Use your browser's Print command to print this page or save it as a PDF. Back to the page.
Privacy Policy
This page is in English. If a translation is published, the English text prevails.
1. Who we are
1.1 This Privacy Policy explains how personal data is handled in Propliyo, a listing and customer relationship management service for real estate brokerages in the United Arab Emirates, on the Propliyo website at https://propliyo.com, and in the support and sales contact we have with people directly.
1.2 Propliyo is supplied by VortexWeb L.L.C-FZ, a company in the Meydan Free Zone, Dubai, United Arab Emirates, registered address Meydan Grandstand, 6th floor, Meydan Road, Nad Al Sheba, Dubai, United Arab Emirates ("VortexWeb", "we", "us" or "our"). VortexWeb contracts with every Customer, issues every invoice and is responsible for this Privacy Policy.
1.3 VortexWeb Cloud LLP, an affiliate of VortexWeb in Noida, India, provides engineering and support staff who act only on VortexWeb's instructions and under a written contract with VortexWeb. VortexWeb Cloud LLP is not a party to any Customer's Agreement. Its staff can open a brokerage's records only through the logged support session described in section 7.
1.4 In this Privacy Policy, "Service" means Propliyo, including Liyo, Liyo Studio, the website feed, the open API and the mobile app. "Customer" means a brokerage or a Solo Agent that holds a Propliyo account. "Authorised User" means a person whom a Customer allows to use the Service. "Admin" means an Authorised User with administrator rights. "Customer Data" means the data a Customer or its Authorised Users load into the Service or collect through it. "Portal" means Property Finder, Bayut, dubizzle or another listing portal the Service connects to. "Agreement" means the Terms of Service and the documents they include. "Liyo" means the assistant in the Service that drafts, checks, summarises and suggests.
1.5 We process personal data under Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the "PDPL") and any regulations issued under it. This Privacy Policy should be read with the Terms of Service at /legal/terms and, for Customers, the Data Processing Agreement (section 3 of the Terms page).
2. Our two roles
2.1 VortexWeb as controller. VortexWeb decides why and how the following data is used, and is the controller for it:
- account data about Customers, Admins and Authorised Users, used to create accounts, sign people in and run the Service;
- billing, payment and tax records;
- security, audit and fraud prevention records about use of the Service;
- data about visitors to the Propliyo website;
- data about people who ask for a demo, apply to become a partner, or contact our support or sales team.
2.2 VortexWeb as processor. For the data a brokerage keeps in the Service about its own business, the brokerage is the controller and VortexWeb is its processor. This covers listings, leads, contacts, landlords, sellers, tenants, buyers, deals, open house visitors, attendance records and files. VortexWeb processes this data only on the brokerage's documented instructions, as the Data Processing Agreement sets out. The brokerage decides what to collect, why, who may see it and how long to keep it.
2.3 Requests about a brokerage's clients. If you are a lead, contact, landlord, seller, tenant, buyer or visitor of a brokerage, please contact that brokerage first. If you write to us about data a brokerage controls, we forward your request to the brokerage within 5 working days and tell you that we have done so, unless the law prevents it.
3. What we collect
3.1 Admins and Authorised Users. Name, work email address, mobile number, role and permissions, branch and team, the broker registration number (BRN) the brokerage enters for a listing agent, profile photo where added, language and display choices, a protected password hash, multi-factor authentication settings, device and session information, and a record of the actions taken in the Service, held in an audit log.
3.2 Leads and enquirers. Name, phone number, email address, the property or requirement asked about, budget, language, the source of the lead (including the Portal that sent it), messages, call notes, tasks, consent and marketing choices, and the history of the enquiry. Leads from Property Finder are labelled Property Finder and are never pooled, linked or merged with leads from other sources.
3.3 Contacts, landlords, sellers, tenants and buyers. Contact details, the property and unit, ownership and authority records (such as a Form A), offers, viewings, deal history, documents the brokerage uploads for its own compliance duties, and the notes its Authorised Users record. Designated personal fields are stored encrypted.
3.4 Open house visitors. Name and phone number, the property visited, and the visitor's answer to the statement read out at the viewing. The brokerage records whether the visitor agreed to be contacted about the property and, separately, whether the visitor agreed to receive other property offers.
3.5 Attendance. For each clock in and clock out: the person, the time, whether it came from the web or the phone, and one place flag (inside office, outside office, no location, or no office set). The device location is recorded only when the person allows the browser or phone to share it at that moment, and it is stored encrypted. There is no tracking between clock in and clock out, no background location and no polling. If the person declines, the clock in or out still works. Locations never appear in reports, exports or logs and are never sent to Liyo or any other outside service.
3.6 Website visitors. Internet address, browser and device type, pages requested, time of the request, referring page, and anything typed into a form.
3.7 Demo and partner applicants. Name, company, role, work email, phone number, and the details given in the application.
3.8 Support. The ticket or chat, our reply, attachments the person chooses to send, and the details needed to resolve the request.
3.9 Payment details. Card details are entered on our payment provider's page and are held by that provider. VortexWeb does not store full card numbers.
3.10 We do not ask for, and the Service is not designed to hold, special categories of personal data such as health data or religious belief. Brokerages are asked not to type identity document numbers or scans into free text fields.
4. Why we use data and on what lawful basis
4.1 Where VortexWeb is the controller, we use personal data for the purposes and on the bases in this table.
| Purpose | Data | Lawful basis under the PDPL |
|---|---|---|
| Create and run accounts, sign people in, apply roles | Admin and Authorised User data | Performance of the Agreement with the Customer |
| Provide the Service and send service messages such as sign-in codes and incident notices | Account data | Performance of the Agreement |
| Billing, invoicing, collection and tax | Billing and subscription data | Performance of the Agreement and legal duties, including UAE VAT and Corporate Tax record keeping |
| Secure the Service, prevent fraud, keep the audit log, investigate misuse | Account, session, device and audit data | Processing necessary to perform the Agreement and to meet legal duties, which the PDPL permits; VortexWeb's need to secure the Service and prevent fraud is pursued only on that basis |
| Support | Ticket content and account data | Performance of the Agreement, or the request of the person who contacts us |
| Demo and partner applications | Applicant data | Steps taken at the applicant's request before a contract |
| Marketing our own services | Business contact data | Consent, or an existing customer relationship as section 13 describes |
| Legal claims and requests from authorities | As needed | Legal duties and the establishment or defence of legal claims |
| Website operation | Website visitor data | Processing necessary to provide the website the visitor asked for |
4.2 Where VortexWeb is a processor, it uses Customer Data only to provide the Service on the brokerage's instruction. The brokerage chooses the lawful basis for its own processing, for example performance of a contract with its client, its client's consent, or a legal duty such as its record keeping as a licensed broker.
4.3 Where processing relies on consent, the person may withdraw it at any time. Withdrawal does not affect processing done before it.
4.4 We do not sell personal data. We do not use Customer Data to build profiles of individuals for our own purposes. We may use aggregated statistics that do not identify any person to maintain and improve the Service.
5. Liyo and your data
5.1 Liyo drafts, checks, summarises and suggests. A person approves every output before it is used. Liyo never publishes, unpublishes, changes a price, sends a message or deletes anything on its own, and it makes no decision about anyone that has legal or similarly significant effects.
5.2 Before any text goes to an AI provider, the server replaces names, phone numbers, email addresses, Emirates ID numbers and passport-like numbers with markers. This works by pattern matching, so a detail written in an unusual way in free text may not be caught. For that reason Authorised Users are asked not to type personal data into Liyo.
5.3 Lead names, phone numbers, email addresses and message text are never sent to an AI provider.
5.4 Property Finder lead data is never sent to any AI provider. There is no setting that allows it.
5.5 Liyo conversation history is deleted after 30 days. For each Liyo run the Service keeps a redacted summary, token counts and the cost, with the brokerage's records, so the brokerage can see who approved what.
5.6 The AI providers that run Liyo are large language model, image, video and speech services operated in the United States. Under their commercial terms they do not use customer content to train their models. The product shows only the name Liyo; the providers are named in the sub-processor list available from support@propliyo.com.
5.7 A brokerage may choose to use its own AI key instead. It then holds its own contract with that provider and is responsible for where the provider processes the data and on what terms. The key is stored encrypted and only its last four characters are shown.
6. Who can see your data
6.1 Within the brokerage. A brokerage's Admins and Authorised Users can see the data in its account according to the roles and permissions the Admins set. Nobody in another brokerage can see it.
6.2 VortexWeb staff. VortexWeb and VortexWeb Cloud LLP staff open a brokerage's records only through a support session that states one reason and ends after 30 minutes at most. Starting and ending the session are written to the brokerage's audit log, which its Admins can read.
7. Who we send data to because the brokerage asked
7.1 A brokerage can connect the Service to other services. Data sent to them is sent on the brokerage's instruction, and each recipient handles it under its own terms. These recipients are chosen by the brokerage and are not VortexWeb's sub-processors:
- the Portals (Property Finder, Bayut and dubizzle), which receive approved listings with their media, agent details and permit details, and return status, quality scores and leads;
- the brokerage's own Bitrix24, which may receive leads and records; Property Finder leads pushed there stay labelled Property Finder and are never pooled;
- Meta lead ads and website forms the brokerage connects;
- Zapier and Make, outbound webhooks and the open API, which never receive Property Finder lead data;
- calendar and mailbox providers the brokerage connects for sync;
- WhatsApp click-to-chat, where a person opens a link with the number and a prepared text and sends it themselves; nothing is sent automatically;
- the brokerage's own website, through the website feed.
7.2 We may also share data with professional advisers, auditors and insurers under a duty of confidence, with courts, regulators and law enforcement where the law requires it, and with a successor if VortexWeb's business is transferred, on condition that the successor protects the data as this Privacy Policy describes.
8. Service providers and sub-processors
8.1 We use service providers that process data on our instructions under written contracts. By role they are:
| Role | Provider | What they receive |
|---|---|---|
| Hosting, database, file storage, outgoing email, secrets, audit anchor store | Amazon Web Services, Mumbai region (ap-south-1) | All Service data, encrypted |
| Card payments | Stripe Payments Europe, Ltd. | Billing contact and card data; cardholder data is processed outside the UAE under Stripe's terms |
| Error monitoring | Error monitoring service | Diagnostic events, with contact details scrubbed |
| Push notifications | Push notification service | Device token and short notification titles |
| Liyo | AI providers in the United States | Redacted text and listing facts, as section 5 describes |
8.2 The full list of sub-processors, with company names and locations, is available on request from support@propliyo.com. Customers are told of changes as the Data Processing Agreement sets out.
9. Where data is stored and processed
9.1 Since 28 October 2026 the Service is hosted in Amazon Web Services in Mumbai, India (ap-south-1). The application servers, the database, uploaded files, outgoing email, secrets, backups and the audit anchor store are there.
9.2 Support and engineering staff of VortexWeb Cloud LLP work from India and access data only through the logged support session. VortexWeb Cloud LLP processes under its contract with VortexWeb; no consent is sought from people in the UAE under Indian law for that processing.
9.3 Liyo's AI providers process in the United States, as section 5 describes. Stripe processes cardholder data outside the UAE.
9.4 Data is transferred outside the UAE under binding contractual safeguards with each recipient and, for Customer Data, on the brokerage's instruction under the Data Processing Agreement, in line with the PDPL.
9.5 Property Finder lead data is encrypted, is never sent to any AI provider or outbound tool, and is pushed only to the brokerage's own Bitrix24, labelled Property Finder. Property Finder has been notified in writing of the hosting in Mumbai.
10. How we protect data
10.1 We use technical and organisational measures that fit the risk, including:
- encryption in transit with TLS, including the database connection;
- encryption at rest of the database, files and backups, with designated personal fields, Portal credentials and AI keys encrypted again at field level;
- strict separation between brokerages, with every query scoped to the signed-in brokerage;
- role-based permissions set by each brokerage's Admins;
- multi-factor authentication for Admins and for the Platform console;
- a tamper-evident audit log of significant actions, including support sessions and anything that changes a live listing;
- private file storage with short-lived signed links, and uploaded images checked by file content and re-encoded;
- staff access limited to the logged 30-minute support session;
- secrets kept in a managed secret store, never in code;
- nightly encrypted backups and daily disk snapshots;
- redaction of tokens, passwords and contact details from logs.
10.2 A person who opens Propliyo from inside their brokerage's Bitrix24 is signed in by Bitrix24 and is not asked for a Propliyo MFA code there. The brokerage is responsible for the security of its Bitrix24. The Platform console is never opened that way.
10.3 If a personal data breach affects data for which VortexWeb is the controller, we notify the regulator and the people affected as the PDPL requires. If it affects a brokerage's data, we tell the brokerage's Admins without undue delay and within 72 hours of confirming it, and say at once if Property Finder lead data is involved.
10.4 No system is perfectly secure. Please keep your password private and tell us at support@propliyo.com if you suspect a problem.
11. How long we keep data
11.1 We keep personal data only as long as the purpose needs or the law requires. The periods are:
| Data | How long |
|---|---|
| Account and brokerage records | While the account is open, then 12 months after closure |
| Customer Data loaded by the brokerage (listings, leads, contacts, deals, files) | Until the brokerage deletes it or the account is deleted; purged 30 days after an approved deletion request |
| Invoices and tax records | 7 years from the end of the tax period, as UAE Corporate Tax law requires |
| Audit log | While the account is open and 12 months after closure; the tamper-evident anchored copy is kept for 1 year |
| Support tickets and support chats | 24 months |
| Website analytics | 13 months |
| Backups | Database backups 35 days, disk snapshots 14 days, then overwritten |
| Attendance records | 12 months by default, or as the brokerage sets |
| Liyo conversation history | 30 days |
| Liyo run records (redacted summary, token counts, cost) | With the brokerage's records |
| Reels and Liyo Studio outputs | Rendered files 30 days after creation, or at once on an erase request; names typed into captions or brochures erased on request |
| Open API delivery logs | 30 days, without message bodies |
| Partner and demo applications | 24 months |
11.2 A brokerage's legal hold or a legal duty to keep a record can delay a deletion. The Service shows Admins when a hold blocks an erasure.
12. Your rights and how to use them
12.1 Under the PDPL you have the right to:
- access your personal data and receive information about how it is processed;
- have inaccurate data corrected and incomplete data completed;
- have your data deleted where it is no longer needed or was processed unlawfully;
- ask for processing to be restricted, for example while accuracy is checked;
- receive the data you gave in a structured, commonly used format, and have it sent to another controller where this is technically possible;
- object to processing, including processing for direct marketing, which we stop at once;
- object to a decision based only on automated processing that significantly affects you;
- withdraw consent at any time where processing relies on it;
- complain to the UAE Artificial Intelligence and Data Authority.
12.2 Admins can export the brokerage's data, correct records and raise account deletion requests in the app, under Settings, Security. Deletion requires typing the brokerage name. Requests about an individual contact are carried out by the brokerage in the CRM.
12.3 Everyone else, including Authorised Users, website visitors and applicants, can write to support@propliyo.com with the subject "Privacy request". We may ask for information to confirm your identity before we act.
12.4 We answer within one month of receiving a verified request. We do not charge a fee unless a request is clearly unfounded or excessive. Where the law allows us to refuse or limit a request, for example to keep tax records or protect another person's rights, we explain why.
12.5 Requests about a brokerage's clients are forwarded to the brokerage within 5 working days, as section 2.3 states, and the brokerage answers them.
12.6 Please contact us first so we can try to put things right. You may complain to the UAE Artificial Intelligence and Data Authority at any time.
13. Website enquiries on a brokerage's site
13.1 A brokerage may place a Propliyo enquiry form on its own website. The brokerage is the controller of the enquiries it receives.
13.2 Before sending an enquiry the visitor ticks a box that reads: "I agree that (brokerage name) may store my details and contact me about this enquiry." The brokerage's name appears in place of the words in brackets.
13.3 A second, optional box reads: "Also send me other properties that match what I am looking for, by email or WhatsApp. I can stop this at any time." Marketing is sent only when this box is ticked.
13.4 Every marketing message carries the line "Reply STOP to stop receiving property offers from (brokerage name)." A STOP reply is recorded against the contact and honoured.
13.5 The Service records the wording shown, its version and the time of each consent, so the brokerage can show what the person agreed to.
14. Cookies
14.1 The Propliyo app uses two cookies, both strictly necessary: a session cookie that keeps you signed in, and a refresh cookie that renews the session securely. The app sets no advertising or tracking cookies.
14.2 The app may keep display choices, such as a selected tab, in your browser's local storage. This stays on your device.
14.3 The Propliyo marketing website has its own cookie notice, shown on that website.
15. Marketing messages from us
15.1 We send marketing about Propliyo only to people who have consented, or to contacts of existing Customers about services similar to the ones they use.
15.2 Every marketing email has an unsubscribe link. You may also write to support@propliyo.com. Service messages, such as invoices, security alerts and notices of changes, are not marketing and continue while you have an account.
16. Children
16.1 The Service is for businesses and is not for anyone under 18. We do not knowingly collect personal data from children for our own purposes. If a brokerage records a minor in a family transaction, it is responsible for having the authority to do so. If you believe a child's data has reached us in error, write to support@propliyo.com.
17. Changes to this Privacy Policy
17.1 We may update this Privacy Policy when the Service, our providers or the law change. For a material change we give at least 30 days' notice by email to Admins and in the app, unless the law or a Portal requires a change sooner, in which case we give notice as soon as practicable.
17.2 The version and date at the top of this page show which text applies. Earlier versions are available on request from support@propliyo.com.
18. Contact
18.1 Privacy questions and requests: support@propliyo.com.
18.2 Security reports: support@propliyo.com.
18.3 Post: VortexWeb L.L.C-FZ, Meydan Grandstand, 6th floor, Meydan Road, Nad Al Sheba, Dubai, United Arab Emirates, Meydan Free Zone, Dubai, United Arab Emirates.