights have been infringed. For EU residents, equivalent rights under the GDPR apply.

Some of these rights are built into the app. You can see the details we hold on your profile, change your mobile number, export your portfolio as a CSV or PDF file, change your notification choices, and delete your account. For anything else, write to [email protected] from the email address linked to your Mulki account. We will verify your identity and respond within 30 calendar days. We do not charge a fee, unless a request is manifestly unfounded or excessive.

Mulki is not intended for, and may not be used by, anyone under 18. If we become aware that we have collected personal data from a person under 18, we will delete it.

Transactional messages (sign-in codes, booking and quote updates, security alerts, account changes) are part of the service and are always sent. The monthly portfolio digest by push, email, or WhatsApp, and alerts about prices and sales, are optional. You can switch each one on or off in the app's notification settings. WhatsApp updates are off until you turn them on. Promotional messages about services reach you only if you switch service recommendations on. You can turn them off in the app at any time, or write to [email protected]. Doing so does not affect transactional messages.

We may update this policy as the product evolves, the law changes, or we add new sub-processors. The date at the top reflects the current version. If a change materially affects how we handle your data, we will tell you at least 30 days before it takes effect, by email and in the app.

For any privacy question, request, or complaint, write to [email protected]. We aim to resolve substantive requests within 30 calendar days. If you are unhappy with our response, you may complain to the UAE Data Office, established under UAE Federal Decree-Law No. 44 of 2021. EU residents may also complain to the supervisory authority in their country of residence.