distress.ae
Home›Privacy Policy

Privacy Policy

Effective: 2026-05-11 · Last updated: 2026-05-11

1. Who We Are

This Privacy Policy explains how Distress PORTAL (the “Platform,” “we,” “our,” or “us”), operated by Khazhimurod Khusanbaev (the “Operator”), collects, uses, shares, and retains personal data of Users of distress.ae (the “Service”). The Operator, based in Dubai, United Arab Emirates, is the data controller for the purposes of UAE Federal Decree-Law No. 45 of 2021 on Personal Data Protection (“PDPL”).

2. Scope

This Policy applies to all data we collect through distress.ae and any communication channels we operate (email, WhatsApp). It does not apply to third-party websites or services we link to.

3. Personal Data We Collect

3.1 Data you provide when posting a listing

  • Full name
  • Contact phone number (used to reveal to interested buyers when they tap “Show number”)
  • WhatsApp opt-in status
  • Property address details (building or community, area, emirate)
  • Property attributes (bedrooms, bathrooms, size, price, photographs)
  • Title-deed number (optional; kept admin-only and never displayed publicly)
  • If you identify as an agent: brokerage name, BRN, agent profile slug

3.2 Data we collect when you contact a seller or buyer

  • The fact you tapped “reveal phone” on a listing (channel: call or WhatsApp)
  • Timestamp of the reveal
  • Your IP address and User-Agent string (for fraud prevention and rate limiting)
  • If applicable, your role declaration (agent or buyer) and one-time profile details (name, brokerage and BRN for agents; buyer status and timeline for buyers)

3.3 Data we collect when you submit a valuation request or report a listing

  • Form-submitted contact details (name, phone, email if provided)
  • Free-text content you write
  • Submission timestamp, IP address, User-Agent

3.4 Technical data

  • Pages visited, referrer, session timing
  • Device type, browser, operating system
  • Cookies as described in Section 9 below

3.5 Data we do NOT collect

  • Emirates ID numbers
  • Financial account or payment details
  • Passport scans
  • Biometric data
  • Religious, political, or health information

4. How We Use Personal Data

We use personal data for the following purposes, on the corresponding PDPL legal basis:

  • Operate the Service — render listings, reveal phone numbers to legitimate enquirers. Legal basis: performance of contract (PDPL Art. 4(2)).
  • Communicate with you about your listings. Legal basis: performance of contract.
  • Manually verify Dubai listings against the Dubai REST app. Legal basis: legitimate interest in publishing accurate listings.
  • Prevent fraud, scam listings, and abuse. Legal basis: legitimate interest.
  • Comply with legal obligations under UAE law. Legal basis: legal obligation (PDPL Art. 4(3)).
  • Aggregate visitor analytics to improve the Service. Legal basis: legitimate interest.
  • Send marketing communications (only if you opt in, in the future). Legal basis: consent (PDPL Art. 4(1)). Currently dormant.

5. Sharing Personal Data with Third-Party Processors

We share personal data with the following categories of processors. We do not sell personal data.

  • Hosting provider — Vercel Inc. (USA). Serves the website to your browser.
  • Cloud database, file storage, and authentication provider — Supabase Inc. (USA, hosted on Amazon Web Services). Stores listings, accounts, photographs, and contact-event logs.
  • DNS and edge-security provider — Cloudflare Inc. (USA). Routes web traffic to the Service.
  • Backup storage — GitHub Inc. (USA, a Microsoft subsidiary). Stores encrypted daily database backups.
  • Search and analytics tools — Google LLC (USA). Google Search Console for SEO indexing; may include Google Analytics for visitor analytics (your consent will be requested before analytics activates).

Email delivery and SMS providers will be added to this list and notification will be posted on the Service at least 30 days before activation.

We may also disclose personal data:

  • When required by UAE law, court order, or regulatory authority (RERA, DLD, Dubai Police, UAE Data Office)
  • To enforce or apply our Terms of Service
  • To protect the rights, property, or safety of the Platform, its Users, or others (including fraud prevention)

6. International Data Transfers

Some processors listed in Section 5 host data outside the United Arab Emirates. PDPL Article 22 permits cross-border transfer where the destination jurisdiction provides an adequate level of protection or where appropriate safeguards (such as standard contractual clauses) are in place. We rely on the standard contractual terms in our agreements with each processor.

7. Data Retention

We retain personal data for the periods set out below, after which it is deleted or anonymized:

  • Active listings — for as long as the listing is live, plus 90 days after the listing is marked sold or expires.
  • Phone-reveal event logs — 12 months from the reveal.
  • Report submissions — 12 months from submission.
  • Valuation form submissions — 12 months from submission.
  • Database backups — 90 days.
  • Anonymized aggregate analytics — indefinitely.

8. Your Rights as a Data Subject

Under PDPL Articles 13 to 22, you have the right to:

  • Access the personal data we hold about you (PDPL Art. 13)
  • Correction of inaccurate or incomplete data (PDPL Art. 14)
  • Deletion of your data, subject to legal retention obligations (PDPL Art. 15)
  • Restriction of processing while a request is investigated (PDPL Art. 16)
  • Object to processing based on legitimate interest (PDPL Art. 17)
  • Data portability — receive your data in a portable format (PDPL Art. 18)
  • Withdraw consent previously given (consent-based processing only)

To exercise any of these rights, email support@distress.ae with your request and sufficient detail for us to locate your data. We will respond within 30 days of receipt. We may need to verify your identity before fulfilling the request.

If you believe we have not handled your request properly, you may lodge a complaint with the UAE Data Office.

9. Cookies and Similar Technologies

distress.ae uses the following categories of cookies:

  • Strictly necessary — session management, security tokens, admin authentication, role gate. Cannot be disabled.
  • Functional— remember your “My Listings” device, role choice (agent/buyer), agent profile pre-fill. Optional; set only after you interact.
  • Analytics — aggregated visitor analytics (Google Analytics, when enabled). Optional; your consent will be requested before activation.

We do NOT use advertising cookies or cross-site tracking pixels.

10. Children's Privacy

The Service is not intended for and is not directed at persons under 18. We do not knowingly collect personal data from minors. If you believe a minor has provided us data, contact support@distress.ae and we will delete it promptly.

11. Security

We take reasonable technical and organizational measures to protect personal data, including: encryption in transit (TLS), row-level access controls on our database, hashed credentials, restricted admin access, and daily encrypted backups. No system is ever fully secure. If we become aware of a personal-data breach that is likely to result in significant harm to affected Users, we will notify both the affected Users and the UAE Data Office within the timeframes required by PDPL.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be announced on the Platform homepage at least 30 days before they take effect. The “Last updated” date at the top of this Policy shows the most recent revision.

13. Contact

For privacy questions, data-subject requests, or any other concern about how your data is handled, contact support@distress.ae.

Distress PORTAL · Dubai, United Arab Emirates