Privacy policy

What we collect

Account data. Your name, email address, phone number, password (stored only as a cryptographic hash, never as text we can read), the roles attached to your account, your language and currency preferences, and your notification settings. If you sign in with Google or Apple we receive your name and email address from that provider, and we link it to your account.

Verification documents. If you are an agent, agency, developer, or owner, we collect the documents and reference numbers that prove who you are and what you are entitled to advertise: an Emirates ID, a broker card, a broker registration number, an office registration number, a trade licence, a title deed or other ownership document, an advertising permit and its document, and, where relevant, a tenancy contract or a developer no-objection certificate. We also store what our system reads out of those documents, such as a licence number and an expiry date. These files are never public. They are served only to you and to authorised members of our team, and every time a member of our team opens one of your identity documents that access is recorded against the person who opened it.

Listing content and photos. Everything you publish about a property: the unit facts, price, terms, description, and the photos you upload. This is published deliberately and is visible to anyone once the listing is live.

Messages. The conversations you have with other members through Habanto, including the message text and who sent what and when.

Enquiries, viewings, and offers. A record of the homes you save, the enquiries and callback requests you send, the viewings you book and the slots that were confirmed, and the offers you make and how they were decided.

Payment data. If you pay us, our payment processor Stripe collects and holds your card details. We never see or store a card number. What we store is your Stripe customer reference and the record of your subscriptions and what was charged. The last four digits and brand of a saved card, and your invoices, are read from Stripe at the moment you open your billing page and are not kept by us.

Support and administration records. If you ask our support team for help, an authorised member of our team may sign in to your account to act on your behalf. Every such session is time limited, is recorded with the name of the person who started it and the reason they gave, and is shown to you by a banner across the site while it is active. Certain sensitive actions, including deleting your account, changing your password, and anything to do with saved cards, are blocked outright during one.

Email delivery records. For every email we send you we record the address, the subject, the type of email, and whether it was delivered, bounced, or was marked as spam, so that our support team can tell you what happened to an email you did not receive. We do not store the body of the email.

Technical and security data. Your IP address, your browser and device description, and the times of your sign-ins. We use these for security, to show you the list of devices signed in to your account, and to limit abuse.

Waitlist. If you joined our waitlist before signing up, we hold the name, email address, phone number, role, and optional building or community you gave us then.

Why we collect it

To run your account and provide the Service: signing you in, showing you the homes you saved, delivering your messages and enquiries, and letting you publish and manage listings.

To verify people and property, which is the point of Habanto. We check identity and licence documents so that a person browsing a home can rely on who is behind it. This is why we collect more from professionals than from seekers, and why we ask an owner to prove ownership before a listing on their unit goes live.

To take payment for the fees professionals owe us, and to issue invoices.

To keep Habanto safe: preventing fraud and impersonation, investigating reports, enforcing our Terms and our Content moderation policy, and protecting the site against abuse.

To communicate with you: transactional messages about your own account, listings, enquiries, and payments, and, where you have opted in, alerts about saved searches and product updates. Transactional messages about your own record are not optional, because they are how you find out what happened to something you submitted.

To meet legal and regulatory obligations, including tax and accounting requirements.

Our legal basis

We rely on the performance of our contract with you for everything needed to run your account and provide the Service, on our legitimate interests for security, fraud prevention, and improving the product, on your consent where you opted in, for example to marketing or to joining the waitlist, and on compliance with a legal obligation where the law requires us to keep or produce something.

Where we rely on your consent you can withdraw it at any time, from your notification settings or by emailing info@habanto.com.

What other members can see

A listing you publish is public, including its photos, price, and the professional or owner attached to it. A verified professional profile is public: the name, registration number, emirate, languages, service areas, and the phone number you chose to publish. Your account email address and your account phone number are never published.

When you send an enquiry, the professional you sent it to sees it. If you turn off "show my name" in your privacy settings, they see you as a Habanto member instead of by name, and your email address is withheld. One exception is deliberate and you are told about it on the form: if you ask to be called back, your name, email address, and phone number are shared with the agent you chose, because a callback is a request to be contacted directly.

A phone number published on a professional profile or a listing is not written into the page. A signed-in member reveals it, and we record that a reveal happened so the professional can see how many people asked to call.

Cookies

We use strictly necessary cookies only: one to keep you signed in (your session) and one to protect the site against abuse (security). These cannot be switched off and are never used for advertising or tracking.

A few services we rely on set their own cookies directly in your browser: Stripe (fraud prevention on card payments), Cloudflare Turnstile (confirming you are not a bot), and Google Maps (on pages with the interactive map). Each provider’s own policy explains how it uses these cookies.

We do not use advertising or tracking cookies, and no cookie is set for analytics, so we do not show a cookie consent banner. Our analytics is described in the next section.

Analytics

We measure how the site is used so we can fix what does not work. We use PostHog, configured to record only a short list of named events we have decided in advance, such as a search being run and how many homes it returned, a listing page being opened, an enquiry being sent, or a listing being submitted for review.

We do not use automatic click tracking, and we do not record your screen or your session. Nothing you type is collected: the words you enter in the search box are never sent, and neither is your name, email address, phone number, or any document you upload. Where an event needs to identify you, it uses your account identifier, never your email address.

To recognise a returning browser, we store one anonymous identifier in your browser’s local storage. It is not a cookie, it is not shared with any other website, and it is not used for advertising.

We also count how often a listing is shown in search results and opened, as anonymous daily totals with no personal data attached, so we can tell which parts of the site are actually used.

Analytics data is processed by PostHog on servers in the European Union. If your browser sends a Do Not Track signal we do not collect analytics from it at all. You can also ask us to delete your analytics data by emailing info@habanto.com.

How long we keep it

Account data. For as long as your account exists. When you delete your account we delete it, subject to the exceptions below.

Verification documents. Once a document has been reviewed, the file itself is deleted after a fixed window: 30 days for an Emirates ID, and 90 days for every other document type. A document still waiting for review is never deleted while it is genuinely waiting, and is removed after 180 days on the basis that nobody is coming to review it, at which point we close it as not accepted so you can upload again. A daily sweep does this. What remains after the file is deleted is the record that a document of that type was submitted and what was decided, not the document.

Listing content. For as long as the listing exists in our records. A withdrawn or expired listing is retained as part of the professional’s own history.

Messages, enquiries, viewings, and offers. For as long as your account exists.

Payment records. Invoices and the record of amounts charged are kept for as long as tax and accounting law requires, which is longer than your account may last. This is one of the exceptions to deletion.

Email delivery records and security logs. Retained for support and security purposes, and not used for anything else.

Audit records. Decisions our team takes, such as approving or rejecting a listing or a document, suspending an account, or opening an identity document, are kept in an internal audit trail. This is also an exception to deletion: an audit trail whose subjects can erase themselves from it is not an audit trail.

Waitlist. Until we launch or until you ask us to delete it, whichever comes first.

Who processes it for us

We do not sell your data. We share it with service providers that process it for us under contract, and only for the purpose each is engaged for.

Hosting and database: Vercel (running the site) and Neon (our database).

File storage: Cloudflare R2, where uploaded documents and photos are stored. Cloudflare Turnstile also provides our bot protection.

Payments: Stripe, which collects and holds card details and processes charges.

Email: Resend, which delivers our transactional email.

Analytics: PostHog, on servers in the European Union, as described above.

Sign-in: Google and Apple, if you choose to sign in with them.

Maps: Google, on pages with the interactive map.

Customer records: HubSpot, which holds contact details for people who sign up or join the waitlist so we can follow up.

Error reporting and uptime monitoring, which receive technical diagnostics about failures and can incidentally include an identifier for the request that failed.

We may also disclose data where the law requires it, to a UAE authority or regulator acting within its powers, or where it is necessary to establish, exercise, or defend a legal claim.

Where it is processed

Habanto is a UAE business and the federal Personal Data Protection Law applies to us. Several of the providers listed above run infrastructure outside the UAE, including in the European Union and the United States, so your data is transferred and processed outside the UAE.

We only use providers that commit contractually to protect the data they process for us and to process it solely on our instructions, and we transfer only what each provider needs for its purpose.

Your rights

Under the UAE Personal Data Protection Law you can ask to access your data, correct it, delete it, restrict or object to how we process it, receive a copy of it in a portable form, and withdraw a consent you gave.

You can delete your account yourself, at any time, from your account settings. Before you confirm, we show you exactly what will be removed. Deleting your account removes your account data, your saved homes, your messages, and the verification documents you uploaded, withdraws your listings from the public site, and cancels any subscription attached to them. What survives is listed under "How long we keep it": records the law requires us to keep, and our internal audit trail.

To exercise any other right, or if you want us to act on a right rather than doing it yourself, email info@habanto.com. If you are not satisfied with how we handled your request, you can complain to the UAE Data Office.

Security

Passwords are stored only as cryptographic hashes. Sessions are opaque tokens, not readable identity. Uploaded documents live in private storage and are never served from a public address: each request for one is checked against who is asking, and a request by our team for someone else’s identity document is recorded against that person by name. Sensitive actions are blocked while a support session is acting on your behalf.

We use reasonable technical and organisational measures to protect your data. No method of storage or transmission is completely secure, so we cannot guarantee absolute security.

Children

Habanto is not intended for anyone under 18 and we do not knowingly collect personal data from anyone under 18. If you believe we have, write to info@habanto.com and we will delete it.

Changes

We may update this notice as the product changes, and will post the new version here. Because this notice describes what we actually do, a change to what we collect, who processes it, or how long we keep it is a change to this page.

Contact

If you have any question about this notice, or want to exercise a right, email us at info@habanto.com.