Privacy policy

2. The data we process

• Identity and contact details: name, phone, email address, country, language.
• Your property project: type of property, area, budget, timeline, financing, and what you tell us about it. If you agree, the record Aurèle keeps of your project (see section 4).
• Your exchanges with us: messages sent through our form, on WhatsApp or on Instagram, and transcripts of voice conversations with Aurèle, with their summaries.
• Your appointments: date, time, advisor, and the advisor's notes.
• Your contact choices: consent per channel (phone, WhatsApp, email, SMS) with its proof and date, and your objections.
• If you arrive through a Meta ad that opens WhatsApp: the ID and headline of that ad.
• If a transaction goes ahead: the identity documents and information required by anti-money-laundering rules (“KYC”). The AI assistant never asks for them.
• Technical data: server logs, a few preferences saved in your browser and our host's strictly necessary cookies, and anonymous first-party measurement of how the site is used (see section 8). To talk to Aurèle on the site: proof that you have verified your email address (see section 4).

3. Why we process them

• To answer your request and support your project (steps taken at your request, before and during a contract).
• To contact you again or send you information: only on the channels you have consented to, and you can withdraw at any time.
• To meet our legal obligations: Dubai real estate regulation (RERA / DLD) and anti-money-laundering law.
• To secure our services and prevent abuse.
• To know which ads bring in requests, without currently sending any personal data to Meta to measure our campaigns. If this changes, this policy will be updated first.

4. Our AI assistant

Aurèle is an artificial intelligence assistant and always introduces itself as such. It is neither a licensed broker nor an investment advisor, and it takes no decision with legal effects on you. A human advisor can take over the conversation at any time, on request.

To answer, Aurèle relies on artificial intelligence models provided by service providers (see section 5). Your messages are sent to them to produce the answer; where the option exists, we do not allow them to use your messages to train their models.

To talk to Aurèle on the site, by voice or in writing, you first enter your email address and type the six-digit code we send you. This step prevents abuse and limits the number of conversations: five codes per day per address, ten conversations per day and three per hour. We do not keep your address in plain text for this, only a fingerprint of the address, the code and your access, computed with a secret key, together with the number of codes, attempts and conversations and their dates. An optional box, never pre-ticked, lets you ask an advisor to contact you by email. If you tick it, we record your address as a contact request, with proof of your consent (text accepted and its version, date, IP address and browser). This consent is valid for 12 months and can be withdrawn at any time. If you had objected to being contacted, no request is created.

If you agree, Aurèle keeps a record of your project to support you better from one conversation to the next: your search criteria (budget, areas, type of property), your preferences and how much the standard of the property matters to you, the points that make you hesitate and what you fear you might regret, the criteria you ask it to watch, the elements of your decision and a summary. Aurèle must ask you before recording anything, and our system refuses to record it until your agreement has been signalled; a refusal is respected. It only retrieves this record if you give it both the phone number and the email address recorded with it: a record that holds only one of the two is not retrieved by Aurèle. After a viewing, your advisor may also record what you liked or what put you off. This record is partly written by artificial intelligence and may contain errors; only Aurèle and the authorised members of our team (the advisors handling your file, management) read it. At any time you can ask an advisor, or write to us (sections 13 and 14), to see it, correct it or delete it. It is deleted without delay once your identity has been verified, even if part of your file must be kept to meet a legal obligation.

5. Who we share them with

We never sell your data. It is accessible to our advisors and, only as far as necessary, to the following technical providers, who process it on our behalf:

• Supabase: hosting of our database (servers in India, Mumbai region).
• Lovable: website hosting and gateway to AI models; OpenAI: AI model used for Aurèle's written answers.
• ElevenLabs: Aurèle's voice and voice conversations.
• Meta (WhatsApp, Instagram, Facebook): delivery of the messages you send us on these services.
• Resend: sending our emails, including the access code for Aurèle; your address is passed to it only for this sending. Twilio: sending SMS, when this channel is used.
• Cloudflare: checking that the domain of your email address can receive messages. Only the domain (for example gmail.com) is passed to it, never the address.
• Cal.com: appointment booking.
• Google (Google Maps Platform): the 3D view of Dubai. It is loaded only if you click “See the neighbourhood in 3D” or “Fly over Dubai in 3D”, or if you open a conversation with Aurèle. Google then receives your IP address, technical information about your browser and the area of the map being shown; it receives neither your name, nor your email address, nor the content of the conversation. Google processes this data under its own privacy rules (policies.google.com/privacy).
• n8n: automation of internal tasks.
• Developers, conveyancers, banks or authorities: only when your transaction requires it, or when the law obliges us to.

6. Transfers outside the United Arab Emirates

Some of these providers process data outside the United Arab Emirates (notably in India, the United States and the European Union). We frame these transfers with contractual data protection commitments, in line with the PDPL and, where applicable, the GDPR.

7. How long we keep them

• Prospect with no follow-up: 3 years after our last exchange.
• Client: for the duration of the relationship, then 5 years after the end of the relationship or transaction.
• Anti-money-laundering (KYC) documents: 5 years after the end of the relationship or transaction, as UAE law requires.
• Consent to be contacted again: valid for 12 months at most, renewable; its proof is kept as long as it may be needed to show it was valid.
• Objection: kept as long as needed to respect it, including if you contact us later from another number belonging to the same person.
• Voice conversations with Aurèle: the audio recording and transcript are deleted automatically by our provider ElevenLabs after 90 days. The transcript and its summary, copied into our own database, follow the periods above (prospect or client); the audio is never copied there.
• Record kept by Aurèle: kept for at most 3 years after our last exchange (prospect) or 5 years after the end of the relationship or transaction (client), and deleted on request.
• Access to Aurèle on the site: the fingerprints and counters are deleted automatically 13 months after your last activity.
• Technical logs: from a few weeks to 12 months depending on the service.

8. Cookies and trackers

Our public website uses no advertising cookies. Our host, Lovable, measures site traffic for our statistics, with no advertising use: page views and time spent on the page, referrer, device type, display speed and technical errors. Its tool can also record clicks on buttons and links and form submissions: we have set it never to do so without your consent, and we do not ask for it. It records no replay of your visit, sets no cookie and keeps nothing in your browser: its visit identifier disappears when you leave the page. If your browser sends the “Global Privacy Control” signal, it respects that too.

Strictly necessary cookies, used neither for measurement nor for advertising: “__cf_bm”, set by our host's Cloudflare firewall to tell visitors from bots (30 minutes); “__dpl”, a technical cookie of our host Lovable, needed to serve you the site's pages; “sp360-lang”, which remembers the language you chose (12 months).

In your browser's storage (these are not cookies, and nothing is sent to a third party): your language, the closing of the banner that suggests another language, and the areas you add to your favourites in the 3D view (the list stays in your browser; we only count that an area was added, without knowing by whom). For members of our team only, a “team” marker, the same for everyone and with no identifier, lets us count their visits separately. The area reserved for the team also uses a session token for sign-in, and keeps for 30 minutes at most the page to reopen after a sign-in link. If you talk to Aurèle on the site, an access token valid for 30 days, which does not contain your address, saves you from requesting a new code on each visit.

To know which pages and campaigns bring requests, the site counts by itself, with no third-party tool, page views and a few actions (WhatsApp or phone click, first message in the written chat, opening of our voice assistant Aurèle, start and end of a conversation with it, with its duration rounded to ten seconds, the number of messages and the number of items Aurèle showed on screen, never their content, failure to start it, slot chosen, request sent, application sent, newsletter sign-up and its confirmation, PDF checklist request and its confirmation, appointment confirmed, first use of a calculator: purchase costs, mortgage, payment plan, comparison, opening of the 3D view, guided tour, area comparison and favourites in the 3D view, area opened on the developers' projects map), as well as how fast each page displays (three rounded measurements, nothing about what you do on it). For this it keeps, in the tab's storage that is erased when the tab closes (not a cookie), a randomly drawn identifier and the campaign parameters of your arrival (utm, and only the presence of an ad click identifier, never its value). We record neither your IP address, nor your browser, nor your contact details with these measurements, only a fingerprint of the identifier that changes every day; they are kept for 13 months at most. If you send a request, these campaign parameters are attached to it so we know where it came from.

The site's fonts are hosted on our own servers: displaying them sends no request to Google or to any other font provider.

9. Security

Access restricted by role and team, encrypted connections, technical secrets kept outside the code, and a log of sensitive actions. As no system is infallible, we will inform you and the competent authorities of any breach affecting your data where the law requires it.

10. Minors

Our services are intended for adults. We do not knowingly collect data about people under 18.

11. Market letter and project alerts

• Purpose: if you subscribe (page footer, guides, area pages), your email address, language, first name if given and your choices (monthly market letter, project alerts, area, maximum budget) are used only to send you these emails.
• Legal basis: your consent, given in two steps (“double opt-in”): the box ticked on the website, never pre-ticked, then the click on the link in the confirmation email. We keep proof of it: the text accepted and its version, the date and time of the request and of the click, the IP address and browser at both moments, and the landing page or campaign.
• Retention: the confirmation link expires after 7 days, and a request that is never confirmed is deleted within 30 days at the latest. A confirmed subscription is valid for 12 months, not tacitly renewed; its proof is kept for as long as it may be needed to demonstrate its validity.
• Unsubscribing: a link at the bottom of every email, effective immediately for all our mailings. The “I did not ask for this” link in the confirmation email deletes the request. Emails are sent through our provider Resend.

11a. “Buying in Dubai” PDF checklist

• Purpose: if you request the checklist (at the end of a guide), your email address and language are used only to send you a confirmation email, then the download link, which is personal and valid for 7 days. Both emails answer your request: without the “monthly letter” box, you are subscribed to no mailing and no prospect record is created.
• Monthly letter (optional): if you tick the box, never pre-ticked, the confirmation click also subscribes you to the market letter, with the same proof and the same duration as section 11 (12 months, one-click unsubscribe). The IP address and browser are kept only in that case, as proof.
• Retention: the confirmation link expires after 7 days; every request, confirmed or not, is deleted within 30 days at the latest, which also applies to an erasure request. The “I did not ask for this” link deletes the request. The file is stored in a private area of our Supabase database; emails are sent through our provider Resend.

12. Applications and business introducers

• Purpose: if you apply to become an advisor or propose to act as a business introducer (Join us page), your name, contact details, country, chosen market, your answers to the form and your message are used only to review your application or proposal and to contact you about it.
• Legal basis: your consent, given by ticking the box below the form (never pre-ticked), and the steps taken at your request before any contract. We keep the text accepted and its version, the date and time, IP address and browser.
• Who sees them: SwissPro360's management team only, alerted by an email sent through our provider Resend.
• Retention: 24 months at most, then deleted. You can access, correct or erase them at any time (see your rights below). Please do not send us anyone else's contact details without their consent.

14. Deleting your data

1. Send an email with the subject “Delete my data”, stating the phone number and/or email address you used with us.
2. We check that the request comes from you, then delete or anonymise your data within 30 days, including the history of your exchanges on WhatsApp, Instagram and with Aurèle.
3. We keep only what the law requires us to keep, and a minimal record of your objection so that we never contact you again. We confirm the deletion in writing.
4. If the law requires us to keep part of it (for example anti-money-laundering documents, 5 years after the end of the relationship or transaction), our answer tells you so, with the period concerned.

Contact us : chakir@swisspro360.com