DAABOG Privacy Policy

Version 1.0 — effective 6 October 2026

Controller: DAABOG Technologies LLC, a Delaware (USA) limited liability company, formed 6 October 2026, operating the DAABOG platform at daabog.app and affiliated hosts ("DAABOG", "we", "us").

Contact: admin@daabog.com

1. Who we are and what this policy covers

DAABOG is a business-to-business (B2B) PropTech platform for off-plan real estate. Our users are real-estate professionals: individual agents, agencies, and property developers. The platform comprises:

• daabog.app — the main application: the off-plan project catalogue and map, professional social feed, listings, direct messages, broadcasts, and Deal Rooms.
• projectbriefing.com — white-label, tokenized project share pages for brokers' clients.
• dealroom.homes — the accountless client seat for Deal Room guests.
• sites.daabog.app and agent custom domains — white-label agent websites (e.g. an agent's own domain served through our infrastructure).
• daabog.com — the marketing site (static; hosted on Cloudflare Pages).
• daabog.net — the affiliated DAABOG CRM product (see Section 3).

This policy covers personal data processed across these surfaces. Where an agency or developer customer uses DAABOG to process their clients' data (notably Deal Rooms, deal-room guests, CRM tenant data, and leads), DAABOG acts as a processor on that customer's behalf and the customer's own privacy notice governs; our Data Processing Agreement applies between us and that customer. Section 2 sets out the role split per data category.

2. Controller / processor roles by data category

3. Where your data is processed (residency) and international transfers

All primary processing happens on infrastructure in the European Union:

• Application servers and the primary database: Hetzner, Nuremberg, Germany.
• Media object storage (feed/social media, avatars) and ingest staging: Hetzner Object Storage, Nuremberg, Germany.
• Project media and document storage: a Hetzner Storage Box in Germany.
• Encrypted off-site backups: a Hetzner Storage Box in Helsinki, Finland.
• The affiliated DAABOG CRM: Hetzner, Nuremberg, Germany.

The corporate controller is a US Delaware entity, and users include UAE data subjects (as well as users in other jurisdictions). Traffic to the Cloudflare-fronted public hosts transits Cloudflare's global edge network, and several sub-processors are US companies or process globally (Cloudflare, OpenAI, Google Firebase, Resend, Mozilla and Apple push services, Stripe and, when activated, Meta; Telegram processes globally) — so personal data is transferred outside the EU and outside the UAE in the course of providing the service. Transfers of personal data out of the European Union or the United Kingdom to a country without an adequacy decision rely on the European Commission's Standard Contractual Clauses (and, where UK law applies, the UK International Data Transfer Addendum) where a sub-processor's data processing terms provide them, or on the recipient's certification under the EU–US Data Privacy Framework where it holds one. Transfers of personal data out of the United Arab Emirates are made under Articles 22 and 23 of the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021): to countries with an adequate level of protection, or otherwise under the contractual safeguards and other conditions those articles permit. DAABOG Technologies LLC, a US company, is the controller of the personal data this policy describes and applies these safeguards to every transfer it makes.

4. What we collect

Account data. Email address, name, unique handle, password (Argon2 hash only — never stored or logged in plaintext), phone number verified via a one-time code (see Section 6 — Firebase), professional role and organization membership, account status, and notification preferences. Sessions are cookie-based (see Section 9). A browser session lasts 14 days from sign-in and is not extended, with at most 4 per account; a mobile-app session lasts 90 days from its last use, with at most 5 per account.

Verification documents. To obtain the verified badge we request professional brokerage credentials only (e.g. RERA or equivalent license) — not passports or national ID cards. Documents are never publicly served; only platform administrators can open them.

Content you publish. Posts, listings (sale/rental details, photos), stories, replies, reactions, channel broadcasts, and your white-label site content if you operate one.

Messages and Deal Rooms. Direct messages, channel and broadcast messages, Deal Room messages and shared files. Deal Room handling — including encryption and the consent ledger — is described in Section 7.

Engagement telemetry (first-party only). We record engagement events (e.g. project viewed, page class viewed, project shared) with: the event type, the subject id, your user id (if logged in), your role, the platform (web/app), and a timestamp. IP addresses are never stored in engagement events. Anonymous visitors are de-duplicated only in their own browser (sessionStorage) — no fingerprinting, no tracking cookies. Raw events are deleted after 180 days. There are no third-party analytics, advertising, or tracking pixels anywhere on the platform.

Server logs. Standard access logs (including IP addresses) are kept for abuse prevention and debugging. Share-link tokens and email addresses are logged only as hashes; passwords are never logged. Raw logs are kept for a short, bounded time (days to weeks).

Bug reports. If you use "Report a problem", we store your report text and optional screenshot.

Leads/enquiries. When a prospective buyer submits an enquiry on a white-label agent site, the enquiry (name/contact details/message as submitted) is relayed to the responsible agent or agency (by email, and/or into their CRM tenant where linked). We process this as a processor for that customer.

5. AI / LLM processing — what actually happens

We use OpenAI (api.openai.com, a US sub-processor) for narrowly-scoped, non-conversational back-office processing:

• Inventory import (operator-triggered): sample rows from availability spreadsheets/PDF price lists are sent to the model to propose a column-mapping template.
• Ingest agent: when a developer or broker emails inventory to our ingest address (or, in the future, sends it via WhatsApp — currently disabled), the following are sent to OpenAI: the text of the message/note (truncated), sample rows and extracted table text from attached spreadsheets/PDFs, and — for photographed price lists — the image itself (vision model). Nothing is acted on from model output without operator approval.
• Catalogue prose generation: project descriptions are generated from project metadata (location, specifications). No personal data is involved, and investment-return projections are removed from the output.

What is never sent to any AI provider: your direct messages, Deal Room content, social feed content, account credentials, and verification documents. The platform's AI use is confined to the inventory-ingestion and catalogue-copy paths above. AI processing is not "local only" — content on those paths leaves our servers and is processed by OpenAI under its API terms.

6. Sub-processors and third parties

The authoritative list, with what each receives, is the Sub-processor Register (Exhibit A to our DPA, published below on this page). Summary:

Server-side lookups that involve no personal data: frankfurter.dev (currency rates), nominatim.openstreetmap.org and overpass-api.de (project-coordinate geodata).

The DAABOG CRM (daabog.net) is our own affiliated product on our own infrastructure, not a third party; data moves between the platform and a customer's CRM tenant under the customer's link configuration.

7. Deal Rooms — confidentiality, encryption, and the consent ledger

Deal Rooms are the platform's confidential transaction workspace:

• In transit: all traffic is TLS-encrypted. For Cloudflare-fronted hosts, TLS terminates at Cloudflare's edge and is re-encrypted to our origin (Cloudflare therefore processes content in transit, as disclosed in Section 6).
• At rest: every chat message body (all conversation types) and every Deal Room shared file is encrypted with AES-256-GCM, and backups of this content stay encrypted.
• Key custody: the encryption keys are held by DAABOG, which decrypts content to provide the service (rendering rooms, certified exports). This is not end-to-end encryption. Access by our staff is restricted by policy; no administrator screen displays room content.
• Membership secrecy: the existence of a conversation is not disclosed to non-members.
• Consent gate: Deal Room content is only accessible after a member or guest accepts the room terms; the acceptance is recorded in a durable consent ledger that snapshots the accepter's name, handle, email, and phone at acceptance time. This ledger is evidentiary: it survives room deletion and account erasure (the user link is severed; the snapshot remains), and is disclosed at terms acceptance.
• Immutability and export: messages cannot be edited or deleted by participants. On leaving a room, a participant is offered a certified export (transcript and files); taking or declining it is recorded in the ledger.
• Deletion: room deletion is controlled by platform administrators. It hard-deletes content and leaves a metadata-only tombstone (room name, timestamps, actor ids — no content) retained for 6 years on a legal-claims basis.
• Guests: deal-room guests (your clients) access rooms via single-use invite links and a 30-day sliding session bound to one device; revocation immediately kills links and sessions. Guests receive content-free email digests (room title + link only).
• Notifications: push notifications for new messages carry a preview (up to ~100 characters). Push payloads are encrypted to your browser per the Web Push standard — the relaying push service (Google/Mozilla/Apple) cannot read them.

8. Push notifications and other communications

Web-push subscriptions are stored per browser and deleted when the endpoint reports itself dead or when you unsubscribe. Notification categories default to on; each category can be muted in preferences. Transactional email is sent via Resend from noreply@daabog.app. We hold back email where legally or contractually required.

Lead alerts. When someone enquires on an agent's website, the agent (the site owner, the agency's admin, and anyone the agency added to its alert list) is told at once by email, browser notification and, if they choose, Telegram. Each alert carries the enquirer's name, phone number, email address, message and the property they asked about, so the agent can reply directly. This is the purpose for which the enquirer submitted the form. Each recipient can switch each channel off in their profile. Telegram is used only by accounts that link the "Daabog Leads" bot themselves (a one-time link from the profile, then Start in Telegram); unlinking (Disconnect, or /stop in the chat) stops it at once. Telegram alerts are Telegram cloud messages and are not end-to-end encrypted.

9. Cookies and local storage

daabog.com, the marketing site, sets no cookies and sends visitor data to no third party other than Cloudflare, which hosts it (Section 6); the cookies below are set by daabog.app and the other platform hosts. We use no third-party cookies and no advertising or analytics cookies. First-party storage:

The Firebase SDK (phone verification) and the map tile loader (OpenFreeMap) make direct requests from your browser to those providers as described in Section 6.

10. Retention

The full schedule is Exhibit B to the DPA (daabog.com/dpa#retention). Highlights:

• Engagement events: 180 days.
• Ingest source files: 30 days after the intake settles; ingest metadata is kept as an operational record.
• Deal Room deletion tombstones: 6 years (metadata only).
• Deal Room consent ledger: retained indefinitely on a legal-claims basis.
• Billing/transaction records: 7 years, kept apart from all other data (tax/AML basis; overrides erasure).
• Backups: nightly, encrypted, off-site; pruned on a 7-daily / 4-weekly schedule (≈ one month of history). Deletions are re-applied after any restore, as an operational policy.
• Access logs: days to weeks.
• Chat/DM/social content: retained for the life of the account/conversation.

11. Your rights, and what deletion actually does

Subject to the UAE PDPL, applicable US law, and (for EU-processed data) EU rules, you can request access, correction, deletion/erasure, restriction, and objection, and you can withdraw consent where processing is consent-based. Requests go to admin@daabog.com; our target turnaround for erasure is 21 days.

How erasure works here — stated plainly:

1. You (or an operator on your request) file a deletion request; the account is marked as pending deletion.
2. A platform administrator reviews and approves. Approval is a safeguard, not a veto — a valid erasure request is honored within the SLA.
3. On approval the account is anonymized in place: name replaced ("Former member"), email replaced with an opaque non-routable address, phone numbers removed, avatar deleted, sessions revoked, password invalidated, marketing consent cleared. The same applies to organization records (office contact details cleared).
4. What survives, and why: your published content remains but is attributed to the anonymized identity; Deal Room consent-ledger snapshots and deletion tombstones remain (legal claims); audit trail entries remain (metadata only); billing records, when they exist, remain for 7 years (tax/AML); backups age out on the ≈ one-month cycle and deletions are re-applied on any restore. Verification credentials are handled per the retention schedule (daabog.com/dpa#retention).
5. There is no hard delete of accounts, by design — anonymization is the erasure mechanism.

Suspension/ban (for Acceptable Use violations) is separate from erasure: a restricted account's sessions are revoked and its content is hidden by the platform's visibility rules, but the data is retained unless erasure is separately requested and processed.

UAE data subjects may also lodge complaints with the UAE Data Office; EU-related complaints may go to a competent supervisory authority; other jurisdictions per applicable law.

12. Security

Beyond Section 7: the platform's hosts are firewalled and the database is never exposed publicly; passwords are stored only as Argon2 hashes; login and abuse-sensitive endpoints are rate-limited; each customer's data is access-controlled on every request; off-site backups are encrypted, with a tested restore procedure; destructive administrative actions are audited.

13. Children

The service is a B2B professional tool and is not directed at children. We do not knowingly process children's data.

14. Changes

We may change this Policy at any time. Changes that do not materially reduce your rights apply on publication. Material changes are announced by email or in-app at least 7 days before they apply, and this page shows the new version and effective date.