Privacy Policy

Last updated:
[DD.MM.YYYY]
Controller:
[LEGAL NAME OF THE COMPANY OR SOLE OWNER], [JURISDICTION OF REGISTRATION]
Contact for privacy requests:
privacy@earlyflat.com

Draft — not yet finalised. This document still contains unfilled placeholders in square brackets. The site owner must complete them and have the text reviewed by a UAE-qualified lawyer before relying on it.

1.Introduction

This Privacy Policy explains how earlyflat ("earlyflat", "we", "us") collects, uses, shares, and protects personal data when you use our website at earlyflat.com and related services (the "Service") — an aggregator of property rental and sale listings in Dubai. We act as the data controller for the personal data described below.

We process personal data in accordance with the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) and, where applicable, the EU General Data Protection Regulation (GDPR).

2.Data we collect

You provide directly:

  • Email address (registration, passwordless login codes).
  • Account settings: preferred language, notification channels and frequency.
  • Saved searches, favorites, comparison selections.
  • Community comments you post.
  • Telegram account link (your Telegram chat_id) if you connect the bot.

Collected automatically:

  • Device/browser fingerprint and technical identifiers (anti-abuse, one-trial-per-account enforcement).
  • Session and authentication tokens.
  • Usage and analytics events (pages viewed, role, funnel actions such as sign-in, checkout opened) via PostHog — only if you accept analytics in the cookie banner.
  • Error and diagnostic data via Sentry.
  • Log data (IP address, timestamps) for security and operation.

From third parties:

  • If you sign in with Google, we receive your basic profile and verified email from Google (via OAuth).
  • Payment status/transaction confirmation from Paddle (we do not receive or store your full card details).

We do not intentionally collect special/sensitive categories of personal data.

4.Who we share data with (processors & recipients)

We share personal data only with service providers that process it on our behalf:

  • Paddle — payment processing (Merchant of Record). Paddle is the seller of record for transactions and applies its own buyer terms and privacy notice.
  • Resend — transactional email delivery.
  • Google — OAuth sign-in (if used).
  • Telegram — alert delivery to your linked account (if used).
  • PostHog (EU region) — product analytics.
  • Sentry (EU/Germany region) — error monitoring.
  • Our hosting/infrastructure provider on which the Service runs.

We do not sell personal data. We may disclose data where required by law or to protect our rights.

5.International transfers

Some processors operate outside the UAE (e.g. EU, USA). Where personal data is transferred internationally, we rely on the recipients' appropriate safeguards and their compliance frameworks (e.g. GDPR-readiness, standard contractual protections), consistent with the cross-border transfer conditions of the UAE PDPL.

6.How long we keep it

We keep personal data only as long as necessary for the purposes above:

  • Account data — while your account is active; deleted on account deletion.
  • Login codes — expire after 10 minutes.
  • Sessions/refresh tokens — up to their validity period.
  • Analytics/log data — [RETENTION PERIOD, e.g. 12–24 months], then aggregated or deleted.
  • Payment records — as required for accounting/legal obligations.

7.Your rights

Under the UAE PDPL (and GDPR where applicable) you have the right to: access your data; correct inaccurate data; delete your data ("right to be forgotten"); receive your data in a machine-readable format (portability); restrict or object to processing; and not be subject to solely automated decisions with legal/similar effects.

You can delete your account and associated personal data directly in the Service (Profile → delete account), which triggers deletion on our side. For any other request, contact privacy@earlyflat.com; we respond within a reasonable timeframe. You may also withdraw consent (e.g. disable analytics via the cookie settings link in the footer) at any time without affecting prior lawful processing.

8.Security

We apply technical and organizational measures to protect personal data, including HTTPS/TLS everywhere, hashed credentials, scoped access tokens with rotation, server hardening (firewall, intrusion prevention), and restricted access to production systems. No method is 100% secure, but we work to protect your data against unauthorized access, loss, or misuse.

9.Data breach

In the event of a personal data breach likely to cause harm, we will notify the UAE Data Office and affected individuals as required by the PDPL, without undue delay.

10.Cookies & analytics

We use essential cookies necessary for the Service (e.g. session/authentication) and, subject to your consent, analytics cookies and local storage (PostHog) to understand usage. Analytics is not loaded at all until you accept it: if you decline, PostHog is never initialized and no analytics identifiers are written to your device.

You can change your decision at any time via the "Cookie settings" link in the site footer, or through your browser settings.

11.Children

The Service is intended for users aged 18 and over and is not directed at children. We do not knowingly collect data from minors.

12.Changes

We may update this Policy. Material changes will be posted here with an updated "Last updated" date.

13.Contact

Questions or requests: privacy@earlyflat.com — [LEGAL NAME OF THE COMPANY OR SOLE OWNER], [REGISTERED ADDRESS].

14.Languages

This Policy is published in English, Russian, and Arabic. The Russian and Arabic versions are provided for convenience; in case of any discrepancy, the English version prevails.

Questions about your data or privacy? Write to us — we answer every request.

privacy@earlyflat.com

Back to top