Privacy Policy

1. Who We Are

This Privacy Policy explains how Distress PORTAL (the “Platform,” “we,” “our,” or “us”), operated by Khazhimurod Khusanbaev (the “Operator”), collects, uses, shares, and retains personal data of Users of distress.ae (the “Service”). The Operator, based in Dubai, United Arab Emirates, is the data controller for the purposes of UAE Federal Decree-Law No. 45 of 2021 on Personal Data Protection (“PDPL”).

2. Scope

This Policy applies to all data we collect through distress.ae, through the distress.ae mobile app for Android and iOS, and through any communication channels we operate (email, WhatsApp). It does not apply to third-party websites or services we link to.

3. Personal Data We Collect

3.1 Data you provide when posting a listing

• Full name
• Contact phone number (used to reveal to interested buyers when they tap “Show number”)
• WhatsApp opt-in status
• Property address details (building or community, area, emirate)
• Property attributes (bedrooms, bathrooms, size, price, photographs)
• Title-deed number (optional; kept admin-only and never displayed publicly)
• If you identify as an agent: brokerage name, BRN, agent profile slug

3.2 Data we collect when you contact a seller or buyer

• The fact you tapped “reveal phone” on a listing (channel: call or WhatsApp)
• Timestamp of the reveal
• Your IP address and User-Agent string (for fraud prevention and rate limiting)
• If applicable, your role declaration (agent or buyer) and one-time profile details (name, brokerage and BRN for agents; buyer status and timeline for buyers)

3.3 Data we collect when you submit a valuation request or report a listing

• Form-submitted contact details (name, phone, email if provided)
• Free-text content you write
• Submission timestamp, IP address, User-Agent

3.4 Technical data

• Pages visited, referrer, session timing
• Device type, browser, operating system
• Cookies as described in Section 9 below

3.5 Data we collect when you use the AI assistant

The Service offers an assistant (“Distress Live”), on this website and in our mobile app, that answers questions about recorded property sales and published UAE property rules. In the mobile app, it asks for your agreement before your first question is sent. When you send it a question:

• The question you typed is sent to our AI processor (named in Section 5) to be routed and worded
• The question you typed is also stored by us, together with the assistant’s reply as you saw it, the outcome (answered, or the reason it could not be answered), the language you used, and any building or area name the question mentioned
• A random conversation code that links the questions asked in one chat. It is created in your browser tab, or in the mobile app, when you start a chat, and replaced when you choose “Start over” (in the app, also when the app is closed); it does not identify you
• If you use the mobile app: which app you used (iPhone or Android) and its version number
• A one-way cryptographic digest of your IP address — used to group repeated questions and to prevent automated abuse. The IP address itself is not stored and the digest cannot be converted back into it

We store questions for one reason: the assistant may only repeat answers a human has written and verified, so the questions it could not answer are the list of answers we need to write next. Questions are retained as described in Section 7. Please do not type personal or financial details into the assistant — it does not need them to answer, and a question is stored as you wrote it.

If you report an assistant answer, we store the reason you select, your optional comment, the linked answer or the copy of the question and answer sent by your app, and whether that copy was shortened. We also store a random report code to prevent duplicate submissions, the conversation code when available, the app and version labels, and an IP digest to limit abuse. A submitted copy is treated as unverified visitor text. Our team reviews reports for accuracy and safety and records the action taken. Reports do not automatically train the AI or trigger action against a person. Please leave personal and financial details out of report comments.

There is one place the assistant does ask for a contact detail, and only if you choose to give it. When you ask for a property we have nothing matching, the assistant offers to tell you if one is listed later. If you tap that offer, we store what you were looking for (the area or building, the size, and a budget if you give one) together with the one contact detail you type — a WhatsApp number or an email address. We do not ask for your name and we do not keep your question alongside it.

We use it for one thing: to contact you about matching listings. It is not shared, not sold, and not added to any marketing list. Nobody is signed up to anything automatic — a person reads the request and writes to you. Ask us to delete it at any time (Section 9) and we will. Otherwise it is kept as described in Section 7.

3.6 Data we collect when the mobile app crashes

The distress.ae mobile app reports its own crashes to an error-reporting processor (named in Section 5). Without this, a fault on your phone reaches nobody — the app simply stops working and we never learn that it did. A crash report contains:

• The technical description of the fault, and the point in our own code where it happened
• Device model, operating-system version, and the version of the app you are running

We have not switched on the setting that would attach identifying information to these reports, and the app never tells the reporting service who you are. No crash report is linked to your account, and crash reports are not combined with any other record we hold. They are sent only from the installed mobile app, never from this website.

3.7 Data we do NOT collect

• Emirates ID numbers
• Financial account or payment details
• Passport scans
• Biometric data
• Religious, political, or health information

4. How We Use Personal Data

We use personal data for the following purposes, on the corresponding PDPL legal basis:

• Operate the Service — render listings, reveal phone numbers to legitimate enquirers. Legal basis: performance of contract (PDPL Art. 4(2)).
• Communicate with you about your listings. Legal basis: performance of contract.
• Manually verify Dubai listings against the Dubai REST app. Legal basis: legitimate interest in publishing accurate listings.
• Prevent fraud, scam listings, and abuse. Legal basis: legitimate interest.
• Comply with legal obligations under UAE law. Legal basis: legal obligation (PDPL Art. 4(3)).
• Aggregate visitor analytics to improve the Service. Legal basis: legitimate interest.
• Answer questions asked of the AI assistant, and decide which answers to write next by reviewing the questions it could not answer. Legal basis: legitimate interest.
• Send marketing communications (only if you opt in, in the future). Legal basis: consent (PDPL Art. 4(1)). Currently dormant.

5. Sharing Personal Data with Third-Party Processors

We share personal data with the following categories of processors. We do not sell personal data.

• Hosting provider — Vercel Inc. (USA). Serves the website to your browser.
• Cloud database, file storage, and authentication provider — Supabase Inc. (USA, hosted on Amazon Web Services). Stores listings, accounts, photographs, and contact-event logs.
• DNS and edge-security provider — Cloudflare Inc. (USA). Routes web traffic to the Service.
• Backup storage — GitHub Inc. (USA, a Microsoft subsidiary). Stores encrypted daily database backups.
• Email delivery provider — Plus Five Five, Inc., trading as Resend (USA). Sends the emails the Service sends: account emails, notices about listings and documents, and alerts when a buyer makes contact. It receives the recipient’s email address and the content of each email, which can include a buyer’s name and phone number when we tell a seller about an enquiry.
• AI language provider — Anthropic PBC (USA). Receives the question you type into the assistant, in order to route it and to put verified facts into readable English. It is not permitted to answer from its own knowledge, and it is not given your name, contact details, or account data.
• Search and analytics tools — Google LLC (USA). Google Search Console for SEO indexing; may include Google Analytics for visitor analytics (your consent will be requested before analytics activates).
• Search and analytics tools — Yandex LLC (Russian Federation). Yandex Webmaster for search indexing; Yandex Metrica for visitor analytics, which helps us improve the Service for our Russian-speaking audience. Metrica loads only after you grant analytics consent, stores its data on servers in the Russian Federation, and runs with session recording (Webvisor) disabled.
• Error-reporting provider — Functional Software, Inc. d/b/a Sentry (USA). Receives crash reports from the distress.ae mobile app, as described in Section 3.6. It is not given your name, contact details, or account data.

If we start using another processor, such as an SMS provider, we will add it to this list and post a notice on the Service at least 30 days before it starts.

We may also disclose personal data:

• When required by UAE law, court order, or regulatory authority (RERA, DLD, Dubai Police, UAE Data Office)
• To enforce or apply our Terms of Service
• To protect the rights, property, or safety of the Platform, its Users, or others (including fraud prevention)

6. International Data Transfers

Some processors listed in Section 5 host data outside the United Arab Emirates. PDPL Article 22 permits cross-border transfer where the destination jurisdiction provides an adequate level of protection or where appropriate safeguards (such as standard contractual clauses) are in place. We rely on the standard contractual terms in our agreements with each processor.

7. Data Retention

We retain personal data for the periods set out below, after which it is deleted or anonymized:

• Active listings — for as long as the listing is live, plus 90 days after the listing is marked sold or expires.
• Phone-reveal event logs — 12 months from the reveal.
• Report submissions — 12 months from submission.
• Valuation form submissions — 12 months from submission.
• AI assistant questions and replies — 90 days from the question. After that the text is deleted; where we acted on a question, an anonymized record of the decision is kept without the question, the reply, the conversation code or the IP digest.
• Reports about assistant answers — expire 90 days from the report, or sooner when the linked question reaches its 90-day limit or is deleted or anonymized. This covers the report reason, comments, copied text, review notes, report and conversation codes, app labels and caller digest. Expired reports stop being available immediately and are removed by hourly cleanup.
• Contact details you leave in the AI assistant to be told about a listing — 6 months from the request. If we have not answered it by then the whole record is deleted; where we did contact you, the area and budget are kept as demand data and your contact details and IP digest are erased.
• Database backups — 90 days.
• Mobile app crash reports — kept by our error-reporting processor for the retention period of our plan with that processor, then deleted. They are not linked to your account and are not combined with any other record.
• Anonymized aggregate analytics — indefinitely.

8. Your Rights as a Data Subject

Under PDPL Articles 13 to 22, you have the right to:

• Access the personal data we hold about you (PDPL Art. 13)
• Correction of inaccurate or incomplete data (PDPL Art. 14)
• Deletion of your data, subject to legal retention obligations (PDPL Art. 15)
• Restriction of processing while a request is investigated (PDPL Art. 16)
• Object to processing based on legitimate interest (PDPL Art. 17)
• Data portability — receive your data in a portable format (PDPL Art. 18)
• Withdraw consent previously given (consent-based processing only)

To exercise any of these rights, email support@distress.ae with your request and sufficient detail for us to locate your data. We will respond within 30 days of receipt. We may need to verify your identity before fulfilling the request.

If you believe we have not handled your request properly, you may lodge a complaint with the UAE Data Office.

9. Cookies and Similar Technologies

distress.ae uses the following categories of cookies:

• Strictly necessary — session management, security tokens, admin authentication, role gate. Cannot be disabled.
• Functional — remember your “My Listings” device, role choice (agent/buyer), agent profile pre-fill. Optional; set only after you interact.
• Analytics — aggregated visitor analytics (Google Analytics and Yandex Metrica, when enabled). Optional; your consent will be requested before activation, and Yandex Metrica is not loaded at all until you grant it.

We do NOT use advertising cookies or cross-site tracking pixels.

10. Children's Privacy

The Service is not intended for and is not directed at persons under 18. We do not knowingly collect personal data from minors. If you believe a minor has provided us data, contact support@distress.ae and we will delete it promptly.

11. Security

We take reasonable technical and organizational measures to protect personal data, including: encryption in transit (TLS), row-level access controls on our database, hashed credentials, restricted admin access, and daily encrypted backups. No system is ever fully secure. If we become aware of a personal-data breach that is likely to result in significant harm to affected Users, we will notify both the affected Users and the UAE Data Office within the timeframes required by PDPL.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be announced on the Platform homepage at least 30 days before they take effect. The “Last updated” date at the top of this Policy shows the most recent revision.

13. Contact

For privacy questions, data-subject requests, or any other concern about how your data is handled, contact support@distress.ae.

Distress PORTAL · Dubai, United Arab Emirates