Privacy Policy
What we collect, why, who processes it, and how to get it corrected or deleted — written to be read, not scrolled past. Last updated: 17 August 2026.
The controller of your data
DubaiHandover (dubaihandover.com) is operated from Dubai, United Arab Emirates. For anything in this policy, the fastest route to a human is [email protected] — data questions, corrections, and deletion requests all land in the same inbox and are answered by the people who run the service.
The data we hold, item by item
Account and alert data: your email address; which projects you track and when you started; which plan you are on and any paid plan you have expressed interest in; sign-in timestamps. Passwordless sign-in links mean we never store a password.
Optional profile details, only if you choose to give them on your account page: your first name (so emails can greet you), what best describes you (owner, buyer, agent, investor, researcher), country of residence, a WhatsApp number if you opt in to future WhatsApp alerts, and how you heard about us. Every one of these can be left blank, and skipping them changes nothing about the service.
Messages: anything you send through the contact form (name, email, topic, message) or by email.
Visitor analytics, collected first-party on our own servers: for each page view we record the time, page, referring site, IP address, approximate location derived from the IP (city and country), internet provider, and device type, browser, and operating system. We use no third-party analytics or advertising trackers — no Google Analytics, no Facebook pixel, nothing of that kind.
Cookies: a session cookie (dh_user) that keeps you signed in for up to 30 days, and an equivalent cookie for staff on the admin console. Both are HttpOnly and used solely for authentication. We set no advertising or cross-site tracking cookies, which is why the site shows no cookie banner theatre.
What each piece is used for
Your email exists to deliver exactly what you asked for: sign-in links, alerts about projects you track, and — if you joined a plan waitlist — the launch notice for that plan. We do not send marketing blasts, and we never share or sell your address.
Visitor analytics exist to understand which pages matter, keep the service secure (spotting abuse, scrapers, and attack patterns), and make product decisions. The IP address is the technical backbone of that: it is how we distinguish visitors, detect bots, and derive coarse location.
Contact messages are used to answer you and to fix whatever you reported.
Real-estate broker & agency listings
Separately from the data above, DubaiHandover publishes a directory of real-estate brokers and brokerages in Dubai. This professional information is sourced from the Dubai Land Department (DLD) publicly available broker register and its public broker-card service — the same official records the DLD itself publishes so consumers can verify an agent.
For a licensed broker we may show the name, RERA broker registration number (BRN), licence status and dates, the brokerage worked under, the DLD star rating and office rank, and — where the DLD public card provides them — a photograph and professional contact details. For a brokerage we show the office name, number, DLD rank, logo and agent roster. We add only factual context computed from public records (for example, recorded transaction counts); we never invent or infer personal details.
Our lawful basis for publishing this professional, publicly-available regulatory data is our legitimate interest — and the clear public interest — in helping buyers and renters confirm that an agent is genuinely RERA-licensed and current before they transact. Placement is never paid; the ordering reflects public registry activity only.
If you are a broker and do not want your profile listed, email [email protected] from your DLD-registered address (or use the removal option on your profile) and we will delete your name, photograph and contact details and suppress the profile — promptly and free of charge. We honour removal requests regardless of the public origin of the data.
Processors and services we rely on
Our servers are hosted with Amazon Web Services in Frankfurt, Germany (EU) — the database holding accounts, subscriptions, and analytics lives there, with encrypted backups.
Cloudflare fronts the website as a security and delivery network, so requests pass through their infrastructure before reaching us.
Emails are delivered via Google Workspace (Gmail SMTP) from [email protected].
IP-based location lookups are performed against a geolocation service; only the IP address itself is sent for lookup, never your identity.
When paid subscriptions launch, payments will be handled by Paddle as merchant of record — Paddle is the legal seller for card processing, taxation, and invoicing, and card details go to Paddle directly. We never see or store card numbers.
We do not sell, rent, or trade personal data with anyone, full stop. We would disclose data only if a legally valid order compelled it.
How long we keep things
Account data lives for as long as the account does. Close your account (or ask us to) and it is deleted, along with your tracked-project list.
Visitor analytics are retained to build long-term usage history for the product. IP-to-location lookups are cached so we don't repeatedly query the lookup service.
Contact messages are kept for as long as they remain useful for support history.
If you ask us to delete your data, we honor it across all of the above — see your rights below.
Access, correction, deletion — one email
Email [email protected] from the address concerned and we will, within 30 days: tell you exactly what we hold about you, correct anything wrong, or delete everything tied to your email address and IP history. No forms, no fees, no friction.
Every alert email contains the means to stop receiving it — untrack projects from your account page, or reply and we do it for you.
If you are in a jurisdiction with statutory data rights (such as the EU's GDPR or the UAE's Personal Data Protection Law), the same email address is how you exercise them.
When this policy changes
If we materially change what we collect or how we use it, account holders are notified by email before the change takes effect, and this page's date updates. Last updated: 17 August 2026.