Privacy policy

The service is operated by [legal entity name, registration number and registered address — to confirm] (“ArkBoss”, “we”, “us”).

We play two different roles, and which one applies depends on whose data it is:

• Workspace users — the agency staff who sign in. For their account data we are the controller: we decide why and how it is processed.
• A workspace’s contacts — leads, customers, owners, tenants and the other people an agency records in its workspace. For this data the agency is the controller and we are its processor: we process it only on the agency’s instructions, to provide the service. If you are one of an agency’s contacts, the agency’s own privacy notice applies, and requests about your data are best sent to the agency first. We will help them answer.

About workspace users

• Name, work email, phone number, role, team and reporting line.
• Sign-in data: hashed password, two-factor settings, session and device information, IP address.
• Professional details the agency records, such as a broker licence or RERA card number and its expiry.
• Activity in the service: the records a user creates or changes, kept in an audit log.
• Billing contact and subscription details for the workspace. Card details are handled by the payment provider, not stored by us.

About a workspace’s contacts (entered by the agency, imported, or received through a connected channel)

• Identity and contact details: name, phone numbers, email, nationality, language, company.
• Property interests: requirements, budget, preferred areas, viewings, offers, bookings and deals.
• Documents the agency attaches, such as quotations, invoices, tenancy contracts and ID copies where the agency collects them.
• Communications: WhatsApp and email messages, call logs and — only where the agency switches it on — call recordings.
• Source and attribution: the campaign, portal, web form or advert a lead came from.
• Consent and preferences, including marketing opt-outs and do-not-call flags.

From visitors to a web form — the answers they submit, which arrive in the agency’s workspace as a lead, and basic technical data (IP address, browser) used to stop abuse.

• To provide the service an agency has signed up for — storing records, routing leads, sending the messages its users send, and producing its reports. This is the performance of our contract with the agency.
• To secure the service — authentication, abuse and fraud prevention, the audit log, backups. This is our legitimate interest and a legal obligation to keep data secure.
• To support users — answering questions and fixing problems, with access to a workspace only as far as the request needs.
• To bill the workspace and keep financial records the law requires.
• To tell users about the service — changes, incidents and, where they have not opted out, product news.

We do not sell personal data, we do not use a workspace’s contact data for our own marketing, and we do not use it to train general-purpose AI models.

Where an agency relies on consent — for example to send marketing messages — it is the agency’s responsibility to obtain and record that consent. The service records opt-outs and blocks marketing to contacts who have opted out or asked not to be called.

An agency can connect a WhatsApp Business number and, separately, Facebook and Instagram lead adverts. We connect through the WhatsApp Business Platform, via our Meta Tech Provider [Tegain, or the provider in use — to confirm], and through Meta’s Graph API.

• What we receive: messages to and from the connected number (text, media, delivery and read status), the sender’s WhatsApp profile name and number, message template status, and the answers people submit in the agency’s lead forms.
• What we do with it: show it in the agency’s inbox, attach it to the right lead or customer, and let the agency reply. Nothing else.
• What we send to Meta: the messages and templates the agency’s users send, and the phone numbers they send them to.
• We do not use data from Meta’s platforms for advertising, profiling or any purpose other than showing it to the agency that connected it.

Deleting Meta data. An agency can disconnect WhatsApp or lead adverts in Settings → Integrations at any time; we stop receiving data immediately. To have data received from Meta deleted, delete the conversation or record in the workspace, or write to us at the address under Contact naming the workspace and the phone number or Facebook account concerned. We confirm deletion within 30 days. Meta’s own handling of WhatsApp data is described in WhatsApp’s and Meta’s privacy policies.

A user can connect their own Google or Microsoft account. Each scope is asked for only when the feature that needs it is switched on:

• Gmail or Outlook — to send email from the user’s own address and to show replies from a lead or customer on that person’s record.
• Google Calendar — to create and update the viewing and meeting events the user schedules.
• Google Sheets and Drive file names — to import leads from a sheet the user picks, or to sync leads to one.

ArkBoss Estate’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular: we use Google user data only to provide the features above to the user who connected it; we do not transfer it to others except as needed to provide those features, for security, or to comply with law; we do not use it for advertising; and no person reads it unless the user asks us to for support, it is needed for security, or the law requires it. Google user data is not used to develop, improve or train generalised AI or machine-learning models.

A user can disconnect an account in the service at any time, or revoke access from their Google or Microsoft account settings. We then delete the stored access tokens.

We use these providers to run the service. Each processes personal data only to provide its part of it, under a written agreement.

• [Hosting and database provider, and its region — to confirm] — application servers and database.
• Cloudflare (R2 object storage) — documents, images and other files.
• Amazon Web Services (Simple Email Service) — system email such as invitations and password resets.
• Meta Platforms and [Tegain, as Meta Tech Provider — to confirm] — WhatsApp messaging and lead adverts, when connected.
• Google and Microsoft — email, calendar and sheets, when a user connects them.
• Zadarma — calling, call logs and recordings, when telephony is switched on.
• Stripe and Razorpay — subscription and payment-link processing.
• Property portals the agency connects (for example Property Finder, Bayut and dubizzle) — listing publication and the enquiries they send.
• Browser push services (run by the browser’s maker) — notifications a user has allowed.
• [AI provider, if AI features are enabled — to confirm] — lead scoring and drafting suggestions.

We give workspace owners notice before adding a sub-processor, so they can object.

Workspace data is stored in [country or region of primary storage — to confirm]. Some sub-processors above operate outside Oman and the UAE. Where data leaves the country it was collected in, we transfer it only as the applicable law permits — to a country the regulator recognises as giving adequate protection, or under contractual safeguards and the other conditions the Oman and UAE laws set for cross-border transfers.

• Workspace data is kept while the workspace is active. The agency decides how long to keep each contact and can delete records at any time.
• A deleted workspace is kept for 30 days so an accidental deletion can be undone, then permanently purged. Backups containing it are overwritten within [backup retention period — to confirm].
• The audit log is kept for the life of the workspace, because it is the record of who changed what.
• Call recordings are kept for as long as the agency’s recording settings say.
• Billing records are kept for as long as tax and accounting law requires.
• Security logs are kept for [log retention period — to confirm].

Subject to the conditions and exceptions in the applicable law, you have the right to:

• be told what personal data is processed about you, why, and who receives it;
• get a copy of it, and have it in a portable, machine-readable form;
• have inaccurate data corrected and incomplete data completed;
• have data erased, or its processing restricted, where the law allows;
• object to processing — including, at any time, to direct marketing;
• withdraw consent, where processing relies on it, without affecting what was done before;
• object to decisions based solely on automated processing that significantly affect you;
• complain to the regulator — in Oman, the Ministry of Transport, Communications and Information Technology; in the UAE, the UAE Data Office.

Workspace users can see and correct most of their data in their profile, and can write to us for the rest. An agency’s contacts should write to the agency, which controls their data; if you write to us instead, we will pass the request on and help the agency answer. We respond within the period the law sets, and may need to confirm your identity first.

• Data is encrypted in transit (TLS) and at rest.
• Each workspace is isolated at the database level, so one agency’s query cannot return another’s rows.
• Access inside a workspace follows roles the agency sets, down to own, team or all records.
• Two-factor sign-in and sign-in policies are available to every workspace; the audit log cannot be edited or deleted by anyone.
• Staff access to customer workspaces is limited to what a support request or incident needs.

If a breach affects personal data, we notify the affected agencies without undue delay, and the regulator and affected people where the law requires it.

The service is for businesses and is not directed at children. Agencies should not record sensitive personal data — health, biometric or genetic data, religious or political beliefs, or criminal records — in the service unless the law allows it and any permit it requires has been obtained.

We will post any change here with a new effective date, and tell workspace owners by email before a material change takes effect.

Privacy questions and requests: [privacy contact email — to confirm].
Post: [registered address — to confirm].
Data protection officer or representative: [name, if appointed — to confirm].

See also our Terms of service.