Terms

Terms of Service

1. Parties and acceptance

1.1 These Terms of Service are a master subscription agreement between VortexWeb L.L.C-FZ, a company established in Meydan Free Zone, Dubai, United Arab Emirates under trade licence 2420891.01, with its registered address at Meydan Grandstand, 6th floor, Meydan Road, Nad Al Sheba, Dubai, United Arab Emirates and tax registration number 104559941000003 ("VortexWeb", "we" or "us"), and the Customer. VortexWeb supplies the Service, contracts with every Customer, issues every invoice and holds the payment account through which Fees are charged.

1.2 A brokerage accepts these Terms through the person who creates its account, starts a Trial, completes a checkout or signs an Order on its behalf. That person becomes its first Admin and confirms that they have authority to bind the brokerage. If they do not have that authority, they must not accept, and they are personally responsible for any use made of the Service on that basis.

1.3 A Solo Agent accepts these Terms for themself when they create a Solo Agent account. A Solo Agent must be at least 18 years old and entitled to carry on real estate activity in the United Arab Emirates.

1.4 The Customer accepts these Terms by ticking the acceptance box at sign-up, by signing an Order that refers to them, or by using the Service after notice of a change under clause 27. Clause 28 describes how acceptance is recorded.

1.5 VortexWeb Cloud LLP, of Noida, India, is an affiliate of VortexWeb that provides engineering and support staff who act on VortexWeb's instructions. It is not a party to the Agreement. VortexWeb is responsible for its acts under the Agreement as if they were VortexWeb's own.

2. Definitions

2.1 In the Agreement these words have the following meanings:

• Admin means an Authorised User whom the Customer has given the administrator role in the Service, with control over users, roles, settings, Portal connections, integrations and billing.
• Agreement means these Terms of Service, each Order, the Data Processing Agreement, the Liyo AI Addendum, the Pricing and Billing Terms, the Cancellation and Refund Policy, the Acceptable Use Policy and the Support Policy.
• Authorised User means an individual whom the Customer allows to use the Service under its account, including employees, agents, brokers, contractors and Admins.
• Customer means the brokerage or other business that accepted these Terms or signed an Order, or, on the free plan, the individual Solo Agent who accepted them. "Brokerage" refers to a business Customer.
• Customer Data means all data and material that the Customer or its Authorised Users enter, upload, import, connect or generate in the Service, including listings, photographs, documents, leads, contacts, deals, activity records, settings and approved Liyo output.
• Fees means the amounts payable for a Plan, Packs and any other item under the Pricing and Billing Terms or an Order.
• Liyo means the assistant in the Service that drafts, checks, summarises and suggests, including Liyo Studio.
• Order means a checkout in Plan and billing, an order form signed by both parties, or any other plan selection by which the Customer subscribes.
• Pack means a one-time purchase of extra Units.
• Plan means the subscription plan that the Customer has selected or been assigned, with its listing cap, user cap, features and Unit allowance.
• Portal means a third-party property listing platform with which the Service exchanges listings, status or leads, including Property Finder, Bayut and dubizzle, and the brokerage's own website feed where it receives listings from the Service.
• Service means Propliyo, the software service supplied by VortexWeb, including its web and mobile applications, programming interfaces, Liyo, integrations, documentation and support.
• Trial means the free evaluation period described in clause 7.
• Unit means one unit of Liyo usage, equal in value to AED 1 of usage at the price list shown in Plan and billing. A Unit is not money and has no cash value.

2.2 "Including" means including without limitation. A reference to a law includes that law as amended or replaced and any regulations issued under it. Headings are for convenience only.

3. Order of precedence

3.1 If parts of the Agreement conflict, they apply in this order: a signed Order, to the extent it states that it overrides these Terms; then these Terms of Service; then the Data Processing Agreement (section 3 of this page); then the Liyo AI Addendum (section 4); then the Pricing and Billing Terms; then the Cancellation and Refund Policy (section 2 of this page); then the Acceptable Use Policy (section 5) and the Support Policy (section 6).

3.2 VortexWeb's personal data practices for its own account, billing and website data are described in the Privacy Policy, which is a notice and not part of the Agreement.

4. The Service and the right to use it

4.1 Subject to the Agreement and payment of the Fees, VortexWeb grants the Customer a non-exclusive, non-transferable right, during the term, to let its Authorised Users use the Service for the Customer's own real estate business, within the limits of its Plan.

4.2 The Customer must not resell, rent or provide the Service to another business, run it as a bureau for other brokerages, or use one account to publish for another brokerage, unless VortexWeb agrees in writing.

4.3 The Service is multi-tenant. VortexWeb keeps each Customer's data separate by the technical controls described in the Data Processing Agreement. The Customer must not try to reach another customer's data.

4.4 A feature labelled beta, preview or early access is provided as it is, may change or be withdrawn without notice, and should not be relied on for a critical process. A feature described as planned or coming soon is not part of the Service until released, and the Customer must not buy in reliance on it.

5. Accounts, Admins and Authorised Users

5.1 A brokerage must have at least one Admin at all times. Admins invite and remove Authorised Users, assign roles and capabilities, connect Portals and integrations, and manage billing.

5.2 Each login belongs to one named person. Logins must not be shared, and one person must not hold several logins to get around a cap. The Customer must keep its account details accurate, including its legal name, trade licence, Office Registration Number where it has one, tax registration number where registered for VAT, and its Admin and billing contacts.

5.3 The Customer is responsible for every act and omission of its Authorised Users as if they were its own, and for making sure they follow the Agreement and the Acceptable Use Policy.

5.4 Admins sign in with email, password and multi-factor authentication. Other Authorised Users must use multi-factor authentication where the Service asks for it. A person who opens Propliyo from inside their brokerage's own Bitrix24 is signed in by Bitrix24 and is not asked for a Propliyo multi-factor code there. The Customer is responsible for the security of its Bitrix24, including who has access to it. The Platform console is never opened through Bitrix24.

5.5 The Customer must keep credentials secure and tell VortexWeb at support@propliyo.com without delay if it suspects that a login, key or connection has been compromised.

5.6 Offboarding. When a person leaves the Customer or no longer needs access, an Admin must deactivate their login promptly and reassign their listings, leads and tasks. A deactivated person's records stay with the Customer. The Customer is responsible for anything done through a login it failed to deactivate.

5.7 Support access. VortexWeb staff, including staff of VortexWeb Cloud LLP, can open the Customer's records only through a support session that states one reason, ends after 30 minutes at most, and is written to the Customer's audit log when it starts and ends. VortexWeb never asks for a password and never signs in to the Customer's Portal accounts. The Support Policy (section 6) gives the detail.

6. Plans, users and listing caps

6.1 Pricing is flat per brokerage, not per user. Each Plan has a cap on the number of Authorised Users, a cap on live Portal listings, a set of features and a monthly Unit allowance per user. The figures for each Plan are set out in the Pricing and Billing Terms and shown in Plan and billing.

6.2 The Solo Agent plan is free, is for one person, and does not include Portal publishing or Portal leads.

6.3 When the Customer reaches its user cap it cannot add another Authorised User until it removes one or moves to a larger Plan. When it reaches its live listing cap it cannot publish another listing until it is under the cap or moves to a larger Plan. Reaching a cap never unpublishes a live listing.

6.4 Enterprise and Custom plans, and any custom software arrangement, are supplied under an Order. A custom software plan is assigned by VortexWeb only and is billed under the Customer's existing contract.

7. Trial

7.1 A brokerage may take one Trial of the Growth Plan for 7 days. Card details are taken at the start. The Trial includes 20 Units in total and does not include the free cinematic reel.

7.2 VortexWeb emails the Admins about 2 days before the Trial ends. Unless an Admin cancels before the Trial ends, the Growth Plan is charged monthly from the end of the Trial.

7.3 A Trial is available once per brokerage. VortexWeb may refuse or end a Trial that appears to repeat an earlier one or to avoid payment, or that is being misused.

7.4 The Solo Agent plan has no Trial because it is free.

8. Fees, renewal and autopay

8.1 The Customer pays the Fees shown in Plan and billing or in its Order at the time of purchase. Fees are in UAE dirhams and exclude VAT, which is added at the rate in force while VortexWeb is registered for VAT. The Pricing and Billing Terms govern billing intervals, Units, Packs, coupons, invoices, failed payments and plan changes.

8.2 Fees are paid in advance for monthly, yearly or two-year terms. Each paid term renews automatically for a term of the same length unless it is cancelled before the renewal charge.

8.3 Autopay is on whenever a card is on file. The Customer authorises VortexWeb and its payment provider to charge that card for each renewal, each upgrade and each Pack it buys. The card cannot be removed while a paid Plan is active; the Customer must cancel the Plan first or replace the card.

8.4 Card payments are processed by Stripe Payments Europe, Ltd. under its own terms. Cardholder data may be stored and processed outside the United Arab Emirates, and the Customer agrees to that. VortexWeb does not see or store full card numbers.

8.5 VortexWeb may issue invoices through an accredited e-invoicing service provider when the UAE e-invoicing rules apply to it.

8.6 A price change never applies in the middle of a paid term. VortexWeb gives at least 30 days' notice of a price change under clause 27, and the new price applies from the first renewal after the notice period.

8.7 The Customer must tell VortexWeb at support@propliyo.com of any disputed charge, with reasons, within 30 days of the charge, and must pay any undisputed part on time.

9. Cancellation

9.1 An Admin may cancel a paid Plan at any time in Plan and billing, or, if the Service cannot be used, by email from an Admin address to support@propliyo.com. The cancellation takes effect at the end of the current paid term. A request received after a renewal charge applies to the next term.

9.2 After cancellation the Customer keeps full use until the end of the paid term. The account is then read only for a 30-day export window, after which the Customer may request deletion under clause 26.

9.3 Refunds are given only in the cases set out in the Cancellation and Refund Policy (section 2 of this page). There is no refund for a change of mind, unused days or unused Units.

10. Suspension and read-only mode

10.1 Failed payment. If a charge fails, the payment provider retries it. If an amount is still unpaid 7 days after it fell due, the account becomes read only. Authorised Users can still see listings, leads and records; nothing is deleted; Portal leads keep arriving; Admins see Fix payment. Full access returns as soon as the payment goes through.

10.2 Breach. VortexWeb may suspend or restrict the Service, an Authorised User, a Portal connection or a feature if it reasonably believes that the Customer or an Authorised User is in material breach of the Agreement, the Acceptable Use Policy or a Portal's rules.

10.3 Security risk. VortexWeb may suspend or restrict access at once where use of the account creates a risk to the security, integrity or availability of the Service, other customers or a Portal connection, including a suspected compromised login or key.

10.4 Legal demand. VortexWeb may suspend or restrict access, or remove or disable Customer Data, where a court, regulator or other competent authority requires it, or where a Portal requires it under the conditions on which it gives access to its interface.

10.5 Where it is lawful and practical, VortexWeb will tell the Admins the reason before or promptly after a suspension, keep it to what is needed, and restore access when the cause is fixed. A suspension does not unpublish live listings unless a court, regulator or Portal requires it, and does not end the duty to pay Fees.

11. Customer responsibilities

11.1 Listing accuracy. The Customer alone is responsible for the accuracy, completeness and legality of every listing and all other Customer Data, including the property's existence, unit, location, size, price, status, availability, ownership, description and photographs. The Service blocks publishing where a required field is missing; it never fills a default, and its checks are not verification.

11.2 Permits and Madmoun QR. Before a listing is advertised, the Customer must hold a valid advertising permit, including a Trakheesi permit and its Madmoun QR code where the regulator requires them, and must make sure that the permit number and details entered match the official record and the property advertised.

11.3 BRN and ORN. The Customer must hold a valid Office Registration Number (ORN) and make sure that every listing agent holds a valid Broker Registration Number (BRN). In the Service a listing agent is a person with a BRN. A Team member without a BRN may own listings only under a listing agent whom the Customer chooses.

11.4 Licences and authority. The Customer must hold every trade licence, registration and owner authority, including Form A where required, that its business and each advertisement needs, and must not advertise a property it is not authorised to market.

11.5 Portal contracts and rules. The Customer must hold and keep in good standing its own account and contract with each Portal it uses, and must follow each Portal's rules on content, permits, media, quotas, duplicates, pricing, agent verification and leads.

11.6 Takedown. The Customer must take a listing down from every Portal and its website promptly when the property is sold, rented or withdrawn, or when the permit or owner authority ends.

11.7 Bitrix24. Where the Customer connects its Bitrix24, it is responsible for that Bitrix24's configuration, users, access rights and security, and for what it does with records the Service sends there.

11.8 Consent for its own contacts. The Customer is responsible for having a lawful basis, and giving any notice the law requires, for the personal data of the leads, owners, tenants, buyers and other contacts it loads into or collects through the Service.

11.9 Telemarketing. Where the Customer or its Authorised Users call or message people about property, the Customer is responsible for complying with Cabinet Resolution No. 56 of 2024 and any other telemarketing rules, including: calling only between 09:00 and 18:00 UAE time; not calling a person again after they decline; not calling numbers on the Do Not Call Registry; using local numbers registered on its trade licence; holding any approval of the Telecommunications and Digital Government Regulatory Authority that applies; and keeping the records the rules require. The Customer must apply the same consent rules to WhatsApp messages and SMS. The Service warns when a call is started outside the permitted hours and never blocks a callback to a person who made an enquiry. WhatsApp from Propliyo is click-to-chat only: an Authorised User opens the link and sends the message; nothing is sent automatically.

11.10 Records. The Customer must keep its own records of permits, owner authority, consents and approvals and must not rely on the Service as the only place they are kept.

11.11 Acceptable use. The Customer must comply, and make its Authorised Users comply, with the Acceptable Use Policy (section 5).

12. Third-party services

12.1 The Service works with services that VortexWeb does not control, including the Portals, the Customer's Bitrix24, Stripe, the providers of AI models used by Liyo, Amazon Web Services as hosting provider, Zapier and Make, and calendar and mailbox providers. Some of these are VortexWeb's sub-processors, listed in the Data Processing Agreement; others are recipients that the Customer chooses to connect.

12.2 Each third-party service is provided under its own terms. Where the Customer connects a service of its own choice, the Customer's contract with that provider governs it, and the Customer is responsible for checking where it processes data and on what terms.

12.3 VortexWeb is not liable for a third-party service's changes, outages, errors, moderation, rejection or removal of listings, fees, quota reductions, penalties, or suspension or termination of the Customer's account with it.

12.4 VortexWeb connects to Portals only through their official interfaces and to Dubai Land Department open data under its terms. It does not scrape Portals and does not use unofficial data resellers. Being a supported Portal describes a technical integration only and does not make VortexWeb a Portal's agent or reseller.

12.5 VortexWeb may be bound by conditions that a Portal attaches to its interface, including limits on how data is used, stored, labelled and shared. VortexWeb may apply technical controls, rate limits, blocks and labels to meet those conditions, and the Customer must not try to get around them.

13. Changes to the Service

13.1 Portal changes. If a Portal changes, restricts, suspends or ends its interface or the terms on which VortexWeb uses it, VortexWeb may change, pause or stop the affected integration, in each case without liability. VortexWeb will tell the Admins by email and in the Service as soon as practicable and, where it can, offer a replacement such as a file export.

13.2 Feature changes. VortexWeb may improve and change the Service. Where VortexWeb retires a feature that a Plan lists, it gives at least 30 days' notice by email to the Admins and in the Service, except where a law, a regulator or a Portal requires a faster change, in which case it gives notice as soon as practicable.

13.3 If a retirement under clause 13.2 materially reduces what the Customer's Plan provides, the Customer may cancel under clause 9 before its next renewal. A refund is due only in a case listed in the Cancellation and Refund Policy.

14. Support and availability

14.1 VortexWeb provides support as described in the Support Policy (section 6): in-app tickets under Help and email to support@propliyo.com, Monday to Friday, 10:00 to 18:00 Gulf Standard Time, excluding UAE public holidays.

14.2 VortexWeb uses reasonable care to keep the Service available, but these Terms give no uptime commitment. An uptime target and service credits apply only where an Enterprise or Custom Order states them, and then the credits stated are the Customer's only remedy for missing the target.

14.3 VortexWeb may carry out maintenance, and gives notice where possible. Urgent security or stability work may be carried out without notice.

15. Customer Data and licence to process

15.1 Ownership. As between the parties, the Customer owns Customer Data.

15.2 Licence to process. The Customer grants VortexWeb a non-exclusive licence, for the term and for the periods in clause 26, to host, copy, process, transmit, display and back up Customer Data only as needed to provide, secure and support the Service for the Customer, to follow the Customer's instructions and to comply with law. VortexWeb does not sell Customer Data.

15.3 Roles. For personal data in Customer Data, the Customer is the controller and VortexWeb is its processor, under the Data Processing Agreement (section 3 of this page) and Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data. VortexWeb is the controller of its own account, billing, security and website data, as the Privacy Policy describes.

15.4 Where data is processed. The Service is hosted on Amazon Web Services in its Mumbai region (ap-south-1), in India: the application servers, the database, file storage, outgoing email, secrets and the audit record store. Staff of VortexWeb Cloud LLP in India support the Service. The Data Processing Agreement sets out the contractual safeguards for this processing and lists the sub-processors.

15.5 Aggregated counts. VortexWeb may use counts and other aggregated figures about use of the Service that contain no personal data and do not identify the Customer, to run, secure and improve the Service.

15.6 Disclosure required by law. VortexWeb may disclose Customer Data where a law or a binding order of a competent authority requires it and, where lawful, tells the Customer first.

15.7 The Customer warrants that it has, and will keep, the rights and lawful basis needed for VortexWeb to process Customer Data under the Agreement.

16. Property Finder leads

16.1 Leads received from Property Finder stay labelled as Property Finder leads in the Service. They are never pooled, linked or merged with leads or contacts from other sources.

16.2 Property Finder lead data is never sent to any AI provider. There is no setting that allows it.

16.3 Property Finder lead data is never forwarded to Zapier, Make, email tools, outbound webhooks or the open programming interface. It may be pushed only to the brokerage's own Bitrix24, labelled as Property Finder.

16.4 Property Finder's contract requires that its lead data is encrypted and is not stored or processed outside the United Arab Emirates without its written consent. Property Finder has been notified in writing of the hosting described in clause 15.4. Property Finder lead data is stored encrypted.

16.5 The Customer must not export, copy or relay Property Finder lead data in a way that breaks these rules or its own contract with Property Finder.

17. Migration and imports

17.1 The Service can import listings, contacts, leads and files from the Customer's earlier software, from files the Customer uploads, and from its own Bitrix24.

17.2 The Customer must check imported data before relying on it or publishing it. VortexWeb maps fields as the import screen shows but does not verify the content, and is not responsible for errors, gaps or duplicates that come from the source data.

17.3 Photo import. On the Customer's written request, and only with VortexWeb's approval for that brokerage, the Service may make a one-time copy of the brokerage's own listing photos from the Property Finder or Bayut image links held in its own Bitrix24. The copy covers only the brokerage's own listings, never another brokerage's photos, and the brokerage's own watermark setting in Propliyo applies. The Customer confirms that it is entitled to use those photos.

17.4 The Customer must not import data that it has no right to hold, including data copied from a Portal other than its own listings and leads.

18. Liyo

18.1 Liyo drafts, checks, summarises and suggests. Its output is a draft. An Authorised User must review and approve every output before it is used.

18.2 Liyo never publishes, unpublishes, changes a price, sends a message or deletes anything on its own.

18.3 Liyo output may be wrong, incomplete or out of date. The Customer must check every fact, figure, permit detail and claim before relying on or publishing it.

18.4 Use of Liyo is measured in Units under the Pricing and Billing Terms. The Liyo AI Addendum (section 4) sets out what Liyo sends to AI providers, what it never sends, where those providers operate, the option for a brokerage to use its own AI key, and how long Liyo records are kept.

19. Confidentiality

19.1 Each party must keep the other's non-public information confidential, use it only to perform or receive the Service, and share it only with staff, affiliates, advisers and sub-processors who need it and are bound by equivalent duties. Confidential information of the Customer includes Customer Data. Confidential information of VortexWeb includes non-public parts of the Service, security information and quoted pricing.

19.2 Clause 19.1 does not apply to information that is public without breach, was already lawfully known to the receiving party, is independently developed, or is lawfully received from a third party, or to a disclosure that a law or competent authority requires, made with notice to the other party where lawful.

19.3 Portal documentation and credentials are confidential to the Portals. The Customer must not publish or share them.

19.4 These duties continue for five years after the Agreement ends, and for Customer Data for as long as VortexWeb holds it.

20. Intellectual property and feedback

20.1 VortexWeb and its licensors own all rights in the Service, including its software, design, templates, workflows, documentation and the Propliyo and Liyo names. The Customer receives only the right to use in clause 4.

20.2 The Customer must not copy, modify, decompile or reverse engineer the Service, except as the law allows despite this restriction, and must not use it to build a competing product.

20.3 The Customer keeps all rights in Customer Data, including approved Liyo output and the designs it exports, subject to any rights of third parties in the material it supplies.

20.4 If the Customer or an Authorised User gives VortexWeb suggestions or feedback about the Service, VortexWeb may use them freely without payment or attribution. Feedback does not include Customer Data.

21. Warranties and disclaimers

21.1 Each party confirms that it has the power and authority to enter into the Agreement.

21.2 VortexWeb will provide the Service with reasonable skill and care and substantially as described in its documentation.

21.3 Beyond the written promises in the Agreement, the Service is provided as it is and as available. To the extent the law allows, VortexWeb excludes all other warranties and conditions, including fitness for a particular purpose, uninterrupted or error-free operation and any particular business result.

21.4 VortexWeb does not warrant that any Portal will accept, display, rank, keep or refresh a listing, or that a listing will generate an enquiry. Status and quality scores come from the Portal or are estimates.

21.5 The Service, its checks and its market data are tools. They are not legal, tax, valuation or regulatory advice, and they do not detect every error, missing permit or rule breach.

21.6 Liyo output is a draft and carries no warranty of accuracy until a person has checked and approved it.

22. Limitation of liability

22.1 Nothing in the Agreement limits or excludes liability for fraud, gross error or intentional wrongdoing, or any other liability that UAE law does not allow to be limited or excluded. Nothing in it limits the Customer's duty to pay the Fees.

22.2 Subject to clause 22.1, VortexWeb's total liability arising out of or in connection with the Agreement and the Service, whether in contract, tort, under an indemnity or otherwise, is limited to the greater of AED 5,000 and the Fees paid by the Customer in the 12 months before the event giving rise to the claim. This is one cap for all claims together.

22.3 Subject to clause 22.1, VortexWeb is not liable for:

• indirect or consequential loss;
• loss of profit, revenue, commission or business;
• loss of data caused by the Customer, including by its deletion, its configuration or its failure to export in time; or
• fines imposed by a regulator, or penalties, charges or removals imposed by a Portal, that are caused by Customer Data or by the Customer's breach of a Portal's rules. For example, a Dubai Land Department fine for non-compliant advertising, which is recorded at AED 50,000 per company, is the Customer's responsibility.

22.4 The Fees reflect this allocation of risk.

23. Indemnities

23.1 By the Customer. The Customer will defend VortexWeb, its affiliates and their staff against any claim, investigation or proceeding by a third party, a Portal or an authority, and will pay the resulting losses, fines, penalties and reasonable costs, to the extent they arise from:

• Customer Data, including a claim that it is inaccurate, misleading or infringes another person's rights;
• a listing the Customer or an Authorised User publishes, including a missing, invalid or expired permit, Madmoun QR code, BRN, ORN or owner authority;
• the Customer's breach of a Portal's rules or of its contract with a Portal;
• calls or messages by the Customer or its Authorised Users in breach of telemarketing or messaging rules; or
• the acts and omissions of its Authorised Users, including their breach of the Agreement or the Acceptable Use Policy.

23.2 By VortexWeb. VortexWeb will defend the Customer against a third-party claim that the Service itself, as supplied by VortexWeb and used under the Agreement, infringes that third party's intellectual property rights, and will pay the damages finally awarded or agreed in a settlement VortexWeb approves. This does not apply to a claim that arises from Customer Data, a third-party service, Liyo output after the Customer edits or uses it, a change not made by VortexWeb, or a combination with something VortexWeb did not supply.

23.3 If such a claim is made or likely, VortexWeb may, at its choice, obtain the right for the Customer to keep using the Service, change the Service so that it no longer infringes without a material loss of function, or, if neither is reasonably possible, end the affected part of the Service and refund the Fees prepaid for the unused part of the paid term. This clause and clause 23.2 state VortexWeb's whole liability for infringement.

23.4 Procedure. The party seeking protection must give prompt written notice of the claim, let the other party control the defence and settlement, and give reasonable help at the other party's cost. Delay in notice releases the indemnifying party only to the extent it is harmed by it. The indemnifying party must not settle in a way that admits fault by, or places a duty on, the other party without its written consent.

24. Force majeure

24.1 Neither party is liable for a failure or delay, other than a duty to pay money, caused by an event beyond its reasonable control. Such events include natural disaster, fire, flood, epidemic, war, unrest, government action, change of law, power or telecommunications failure, cyber attack, an outage of a cloud provider or a whole cloud region, and an outage, restriction or change of a Portal or other third-party service.

24.2 The affected party must tell the other promptly and take reasonable steps to limit the effect. If the event prevents performance of the main part of the Service for more than 60 days, either party may end the Agreement by notice. A refund on that ending is due only where UAE law requires it, under the Cancellation and Refund Policy.

25. Term and termination

25.1 The Agreement starts when the Customer accepts it and continues for the Trial and each paid term, or, on the Solo Agent plan, until the account is closed.

25.2 Either party may end the Agreement at the end of a paid term. The Customer does so by cancelling under clause 9. VortexWeb does so by giving the Admins at least 30 days' notice before the renewal date.

25.3 Either party may end the Agreement by notice if the other commits a material breach and, where the breach can be put right, does not put it right within 14 days after receiving notice describing it.

25.4 VortexWeb may end the Agreement at once by notice if:

• the Customer commits a serious breach, including a serious or repeated breach of clause 11, clause 16 or the Acceptable Use Policy;
• the Customer uses the Service unlawfully, or a court, regulator or Portal requires VortexWeb to stop serving it;
• Fees remain unpaid after the account has become read only under clause 10.1 and VortexWeb has sent the Admins a final notice; or
• the Customer's trade licence is withdrawn, or it becomes insolvent or stops doing business.

25.5 A Solo Agent may close the account at any time from Settings.

26. Effect of termination, export and deletion

26.1 When the Agreement ends, the right to use the Service ends, except for the read-only export window. VortexWeb stops sending listings to Portals and stops collecting leads for the Customer.

26.2 Export window. For 30 days after the end of the last paid term, or after termination, the account is read only so that the Admins can export Customer Data. An Admin can export all Customer Data as one ZIP file from Settings, then Security.

26.3 Deletion. After the export window, or earlier if the Customer wishes, an Admin may request deletion of the account by typing the brokerage's name to confirm. Customer Data is deleted 30 days after the deletion request is approved. Database backups are overwritten within 35 days and disk snapshots within 14 days after that.

26.4 Records kept. VortexWeb keeps account and brokerage records for 12 months after closure, invoices and tax records for 7 years from the end of the tax period, and the audit log for 12 months after closure, as the retention table in the Data Processing Agreement sets out. Kept records remain confidential and protected.

26.5 Live listings. VortexWeb never unpublishes a listing from a Portal when an account is cancelled, ended or deleted. The Customer must unpublish its listings, or update them on the Portal directly, before it cancels or deletes its account.

26.6 VortexWeb is not liable for Customer Data that the Customer did not export before deletion.

26.7 Fees due before the end of the Agreement remain payable.

27. Changes to the Agreement

27.1 VortexWeb may change the Agreement, including prices, by giving at least 30 days' notice by email to the Admins and by a notice in the Service before the change takes effect.

27.2 Where a change is required by law, a regulator or a Portal, it may take effect at once, and VortexWeb gives notice as soon as practicable.

27.3 A price change applies only from the first renewal after the notice period, never in the middle of a paid term. If the Customer does not accept a change, it may cancel under clause 9 before the change applies to it. Continued use after the effective date is acceptance of the change.

27.4 An acceptance already given stays valid for the version that was accepted until the change takes effect.

28. Electronic acceptance and records

28.1 The Agreement is made electronically and is valid under Federal Decree-Law No. 46 of 2021 on Electronic Transactions and Trust Services.

28.2 When a person accepts, the Service records the version hash of every document accepted, the acceptance wording shown, the time and the account. Those records are evidence of acceptance and of the version accepted.

28.3 Audit log entries, invoices and other records kept by the Service are evidence of what they record unless shown to be wrong.

29. Notices

29.1 VortexWeb gives notices to the Customer by email to the Admins recorded in the Service and, where the notice concerns the Service, by a notice in the Service. An email is treated as received on the next working day after it is sent, unless the sender receives a delivery failure message.

29.2 The Customer gives notices to VortexWeb by email to support@propliyo.com. Billing notices may go to support@propliyo.com and security reports to support@propliyo.com.

29.3 The Customer must keep at least one Admin email address that is monitored.

30. Assignment and subcontracting

30.1 VortexWeb may assign or transfer the Agreement to an affiliate or to a successor to its business, with notice to the Customer. It may use subcontractors and sub-processors, and remains responsible for them as the Data Processing Agreement sets out.

30.2 The Customer may assign or transfer the Agreement only with VortexWeb's prior written consent, which VortexWeb will not unreasonably withhold for a transfer to a successor to the Customer's business that accepts these Terms.

31. Language

31.1 The Agreement is written in English. If VortexWeb publishes an Arabic translation, it is for convenience only, and the English text prevails if they differ.

32. Governing law and forum

32.1 The Agreement, and any dispute or claim arising out of or in connection with it, including a non-contractual one, is governed by the laws of the United Arab Emirates as applied in the Emirate of Dubai.

32.2 The onshore courts of Dubai have exclusive jurisdiction over any such dispute or claim. The parties do not agree to arbitration.

32.3 Before starting proceedings, a party must give the other written notice of the dispute, and both will try in good faith to settle it within 30 days. This does not prevent either party from seeking urgent interim relief.

32.4 Where a Customer is a consumer under Federal Law No. 15 of 2020 on Consumer Protection, nothing in the Agreement removes or limits a right that the law gives the consumer and that cannot be excluded by contract.

33. General

33.1 Survival. Clauses that by their nature continue after the Agreement ends do so, including clauses 11, 15, 16, 19, 20, 21, 22, 23, 26, 32 and 33 and any duty to pay Fees already due.

33.2 Entire agreement. The Agreement is the whole agreement between the parties on the Service and replaces earlier proposals, statements and understandings about it. Neither party relies on a statement that is not in the Agreement. Nothing in this clause limits liability for fraud.

33.3 No waiver. A failure or delay in exercising a right is not a waiver of it. A waiver must be in writing.

33.4 Severability. If a provision is held invalid or unenforceable, it applies to the greatest extent the law allows and the rest of the Agreement continues.

33.5 Relationship. The parties are independent contractors. The Agreement creates no partnership, agency, franchise or employment. VortexWeb is not a party to any dealing between the Customer and a Portal, an owner, a buyer, a tenant or any other person.

33.6 Third parties. Only the parties may enforce the Agreement, except that persons protected by an indemnity in clause 23 may rely on it.

Cancellation and Refund Policy

1. The short version

1.1 You can cancel a paid Plan at any time in Plan and billing. Cancellation stops the next renewal; you keep full use until the end of the term you have paid for.

1.2 After the term ends, your account is read only for 30 days so that you can export your data. After that you can ask us to delete it.

1.3 We never unpublish your listings from Property Finder, Bayut, dubizzle or your website. Unpublish them yourself before you cancel.

1.4 We refund only in the four cases in clause 7. There is no refund for a change of mind, unused days or unused Units.

1.5 This policy forms part of the Agreement described in the Terms of Service (section 1 of this page) and is read with the Pricing and Billing Terms. Words with capital letters have the meanings given in the Terms of Service. Where this policy says "you", it means the Customer; "we" means VortexWeb L.L.C-FZ.

2. The 7-day Trial

2.1 A brokerage can try the Growth Plan free for 7 days, once. We take card details at the start, but we do not charge the card during the Trial.

2.2 We email your Admins about 2 days before the Trial ends, to remind them that the first charge is coming.

2.3 To pay nothing, an Admin must cancel before the Trial ends. If nobody cancels, the Growth Plan starts and is charged monthly from the end of the Trial.

2.4 If you cancel during the Trial and are still charged, that charge is refunded in full under clause 7.1.

3. How to cancel

3.1 Self-serve. An Admin cancels in the Service:

• open Settings, then Plan and billing;
• choose Cancel plan;
• check the end-of-term date shown on screen; and
• confirm.

3.2 We email every Admin to confirm the cancellation and the date the paid term ends.

3.3 Email fallback. If the Service cannot be used, an Admin can cancel by email to support@propliyo.com from the Admin email address recorded on the account, giving the brokerage name. A request from any other address may be refused until we can confirm it comes from the Customer.

3.4 Only an Admin can cancel a brokerage's Plan. An Authorised User who is not an Admin cannot cancel on the brokerage's behalf.

4. The cut-off

4.1 To stop a renewal, the cancellation must reach us before the renewal charge is made. The renewal date is shown in Plan and billing.

4.2 A cancellation received after a renewal charge has been made applies to the next term. The term just charged runs to its end and is not refunded, except under clause 7.

5. What happens when you cancel

5.1 Until the end of the paid term: nothing changes. All users keep full use, listings stay live and Portal leads keep arriving.

5.2 For 30 days after the term ends: the account is read only. Everyone can still see listings, leads and records, and Admins can export everything. You cannot publish, edit or add records.

5.3 After the 30-day export window: you may ask us to delete the account under clause 6. Until you do, we keep your data in read-only form.

5.4 You can restart a paid Plan at any time before deletion, and your data is still there.

6. Your data and your live listings

6.1 Export. An Admin can export all of the brokerage's data as one ZIP file from Settings, then Security. Do this before you ask for deletion.

6.2 Deletion. An Admin asks for deletion from Settings, then Security, and confirms by typing the brokerage's name. Once the request is approved, the records are deleted 30 days later. Backups are overwritten in their normal cycle after that: database backups within 35 days and disk snapshots within 14 days.

6.3 What we keep. Invoices and tax records are kept for 7 years from the end of the tax period, as UAE tax law requires. Account and brokerage records and the audit log are kept for 12 months after the account is closed. The full retention table is in the Data Processing Agreement (section 3 of this page).

6.4 Live listings. We never unpublish listings from a Portal or your website when you cancel, downgrade or delete your account. Unpublish your listings first, in the Service while it is still fully active or on each Portal directly. Anything left live on a Portal is between you and that Portal.

7. Refunds

7.1 We refund only in these four cases:

• Charged in error. A charge made by mistake, charged twice, or charged above the price shown at checkout. The wrong or duplicate amount is refunded in full.
• Cancelled in time but still charged. You cancelled during the Trial or before a renewal charge, and were charged anyway. That charge is refunded in full.
• Unfixed defect. A defect in the Service that stops it working as described, which you reported in a support ticket and which we did not fix within 10 working days of that ticket. We refund the Fees for the unused part of the paid term, or another fair amount we agree with you in writing.
• Required by law. Any case in which UAE law requires a refund, including a right that a consumer has under Federal Law No. 15 of 2020 on Consumer Protection.

7.2 No other refunds. We do not refund for a change of mind, for unused days in a paid term, for unused Units or Packs, for a downgrade, for removing users, or because a Portal rejected or removed a listing.

7.3 Method and timing. Refunds go to the card that paid, in UAE dirhams, including the VAT charged on the refunded amount, within 10 working days after we approve the refund. Your bank may take longer to show it.

7.4 How to ask. Email support@propliyo.com from an Admin address with the brokerage name, the invoice and the reason, or raise a ticket under Help.

7.5 Worked example. A brokerage buys the two-year Growth Plan for AED 7,199 plus VAT.

• It cancels in month 3. Cancellation stops the renewal at the end of the two years; the brokerage keeps full use until then. There is no refund for the remaining 21 months.
• Its card is charged twice for the same order. The duplicate charge of AED 7,199 plus VAT is refunded in full.

8. Changing plan

8.1 Upgrades take effect at once. The payment provider prorates the price difference for the rest of the current term.

8.2 Downgrades, and moves to a shorter billing term, take effect at the next renewal. There is no refund for the rest of the current term.

8.3 A plan change never unpublishes a live listing. If you are over the new Plan's listing cap, you cannot publish more listings until you are under it.

9. Liyo Packs

9.1 A Pack is a one-time purchase of extra Units. Its Units can be used for 12 months from purchase and then expire.

9.2 Packs are not refundable, except in a case listed in clause 7.1. Unused or expired Units are not refunded.

9.3 Packs and Units cannot be transferred to another account, are not money and have no cash value.

10. Failed payments

10.1 If a charge fails, our payment provider retries it.

10.2 If an amount is still unpaid 7 days after it fell due, the account becomes read only. Everyone can still see listings, leads and records, Portal leads keep arriving, and Admins see Fix payment.

10.3 Nothing is deleted because a payment failed. Full access returns as soon as the payment goes through.

11. Solo Agent

11.1 The Solo Agent plan is free and needs no card. There is nothing to cancel and nothing to refund.

11.2 A Solo Agent can close the account at any time from Settings. Export anything you want to keep first; the data is then deleted as described in clause 6.

12. Enterprise and Custom plans

12.1 Enterprise and Custom plans are supplied under an order form. The cancellation and refund terms in that order form apply. Where the order form says nothing on a point, this policy applies.

13. Custom software

13.1 A custom software plan is assigned by us only and is billed under your existing contract with us. It cannot be bought or cancelled through Plan and billing. Its cancellation and refund terms are those of that contract.

14. Questions

14.1 Email support@propliyo.com with any question about billing, cancellation or refunds. We reply within one working day: Monday to Friday, 10:00 to 18:00 Gulf Standard Time, excluding UAE public holidays.

Data Processing Agreement

1. Parties and scope

1.1 This Data Processing Agreement (the "DPA") is made between the Customer, as named in its Order or account registration, and VortexWeb L.L.C-FZ, a company registered in Meydan Free Zone, Dubai, United Arab Emirates under trade licence 2420891.01, with its registered address at Meydan Grandstand, 6th floor, Meydan Road, Nad Al Sheba, Dubai, United Arab Emirates ("VortexWeb").

1.2 VortexWeb supplies the Service to the Customer under the Terms of Service (section 1 of this page). In doing so it processes Personal Data on the Customer's behalf. This DPA sets out the terms of that processing and forms part of the Agreement. Accepting the Terms of Service online, or signing an Order that refers to them, is acceptance of this DPA. No separate signature is needed.

1.3 This DPA applies to Personal Data in Customer Data. For that Personal Data the Customer is the controller and VortexWeb is the processor.

1.4 This DPA does not apply to Personal Data for which VortexWeb is itself the controller: the account, contact and sign-in details of Authorised Users that VortexWeb needs to run and bill the account, billing and payment records, support tickets, security and fraud prevention records, and website analytics. VortexWeb processes that data as controller under the Privacy Policy, available at https://propliyo.com/legal/privacy.

1.5 Where the Customer is a Solo Agent, references to the Customer mean that individual, and the Solo Agent is the controller of the Personal Data of the leads, contacts and other people it records in the Service.

2. Definitions

2.1 Terms defined in the Terms of Service have the same meaning in this DPA, including "Agreement", "Service", "Customer", "Authorised User", "Customer Data", "Order", "Plan", "Portal", "Liyo", "Admin" and "Trial".

2.2 "Applicable Data Protection Law" means Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the "PDPL") and any regulations issued under it, and any other law on the protection of personal data that applies to a party's processing under this DPA.

2.3 "Controller", "Processor", "Personal Data", "Data Subject" and "Processing" have the meanings given in the PDPL. Where this DPA says "process", it has the same meaning.

2.4 "Regulator" means the UAE Artificial Intelligence and Data Authority, which took over the functions of the UAE Data Office, and any other authority with jurisdiction over a party's processing under this DPA.

2.5 "Data Subject Request" means a request by a Data Subject to exercise a right under Applicable Data Protection Law.

2.6 "Personal Data Breach" means a breach of security that leads to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data processed under this DPA.

2.7 "Property Finder Lead Data" means Personal Data of a lead or enquirer that Property Finder sends to the Customer through the Service, and any record that the Service labels as coming from Property Finder.

2.8 "Security Measures" means the technical and organisational measures in Annex 2.

2.9 "Sub-processor" means a third party that VortexWeb engages to process Personal Data in Customer Data for the Customer. The Sub-processors are listed by role and company in Annex 3.

2.10 "Customer-Chosen Recipient" means a destination that the Customer selects, connects or switches on, such as a Portal, its own Bitrix24, a lead advertising account, a website, an automation tool or its own AI provider. Customer-Chosen Recipients are listed in Annex 4. They are not Sub-processors.

2.11 "Affiliate" means VortexWeb Cloud LLP, an affiliate of VortexWeb L.L.C-FZ in Noida, India, which provides engineering and support staff acting on VortexWeb's instructions.

3. Roles and instructions

3.1 Each party will comply with the Applicable Data Protection Law that applies to it in its role under this DPA.

3.2 VortexWeb will process Personal Data in Customer Data only on the Customer's documented instructions. The documented instructions are: the Agreement, including this DPA; the settings, roles, integrations, Portals and Liyo features that the Customer and its Admins configure in the Service; the actions that Authorised Users take in the Service; and any further written instruction from an Admin that is consistent with the Agreement.

3.3 VortexWeb will not process Personal Data in Customer Data for its own purposes, except where the law requires it, to keep the Service secure, and to produce statistics that are aggregated or de-identified and do not identify the Customer or any individual. VortexWeb does not sell Personal Data and does not use Customer Data to train any AI model.

3.4 If VortexWeb believes that an instruction breaks Applicable Data Protection Law or another law, it will tell the Customer without undue delay and may suspend that instruction until the Customer confirms or changes it. VortexWeb is not required to check the lawfulness of instructions in general.

3.5 If the law requires VortexWeb to process Personal Data other than on the Customer's instructions, VortexWeb will tell the Customer before doing so, unless the law prohibits that notice.

3.6 Where an instruction needs work outside the standard features of the Service, VortexWeb may decline it or agree it in an Order at a reasonable fee.

4. Customer responsibilities

4.1 The Customer is responsible for: having a lawful basis, and consent where the law requires it, for the Personal Data it puts into or collects through the Service; giving Data Subjects the notices the law requires, including at the point where leads are collected through Portals, forms and advertising; the accuracy and lawfulness of its data and instructions; choosing the Customer-Chosen Recipients and Liyo features it switches on; and keeping its own records of consents and Data Subject Requests.

4.2 The Customer is responsible for the roles and permissions it assigns, the Authorised Users it creates and removes, keeping MFA on for its Admins, the security of its own devices and credentials, and the security of its own Bitrix24. A person who opens the Service from inside the Customer's Bitrix24 is signed in by Bitrix24 and is not asked for a Propliyo MFA code there.

4.3 The Customer is responsible for following the UAE rules on marketing calls and messages, including Cabinet Resolution No. 56 of 2024, and for applying the same consent rule to WhatsApp and SMS. The Service warns an Authorised User who starts a call outside 09:00 to 18:00 UAE time. Every WhatsApp message from the Service is click-to-chat: an Authorised User opens the link and sends the message. Nothing is sent automatically.

4.4 The Customer must not enter special categories of Personal Data into the Service, must not enter identity document numbers that it does not need, and must not type Personal Data into Liyo free text fields.

4.5 The Customer must not instruct VortexWeb to process Personal Data in a way that breaks a Portal's terms, including the Property Finder rules in section 11.

5. Nature, purpose and duration

5.1 Subject matter. VortexWeb processes Personal Data to provide, secure, support and maintain the Service for the Customer.

5.2 Nature. Processing consists of hosting, storing, encrypting, organising, retrieving, displaying, sending to destinations the Customer chooses, backing up, restoring, exporting and deleting Personal Data, preparing redacted requests to AI providers when the Customer uses Liyo, and the support and security work needed to run the Service.

5.3 Purpose. To supply the Service to the Customer under the Agreement and on its instructions.

5.4 Categories. The categories of Data Subjects and Personal Data are described in Annex 1.

5.5 Duration. Processing continues for as long as the Agreement is in force, and then for the export and deletion periods in section 15.

6. Confidentiality of personnel

6.1 VortexWeb will ensure that every person it authorises to process Personal Data in Customer Data, including the staff of the Affiliate, is bound by a duty of confidentiality, by contract or by law, that continues after their engagement ends.

6.2 Access is limited to personnel who need it to supply, secure and support the Service and who have been trained on data protection and security.

6.3 Support sessions. VortexWeb staff, including the staff of the Affiliate, can open the Customer's records only through a support session. The staff member states one reason: troubleshooting, onboarding, incident or demonstration. The session ends after 30 minutes at most and can be ended sooner. Starting and ending each session are written to the Customer's audit log, which its Admins can review. Without an active session, access to the Customer's records is refused. The Customer authorises this access for these purposes.

7. Security

7.1 VortexWeb will implement and maintain technical and organisational measures appropriate to the risk, taking account of the state of the art, the cost of implementation, the nature, scope, context and purposes of processing, and the likelihood and severity of harm to Data Subjects. The measures in place are described in Annex 2.

7.2 VortexWeb may change the Security Measures where the change does not reduce the overall level of protection.

7.3 The Customer is responsible for the security choices described in section 4.2 and for the security of every Customer-Chosen Recipient.

8. Assistance

8.1 Data Subject Requests. The Service gives the Customer tools to search, export, correct, restrict and delete records, and an in-app privacy request flow through which an Admin can request an export or the deletion of account data. The Customer answers Data Subject Requests about the data it controls.

8.2 If VortexWeb receives a Data Subject Request that relates to Customer Data, it will not answer the Data Subject except to direct them to the Customer, and will pass the request to the Customer without undue delay unless the law prevents it.

8.3 Where the tools in the Service are not enough, VortexWeb will give the Customer reasonable help, on written request from an Admin, so that the Customer can answer requests for access, correction, erasure, restriction, objection and portability within the time the law allows.

8.4 Impact assessments and the Regulator. VortexWeb will give the Customer reasonable assistance with its data protection impact assessments and with any consultation with, or request from, the Regulator about processing under this DPA, taking into account the nature of the processing and the information available to VortexWeb.

8.5 VortexWeb may charge a reasonable fee for assistance under sections 8.3 and 8.4 that goes beyond the features of the Service, except where the assistance is needed because of VortexWeb's own breach of this DPA.

8.6 Requests from authorities. If a court or authority makes a binding request to VortexWeb for Personal Data in Customer Data, VortexWeb will, where the law allows, tell the Customer first, and will disclose only the minimum that the law requires.

9. Personal Data Breach

9.1 VortexWeb will notify the Customer without undue delay, and in any event within 72 hours of confirming a Personal Data Breach that affects the Customer's Personal Data. Notice is sent by email to the Customer's Admins.

9.2 The notice will include, as far as is known at the time: the nature of the breach; the categories and approximate number of Data Subjects and records concerned; whether Property Finder Lead Data is involved; the likely consequences; the measures taken or proposed to deal with the breach and reduce its effects; and a contact at support@propliyo.com for more information. VortexWeb may give the information in stages as it becomes available, without further undue delay.

9.3 Where Property Finder Lead Data is involved, the first notice says so at once, so that the Customer and VortexWeb can meet their duties to Property Finder.

9.4 VortexWeb will take reasonable steps to contain and investigate the breach, reduce its effects and prevent it happening again, and will cooperate with the Customer's reasonable requests.

9.5 The Customer decides whether to notify the Regulator and Data Subjects about a breach affecting its data. VortexWeb will not notify them on the Customer's behalf unless the law requires it or the Customer asks it to.

9.6 Notifying a breach is not an admission of fault or liability.

10. Sub-processors

10.1 General authorisation. The Customer gives VortexWeb a general authorisation to engage Sub-processors for the Service. The Sub-processors engaged at the date the Customer accepts this DPA are described in Annex 3. The full list, with each company's name, is the Sub-processor List, available from support@propliyo.com.

10.2 Conditions. VortexWeb will engage each Sub-processor under a written contract that imposes data protection obligations no less protective than those in this DPA, as far as they apply to the service that Sub-processor provides. VortexWeb remains responsible to the Customer for the performance of each Sub-processor, subject to section 17.

10.3 Notice of a new Sub-processor. VortexWeb will give at least 30 days' notice before it adds or replaces a Sub-processor, by email to the Customer's Admins. The notice names the Sub-processor, the service it provides, the data involved and where it processes that data.

10.4 The Customer's remedy. If the Customer does not accept a new or replacement Sub-processor, it may end the Agreement for the affected part of the Service, by written notice from an Admin to support@propliyo.com, before the change takes effect. That is the Customer's only remedy for a Sub-processor change. Any refund follows the Cancellation and Refund Policy (section 2 of this page).

10.5 Emergency replacement. If a Sub-processor must be replaced urgently for security, legal or continuity reasons, VortexWeb may do so on shorter notice and will tell the Customer as soon as practicable. Section 10.4 then applies from the date of that notice.

10.6 Customer-Chosen Recipients are not Sub-processors. Section 13 applies to them.

11. Property Finder Lead Data

11.1 Property Finder's contract requires that its lead data is not stored or processed outside the UAE without its written consent, and that personal data is encrypted. The Service is hosted in AWS Mumbai, India, as section 12 describes. Property Finder has been notified in writing of the Mumbai hosting.

11.2 Property Finder Lead Data stays labelled Property Finder in the Service. It is never pooled with data from other sources and never linked or merged across that label.

11.3 Property Finder Lead Data is never sent to Liyo or to any AI provider. There is no setting that allows it, and no instruction from the Customer can change this.

11.4 Property Finder Lead Data is never forwarded to Zapier, Make, email tools, outbound webhooks or the open API.

11.5 Property Finder Lead Data may be pushed only to the Customer's own Bitrix24, labelled Property Finder, when the Customer connects its Bitrix24 and switches that on.

11.6 Phone numbers, email addresses and other contact details in Property Finder Lead Data are stored with column-level encryption, as Annex 2 describes.

11.7 The Customer must not export, copy, forward or use Property Finder Lead Data in a way that conflicts with Property Finder's terms.

12. International transfers

12.1 Hosting. The Service is hosted by Amazon Web Services in its Mumbai region (ap-south-1) in India: the application servers, the database, file storage, outgoing email, secrets and the audit anchor store. Database backups and disk snapshots are kept in the same region.

12.2 Support. Engineering and support staff of the Affiliate in India access Customer Data only through the support sessions in section 6.3 and only on VortexWeb's instructions. The Affiliate processes under contract for VortexWeb L.L.C-FZ. No consent is sought from Data Subjects under Indian law for this processing.

12.3 AI providers. When the Customer uses Liyo, redacted requests are sent to large language model, image, video and speech services operated in the United States, as described in the Liyo AI Addendum (section 4 of this page). The data leaves the UAE and India for the time it takes the provider to answer.

12.4 Other Sub-processors. Stripe and the other Sub-processors in Annex 3 may process the data they receive outside the UAE, as Annex 3 states.

12.5 Safeguards. Every transfer under this section is made under the binding contractual safeguards in this DPA, which VortexWeb imposes on each Sub-processor and on the Affiliate under section 10.2, and under the Customer's instruction.

12.6 Instruction. By accepting this DPA, the Customer instructs VortexWeb to transfer Personal Data in Customer Data to the places described in this section and in Annex 3. Switching on a Liyo feature is an instruction to transfer the redacted data that feature uses. The Customer may object to a transfer only by ending the Agreement under the termination clause of the Terms of Service.

12.7 Property Finder Lead Data is subject to section 11 in every case.

13. Customer-Chosen Recipients

13.1 Portals, the Customer's own Bitrix24, Meta lead ads, website forms and feeds, Zapier and Make, calendar and mailbox providers, the Customer's own AI provider and WhatsApp click-to-chat are Customer-Chosen Recipients. Annex 4 describes each one and its role.

13.2 The Customer chooses whether to connect each Customer-Chosen Recipient and what it receives. The Customer is responsible for its contract with that recipient, for the lawfulness of sending data to it, and for what the recipient does with the data.

13.3 VortexWeb sends a Customer-Chosen Recipient only what the Customer configured, and applies the Property Finder rules in section 11 to every recipient.

13.4 Listings and feeds that the Customer publishes may show an agent's name, photo and business contact details. The Customer must have that agent's agreement.

14. Audits

14.1 VortexWeb will make available to the Customer the information reasonably needed to show that it complies with this DPA. It does this first by written answers to the Customer's reasonable questions, and by sharing a summary of the Security Measures, the Sub-processor List and any independent reports or certificates it holds.

14.2 If that information is not enough, the Customer may audit VortexWeb's compliance with this DPA once in any 12 months, on at least 30 days' written notice, or after a Personal Data Breach affecting the Customer's data. The Customer and VortexWeb will agree the scope and timing in writing beforehand.

14.3 An audit takes place during normal working hours, without unreasonable disruption, and is limited to the systems, records and personnel that relate to the Customer's Personal Data. It may be carried out by the Customer or by an independent auditor that is bound by written confidentiality duties and is not a competitor of VortexWeb.

14.4 The Customer bears its own costs of an audit and VortexWeb's reasonable costs of supporting it.

14.5 An audit gives no access to other customers' data, to VortexWeb's source code or security keys, or to information VortexWeb holds under a duty of confidence to a third party, including Portal documentation.

14.6 The Customer will give VortexWeb a copy of the audit report and keep it confidential. VortexWeb will address material findings within its control within a reasonable time.

14.7 Audits of a Sub-processor are carried out through VortexWeb's rights under its contract with that Sub-processor.

15. Return and deletion

15.1 Export. An Admin can export all Customer Data at any time from Settings, Security, as one ZIP file.

15.2 Read-only window. When the Agreement ends, the account stays read only for 30 days so that the Customer can export its Customer Data. After that window the Customer may request deletion.

15.3 Deletion. An Admin requests deletion of the account from Settings, Security, and confirms it by typing the brokerage name. Customer Data is deleted from the live systems 30 days after VortexWeb approves the request.

15.4 Backups. Deleted data stays in encrypted database backups until they are overwritten, within 35 days, and in disk snapshots until they are overwritten, within 14 days. Backups are not restored to bring back deleted data except to recover from an incident, and any data restored that way is deleted again.

15.5 Records kept. VortexWeb keeps invoices, tax records and the audit log after deletion for the times in the retention table in Annex 1, because the law requires it or to establish or defend legal claims. It keeps that data protected and uses it for no other purpose.

15.6 Listings on Portals. Deleting the account or ending the Agreement does not unpublish listings from any Portal. The Customer must unpublish its listings before it closes the account.

15.7 VortexWeb will confirm deletion in writing if an Admin asks.

16. Customer content in published material

16.1 The Customer is responsible for the Personal Data that appears in listings, brochures, feeds, reels and other material it publishes from the Service, and for the Personal Data it sends to Customer-Chosen Recipients.

17. Liability

17.1 Each party's liability under or in connection with this DPA is subject to the limits and exclusions in the Terms of Service. Any amount a party owes under this DPA counts towards the cap in the Terms of Service and is not a separate or additional cap.

17.2 VortexWeb is responsible for its Sub-processors and the Affiliate as for itself, within those limits. VortexWeb is not responsible for a Customer-Chosen Recipient.

17.3 Nothing in this DPA limits liability that UAE law does not allow to be limited, or the rights of Data Subjects under Applicable Data Protection Law.

18. Term, precedence, changes and law

18.1 This DPA starts when the Customer accepts the Terms of Service or signs an Order, and continues for the term of the Agreement and then until VortexWeb has deleted the Customer's Personal Data under section 15.

18.2 If this DPA conflicts with the Terms of Service on the processing of Personal Data in Customer Data, this DPA prevails, unless a signed Order says otherwise. In all other matters the Terms of Service prevail.

18.3 VortexWeb may change this DPA on the notice the Terms of Service require for changes, which is at least 30 days by email to Admins and an in-app notice, or sooner where the law or a Portal requires the change. Sub-processor changes follow section 10.

18.4 This DPA is governed by the law, and subject to the courts, stated in the Terms of Service.

18.5 Notices under this DPA follow the Terms of Service. Privacy questions go to support@propliyo.com, security reports to support@propliyo.com and legal notices to support@propliyo.com.

19. Annex 1: Description of processing

Data subjects

19.1 The Customer's Personal Data in the Service concerns these Data Subjects:

• Admins and Authorised Users of the Customer, including listing agents and other Team members.
• Leads and enquirers from Portals, websites, Meta lead ads, imports and manual entry.
• Contacts, clients and referrers, including co-brokers.
• Landlords and sellers.
• Tenants and buyers named in deals.
• Visitors registered at open houses and viewings.
• The Customer's staff whose attendance is recorded.

Categories of Personal Data

19.2 Special categories. The Customer does not intend to process special categories of Personal Data in the Service and must not enter them. Identity document numbers appear only where an Authorised User types them into a deal record, and are stored encrypted.

19.3 Attendance. Location is read once, when the person taps to clock in or out, and only if the person allows it at that moment. It is never tracked in between, never shown in reports or exports, and never sent to Liyo or any other outside service.

Retention

20. Annex 2: Security Measures

Encryption

20.1 Traffic between users and the Service, and between the application and the database, is encrypted in transit with TLS. Databases, file storage and backups are encrypted at rest.

20.2 Phone numbers, email addresses and other contact details of leads and contacts, and the personal details of landlords, are encrypted at column level. Blind indexes allow an exact search without storing the value in readable form.

20.3 Portal credentials and the Customer's own AI keys are encrypted with AES-256-GCM, are never returned to the browser, and only the last four characters of an AI key are ever shown.

Access

20.4 Admins sign in with email, password and MFA. Passwords are stored as salted hashes, sign-in attempts are rate limited and sessions expire.

20.5 Every record belongs to one customer. The customer is taken from the signed-in session, never from the request, and every database query is scoped to that customer. Access across customers is blocked and tested.

20.6 A capability matrix controls what each Authorised User can see and do. Any action that changes what is live on a Portal needs a server permission check, a confirmation step and an audit entry.

20.7 VortexWeb staff open the Customer's records only through the support session in section 6.3: one stated reason, 30 minutes at most, logged in the Customer's audit log. Staff access to production systems uses individual accounts and is limited to those who need it.

Audit and monitoring

20.8 Significant actions, including publishing, role changes, exports, privacy requests, Liyo approvals and support sessions, are written to an audit log that the Customer's Admins can review. The log is chained and anchored to a separate store so that alteration can be detected.

20.9 Logs and error reports are scrubbed of contact details, secrets and signed links before they leave the application. Secrets and keys are kept in a secrets store, never in source code, and never written to logs.

Backups and resilience

20.10 Database backups are taken nightly, encrypted and kept for 35 days. Disk snapshots are taken daily and kept for 14 days. Both are stored in the AWS Mumbai region.

Application security

20.11 The web application runs under a strict content security policy with no inline scripts. Inputs are validated on the server.

20.12 Uploaded files are stored privately and served through time-limited signed links. Uploads are checked by file signature and size, and images are re-encoded.

20.13 Dependencies are audited before release.

Liyo

20.14 Before text is sent to an AI provider, the server replaces names, phone numbers, email addresses, Emirates ID numbers and passport-like numbers with markers. Lead names, phone numbers, email addresses and message text are never sent. Property Finder Lead Data is never sent. A person approves every Liyo output.

20.15 Calls to an AI provider that the Customer configures with its own key go only to public https addresses, never follow redirects, time out and are limited in size.

Incident response

20.16 VortexWeb keeps a process to detect, assess, contain and report incidents, and to notify the Customer under section 9.

21. Annex 3: Sub-processors

21.1 VortexWeb uses these Sub-processors. The Sub-processor List, available from support@propliyo.com, names each company and is updated under section 10.

21.2 Stripe. Cardholder data is collected and processed by Stripe and may be stored outside the UAE under Stripe's terms. VortexWeb does not store card numbers. The Customer agrees to that processing.

21.3 Error monitoring. Request bodies and cookies are dropped, and contact details, security keys and signed links are removed, before an event is sent.

21.4 What is never sent to a managed AI provider: Property Finder Lead Data; lead names, phone numbers, email addresses and message text of any source; identity documents; passwords, Portal credentials, tokens and keys; attendance locations; and data from features or data areas the Customer has switched off.

21.5 Under their commercial terms, the managed AI providers do not use Customer content to train their models.

22. Annex 4: Customer-Chosen Recipients

22.1 These recipients receive data only when the Customer connects or switches them on. They are not Sub-processors of VortexWeb. Each acts under its own terms with the Customer or as an independent controller.

Liyo AI Addendum

1. Scope

1.1 This Liyo AI Addendum (the "Addendum") forms part of the Agreement between the Customer and VortexWeb L.L.C-FZ ("VortexWeb"). It applies whenever an Authorised User uses Liyo or Liyo Studio.

1.2 Terms defined in the Terms of Service and the Data Processing Agreement (section 3 of this page) have the same meaning here, including "Unit" and "Pack". If this Addendum conflicts with the Data Processing Agreement on the processing of Personal Data, the Data Processing Agreement prevails.

2. What Liyo does

2.1 Liyo is an assistant inside the Service. It drafts listing text, checks listings against the Service's pre-publish rules, summarises activity, prepares the morning brief, suggests replies and next steps, and in Liyo Studio prepares social images, reels, voice-overs and explainer videos from a listing.

2.2 Liyo only drafts, checks, summarises and suggests. A person approves every output before it is used.

2.3 Liyo never acts on its own. It never publishes or unpublishes a listing, changes a price, sends a message to anyone, or deletes anything. Every such action needs an Authorised User to take it, with the permissions and confirmations the Service requires.

2.4 An Admin decides whether Liyo is on for the Customer, which features and data areas it may use, and who may use it, in Settings.

3. Accuracy and the Customer's duty to review

3.1 Liyo's outputs are generated by AI models and can be wrong, incomplete or out of date. They are suggestions, not facts, advice or a professional opinion.

3.2 The Customer must review every output before using it, and in particular must check listing text, prices, sizes, permit numbers, the Trakheesi and Madmoun QR details, licence numbers and every reply before it is sent or published.

3.3 The Customer remains responsible for every listing it publishes and every message it sends, whether or not Liyo helped draft it. A listing check by Liyo does not mean a listing complies with the rules of the Dubai Land Department, the Real Estate Regulatory Agency or a Portal.

3.4 VortexWeb is not liable for loss caused by an output that the Customer used without checking it, including regulator fines and Portal penalties, as the Terms of Service state.

4. Inputs and outputs

4.1 The Customer owns its inputs to Liyo and, as between the parties, the outputs Liyo produces for it. The Customer may use the outputs for its business.

4.2 VortexWeb may keep and use redacted run records (a redacted summary of the input, the prompt version, token counts and the cost) to operate, secure, support and bill Liyo. Run records are kept with the Customer's records.

4.3 VortexWeb does not use the Customer's inputs or outputs to train any AI model.

4.4 Outputs may be similar to outputs produced for other customers. VortexWeb gives no assurance that an output is unique or free of third party rights.

5. What is sent to an AI provider

5.1 When an Authorised User uses a Liyo feature that is switched on, the Service sends the provider only what that feature needs: listing facts and text (type, bedrooms, bathrooms, size, community, building, view, amenities, furnishing, price type, title and description), listing photos for the features that use them, the question the Authorised User types, and counts for the morning brief.

5.2 Before text is sent, the server replaces names, phone numbers, email addresses, Emirates ID numbers and passport-like numbers with markers, and removes owner, landlord, seller, buyer and contact name fields.

5.3 This removal works by pattern matching. It is not perfect: a name or number written in an unusual way can get through. The Customer must not type Personal Data into Liyo free text, captions or prompts.

6. Excluded data

6.1 These are never sent to any AI provider:

• Property Finder lead data. There is no setting that allows it.
• Lead names, phone numbers, email addresses and message text, from any source.
• Identity documents and their numbers.
• Passwords, Portal credentials, tokens and keys.
• Attendance locations.
• Data from any feature or data area the Customer has switched off.

7. Providers and location

7.1 Liyo uses large language model, image, video and speech services operated outside the UAE and India, in the United States. They are Sub-processors under the Data Processing Agreement and are named in the Sub-processor List available from support@propliyo.com. The Service does not name the provider on screen.

7.2 Under their commercial terms, these providers do not use Customer content to train their models.

7.3 VortexWeb may change providers or models. Where a change affects the location of processing, VortexWeb will give notice as the Data Processing Agreement requires for a new Sub-processor.

7.4 Own key. An Admin may connect the Customer's own AI provider key instead of the managed providers. The key is stored encrypted and only its last four characters are shown. With its own key, the Customer holds the contract with that provider and is responsible for where it processes data, what it keeps and its terms. The same exclusions in section 6 still apply.

7.5 Location notice. Data in a Liyo prompt leaves the UAE and India for the time it takes the provider to answer. The Customer instructs that transfer by switching on and using the feature.

8. Units, allowances, Packs and fair use

8.1 Liyo usage is measured in Units. The allowance for each Plan, the price of each kind of run and the Packs on offer are set out in the Pricing and Billing Terms at https://propliyo.com/legal/pricing-terms and shown in Plan and billing.

8.2 A run is charged at the price in force when it started.

8.3 A run that fails because the provider call fails is not charged.

8.4 Liyo chat, the morning brief and listing checks are free within fair use of 30 chats per Authorised User a day. VortexWeb may slow or pause Liyo for an Authorised User who goes beyond fair use.

8.5 Packs are valid, transferable and refundable only as the Pricing and Billing Terms state.

9. Liyo Studio outputs

9.1 Reels and social images are built only from the listing's own photos. Liyo Studio does not generate images of a property.

9.2 Where the listing holds a permit, exports carry the permit line and QR code. A fact the listing does not hold is left out of a design, never invented.

9.3 Music in reels comes only from a licensed library. The licence covers use in the Customer's marketing of that listing.

9.4 Rendered files are kept for 30 days after creation, or deleted at once on an erase request. Names typed into captions or brochures are erased on request.

10. Prohibited uses

10.1 The Customer must not use Liyo to:

• create unlawful, discriminatory, defamatory or misleading content, including false claims about a property, its price, size, view or permit;
• create fake listings or listings for property the Customer is not authorised to market;
• impersonate a person, brokerage, developer, Portal or authority;
• extract Liyo's prompts or instructions, get around its safety controls, or attempt to jailbreak it;
• process another person's Personal Data without a lawful basis; or
• breach the Acceptable Use Policy (section 5).

11. Logging and history

11.1 Every Liyo run is logged, and every approved output is written to the audit log with the name of the person who approved it.

11.2 Liyo conversation history is deleted after 30 days.

11.3 Audit entries are kept as the retention table in the Data Processing Agreement states.

12. Suspension

12.1 VortexWeb may suspend Liyo for an Authorised User or for the Customer, without notice where needed, if it reasonably believes Liyo is being misused in breach of section 10 or the Acceptable Use Policy, or to protect the Service, a provider or a third party. VortexWeb will tell the Admins the reason and restore access once the issue is resolved.

13. Changes to Liyo

13.1 VortexWeb may change, add or withdraw Liyo features and models. A change that reduces a paid allowance or raises a price follows the notice rules in the Terms of Service and the Pricing and Billing Terms. Unused Units in a Pack stay valid for their term.

13.2 Liyo depends on outside providers. It may be slow or unavailable when a provider is. When Liyo cannot answer, the Service says so and the Authorised User can do the task without Liyo. No uptime commitment applies to Liyo unless an Enterprise or Custom Order says so.

14. Authorised Users

14.1 The Customer is responsible for the use of Liyo by its Authorised Users, for choosing who may use it and which features are on, and for making sure its Authorised Users follow this Addendum.

14.2 Questions about Liyo and personal data go to support@propliyo.com. Reports of a Liyo output that looks unsafe or wrong in a way that may affect others go to support@propliyo.com.

Acceptable Use Policy

1. Purpose and scope

1.1 This Acceptable Use Policy sets the rules for using Propliyo, supplied by VortexWeb L.L.C-FZ, Meydan Free Zone, Dubai, United Arab Emirates ("VortexWeb", "we" or "us"). It forms part of the Agreement under the Terms of Service, and a breach of it is a breach of the Agreement.

1.2 It applies to every Customer, every Authorised User and anyone else who uses or tries to use the Service. The Customer is responsible for all use of the Service under its account, including use by its employees, agents and contractors.

1.3 Words with capitals have the meaning given in the Terms of Service. "Portal" means Property Finder, Bayut, dubizzle or another listing portal the Service connects to. "Lead" means a person who has enquired about a property or whom the Customer holds as a prospect.

1.4 This Policy is not a complete list of what is unlawful. Conduct not named here may still breach the law or the Agreement.

2. Listings

2.1 Every listing must be accurate, complete and current. The Customer must not create, approve or publish a listing that is false or misleading about the property, its location, unit, size, layout, view, condition or features, its price, fees or payment plan, its availability, or the identity or licence of the brokerage or agent.

2.2 The Customer must hold a valid advertising permit for every listing it publishes, such as a Trakheesi permit, and must show the permit number and the Madmoun QR code where the regulator requires them. The permit must match the property, the advertiser and the advertised terms, and must not have expired or been cancelled.

2.3 Listings must be published under a licensed listing agent who holds a broker registration number (BRN). A Team member without a BRN may prepare a listing only under a listing agent the brokerage chooses. The Customer is responsible for keeping its office registration number (ORN) and its agents' BRNs valid.

2.4 The Customer must hold the owner's written authority to market the property, such as a Form A or another authority the regulator accepts, before it publishes a listing.

2.5 The Customer must not publish fake listings, bait listings that advertise a property to attract enquiries for a different one, duplicate listings of the same unit, or outdated listings.

2.6 The Customer must take a listing down promptly when the property is sold, rented or withdrawn. Cancelling or deleting a Propliyo account does not unpublish listings from any Portal, so the Customer must unpublish them first.

2.7 The Service never invents listing data. If a required field is missing, publishing is blocked until the Customer enters the real value. The Customer must not enter a made-up value to get past a check.

2.8 Checks in the Service, such as permit format checks, missing field warnings, duplicate warnings and quality scores, are aids only. They do not confirm that a listing is lawful, and the Customer remains responsible for every listing it publishes.

3. Portals

3.1 The Customer must follow the rules of each Portal it publishes to, including its content, photo, pricing and quota rules.

3.2 The Customer must connect to Portals only through the official Portal interfaces that the Service provides. All Portal calls go through Propliyo's server.

3.3 The Customer must not share Portal logins or credentials with anyone not entitled to them, or use credentials that belong to another brokerage. Portal credentials are stored encrypted by the Service and are never shown back in the browser.

3.4 The Customer must not manipulate Portal quality scores, rankings or refresh systems, for example by repeated republishing, artificial edits, keyword stuffing or duplicate listings.

3.5 The Customer must not use the Service to monitor, copy or analyse another brokerage's listings on a Portal.

3.6 Property Finder leads stay labelled Property Finder and must never be pooled, linked or merged with leads from other sources. They may be pushed only to the brokerage's own Bitrix24, labelled Property Finder, and must not be sent to an AI tool, Zapier, Make, an email tool, an outbound webhook or the open API.

3.7 VortexWeb may refuse or hold a publish, and may ask the Customer to unpublish or correct a listing, where it reasonably believes the listing breaks a Portal rule or the law, or where a Portal asks it to. VortexWeb does not unpublish a Customer's listing itself; where a Portal removes a listing, VortexWeb records the Portal's answer against the listing.

4. Data sources

4.1 The Customer must not scrape, crawl or harvest data from any Portal or website, and must not use the Service to do so.

4.2 The Customer must not load into the Service data from unofficial data resellers, including API marketplaces that resell Portal data, or data it knows or should know was obtained in breach of a source's terms.

4.3 The Customer must not copy other brokerages' listings, descriptions or photos.

4.4 Dubai Land Department open data is used under its licence, with credit to the Dubai Land Department as the source. The Customer must keep that credit where the Service shows it and must not extract or redistribute the raw data in breach of the licence.

4.5 A one-time copy of a brokerage's own listing photos from the Property Finder or Bayut image links held in its own Bitrix24 is allowed only with the brokerage's written agreement and VortexWeb's approval for that brokerage. It covers only the brokerage's own listings and never another brokerage's photos.

5. Telemarketing and WhatsApp

5.1 A Customer that calls Leads or prospects from or with the help of the Service must comply with Cabinet Resolution No. 56 of 2024 on telemarketing and any rules issued under it. These duties belong to the Customer.

5.2 In particular, the Customer must:

• make marketing calls only between 09:00 and 18:00 UAE time;
• not call a person again after the person has declined;
• not make marketing calls to numbers on the Do Not Call Registry, unless the rules allow it;
• call only from local numbers registered on its trade licence;
• hold any approval from the Telecommunications and Digital Government Regulatory Authority that the rules require;
• identify itself and the brokerage at the start of each call;
• keep the records the rules require, including consents, declines and call times.

5.3 Propliyo shows a warning when a call is started outside the permitted hours. It never blocks a callback to a person who has enquired, because returning an enquiry is a reply and not a cold call. The Customer must not use an enquiry as a pretext for unrelated marketing.

5.4 The Customer must send marketing by WhatsApp or SMS only to people who have given consent to receive it, and must keep a record of that consent.

5.5 WhatsApp from Propliyo is click-to-chat only. A person opens the link, which carries the number and a prepared text, and sends it themselves. The Service sends nothing automatically, and the Customer must not use any tool to get around that step.

6. Spam and bulk messages

6.1 The Customer must not use the Service to send unsolicited, bulk or deceptive messages by email, SMS, WhatsApp, push or call.

6.2 Every marketing message must go only to a contact who has consented or for whom another lawful basis applies and is recorded, must identify the brokerage as sender, and must include a working way to opt out.

6.3 A STOP reply, unsubscribe or other opt-out must be honoured at once and recorded against the contact across all channels.

6.4 The Customer must not use purchased, rented, harvested or scraped contact lists with the Service.

6.5 VortexWeb may limit sending where it sees signs of abuse, complaints or a risk to delivery for other Customers.

7. Personal data

7.1 The Customer must have a lawful basis under Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data for every contact it holds in the Service, and must give people the notices the law requires.

7.2 The Customer must not upload personal data it has no right to use, including data obtained by deception or from an unlawful source.

7.3 The Customer must not type or paste identity document numbers or scans, such as Emirates ID or passport details, into notes, comments, messages, Liyo or any other free text field. Documents the Customer needs for its compliance duties go into the document fields made for them.

7.4 The Customer must respect the do-not-call, consent and marketing flags recorded in the Service, and must not override or clear them without the person's instruction.

7.5 The Customer must set roles so that each Authorised User sees only what the job needs, and must not export or share personal data with people who are not entitled to it.

7.6 The Customer must not use the Service to track, profile or harass a person, or to collect special categories of personal data such as health data or religious belief.

8. Accounts and security

8.1 Each Authorised User must have a personal login. Logins must not be shared, rented or resold.

8.2 Admins must use multi-factor authentication. The Customer must remove access promptly when a person leaves and tell VortexWeb at once if it suspects a login has been compromised.

8.3 A person who opens Propliyo from inside the brokerage's Bitrix24 is signed in by Bitrix24, so the Customer is responsible for the security of its Bitrix24 accounts.

8.4 The Customer must not get around user caps, listing caps, Plan feature gates, Liyo limits or billing, for example by opening extra accounts, taking repeated Trials or sharing one login among several people.

8.5 The Customer must not access the Service by automated means, such as scripts, bots or crawlers, except through the open API with its own keys and within the documented rate limits. API keys must be kept secret.

8.6 The Customer must not try to access another Customer's data, bypass permission checks or tenant separation, upload malware, overload the Service, reverse engineer it, or use it to build a competing product.

8.7 The Customer must not ask VortexWeb staff to bypass a control in the Service or to open another Customer's data.

9. Security testing

9.1 No one may scan, probe, load test or penetration test the Service, or attempt social engineering against VortexWeb staff, without VortexWeb's prior written consent. A request for consent goes to support@propliyo.com with the scope, dates, methods and tester details. A test that goes beyond the consent given is a breach of this Policy.

9.2 A person who finds a vulnerability in good faith should report it to support@propliyo.com with enough detail to reproduce it. The person must stop testing once the issue is confirmed, must not access, change or keep data that is not theirs, must not disrupt the Service, and must not disclose the issue to others until VortexWeb has had a reasonable time to fix it.

9.3 VortexWeb will not treat a good-faith report that follows section 9.2 as a breach of this Policy and will not bring a claim against the reporter for it. This does not cover conduct that breaks the law in a way VortexWeb cannot waive, or any harm caused to other Customers.

10. AI misuse

10.1 Liyo drafts, checks, summarises and suggests. Every Liyo output must be reviewed and approved by a person before it is used, and the Customer is responsible for it as if it had written it. Liyo never publishes, unpublishes, changes a price, sends a message or deletes anything on its own, and the Customer must not set up any tool that lets it do so.

10.2 The Customer must check every fact, figure, permit detail and claim in a Liyo output before use. Liyo can be wrong.

10.3 The Customer must not use Liyo to produce misleading, discriminatory, defamatory or unlawful content, including invented features, views, returns or prices, fake reviews or testimonials, or content that impersonates another brokerage, agent, owner, regulator or Portal.

10.4 The Customer must not try to extract Liyo's prompts or instructions, bypass its filters or safeguards, or use it to produce content unrelated to the Customer's real estate business.

10.5 The Customer must not type personal data, identity document details, passwords, card details or another party's confidential material into Liyo. The Service removes common identifiers before text goes to an AI provider, but this works by pattern matching and is not perfect.

10.6 Liyo is not legal, valuation, tax or financial advice, and the Customer must not present its output as such.

11. Content rules

11.1 The Customer must not upload, publish or send through the Service content that:

• is unlawful or promotes unlawful conduct, such as fraud or money laundering;
• is defamatory, obscene, hateful or discriminatory, or is contrary to public order or public morals in the UAE;
• infringes copyright, trade marks or another person's rights, including photos the Customer has no right to use;
• exposes another person's confidential or personal information without authority;
• contains hidden links, redirects or malicious code.

11.2 The Customer must not present AI-generated or AI-altered property images as real photos of the property. Virtual staging and renders may be used only where they are clearly labelled as such and the Portal's rules allow them. Basic corrections such as cropping, straightening and exposure are allowed.

12. Enforcement

12.1 If VortexWeb reasonably believes this Policy has been breached, it may take one or more of these steps, in proportion to the breach: a warning; removing content or refusing a publish; suspending a feature or an Authorised User; suspending the account; or ending the Agreement under the Terms of Service.

12.2 Where practical, VortexWeb gives notice, explains the reason and gives the Customer a reasonable chance to fix the problem before it acts.

12.3 VortexWeb may act at once, without prior notice, in serious cases, such as a security threat, a risk to a Portal connection, a request from a Portal or regulator, unlawful content, or a breach of the Property Finder lead rules. It then tells the Customer as soon as practicable.

12.4 Suspension does not stop Fees from being due and does not unpublish live listings unless the listing itself is the problem. The Customer is responsible for any fine, claim or loss caused by its breach, as the Terms of Service provide.

12.5 If VortexWeb does not act on a breach, it has not waived its right to act later.

13. Reporting

13.1 Anyone can report misuse of the Service, such as a misleading listing, an unwanted message sent through Propliyo or a suspected account compromise, to support@propliyo.com. Security vulnerabilities go to support@propliyo.com.

13.2 A report should give the listing or account concerned, the date, what happened and any evidence that can be shared safely. Please do not send passwords or Portal credentials.

13.3 A person who received a call or message from a brokerage should also contact that brokerage, which is responsible for it. VortexWeb passes reports to the Customer concerned and may take the steps in section 12.

14. Changes to this Policy

14.1 VortexWeb may update this Policy when the law, Portal rules, security practice or the Service change. For a material change it gives at least 30 days' notice by email to Admins and in the app. Where a change is required by law or by a Portal, it may apply sooner, with notice as soon as practicable.

14.2 The version and date at the top of the page show which text applies.

Support Policy

1. Scope

1.1 This policy describes the support VortexWeb L.L.C-FZ gives Customers using Propliyo. It forms part of the Agreement described in the Terms of Service (section 1 of this page). Words with capital letters have the meanings given in the Terms of Service.

1.2 Support covers questions about how the Service works, problems signing in, publishing and Portal sync errors shown in the Service, imports, billing and account settings, and reports of defects.

1.3 An Enterprise or Custom order form may add to this policy, for example with phone support, a named contact or an uptime target. Where it does, the order form applies.

2. Hours

2.1 Support works Monday to Friday, 10:00 to 18:00 Gulf Standard Time (UTC+4). UAE public holidays are excluded.

2.2 A "working day" in this policy means a day and the hours in clause 2.1.

3. Channels

3.1 In the Service: open Help and raise a ticket. This is the fastest route, because the ticket carries the account and page you were on.

3.2 By email: support@propliyo.com. Write from the email address on your Propliyo login so that we can find your account.

3.3 There is no phone support unless an order form says so.

4. Reply target

4.1 We aim to send a first reply within one working day of receiving a ticket or email.

4.2 We deal first with a brokerage that cannot sign in or cannot publish to a Portal. Other requests are handled in the order received.

4.3 A first reply is a reply from a person, not an automatic acknowledgement. It may ask for more detail. Some problems take longer to fix than to answer; we keep you updated on the ticket.

4.4 A defect that stops the Service working as described and that we do not fix within 10 working days of your ticket may lead to a refund under the Cancellation and Refund Policy (section 2 of this page).

5. What support can access

5.1 Our support staff, including staff of VortexWeb Cloud LLP acting on our instructions, can open a brokerage's records only through a support session.

5.2 Every support session:

• states one reason, such as troubleshooting, onboarding or an incident;
• ends after 30 minutes at most; and
• is written to the brokerage's audit log when it starts and when it ends, where the brokerage's Admins can see it.

5.3 Support never signs in to a brokerage's Property Finder, Bayut, dubizzle or other Portal account, and never asks for a Portal login.

5.4 Support never asks for your password, your multi-factor code or a card number, by email, chat or phone. If anyone claiming to be from Propliyo asks for one, do not give it, and report it to support@propliyo.com.

5.5 Support does not see Property Finder lead data outside a support session, and never sends it to any AI provider or outside tool.

6. Out of scope

6.1 Support does not cover:

• disputes about a brokerage's account, quota, fees or listing decisions with a Portal, which must be raised with that Portal;
• obtaining, checking or renewing permits, Madmoun QR codes, BRNs or ORNs;
• legal, tax, valuation or regulatory advice;
• custom development, custom reports or integrations that the Service does not offer; and
• the brokerage's own Bitrix24 configuration, beyond the Propliyo connection itself.

6.2 We may point you to the right party for these matters, but we are not responsible for the outcome.

7. Portal notices

7.1 When a Portal has an outage, changes its rules or changes its interface in a way that affects publishing or leads, we may post a notice in the Service so that Admins and listing agents know what is happening and what to do.

7.2 These notices are information only. Each Portal's own rules and messages prevail.

8. Security reports

8.1 Report a suspected security problem, a compromised login or a suspicious message to support@propliyo.com. Give as much detail as you can, and do not test the Service in a way that could affect other customers or their data.

8.2 We review security reports as a priority, including outside support hours where the report shows an active risk.

9. Availability and maintenance

9.1 We work to keep the Service available, but this policy and the Terms of Service give no uptime guarantee. An uptime target and service credits apply only where an Enterprise or Custom order form states them.

9.2 We carry out maintenance outside UAE business hours where we can, and give notice in the Service where possible. Urgent security or stability work may be done without notice.

10. Changes to this policy

10.1 We may change this policy under the change clause of the Terms of Service: with at least 30 days' notice by email to Admins and in the Service, or at once where a law, regulator or Portal requires it, with notice as soon as practicable.