MAPSTI Privacy Policy

MAPSTI (mapsti.com, app.mapsti.com, agency subdomains *.mapsti.com and the MAPSTI mobile app) is operated by OASISCLOUD TECHNOLOGIES L.L.C, Office F1-516, Dubai Investments Park 1, Dubai, United Arab Emirates (Dubai DET trade licence no. 1368299) ("MAPSTI", "we"). We are the controller of personal data described in this policy. We process data under the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL) and other applicable UAE laws. Privacy contact: privacy@mapsti.com.

Where an agency uses MAPSTI under its own brand (white-label), that agency decides how it uses its clients' data and is the controller for it; MAPSTI acts as its processor.

• Account data: name, email, phone, company, role (broker, agency, developer, developer's sales agent), password (stored encrypted), profile photo.
• Professional data: agency name, RERA/BRN or trade licence numbers, licence documents, team membership.
• Messages: content and attachments of chats inside MAPSTI, WhatsApp messages exchanged with MAPSTI's WhatsApp Business number, and emails to support@ or billing@mapsti.com, with time and delivery status.
• Deal and verification data (only for deals through our partner broker, section 6): client name, Emirates ID or passport, booking form, SPA and invoices.
• Payment data: subscription plan, invoices and the last 4 digits of the card. Card numbers are processed by Stripe and never stored by MAPSTI.
• Website forms: company, name, email and optional phone you send in a demo or contact request.
• Usage data: pages and projects viewed, searches, clicks, device, browser, IP address and approximate location.
• Property data: projects, units, prices, payment plans, brochures and price lists published by developers or shared by their sales agents by email, WhatsApp or upload. These may contain the name and contact details of the developer's agent who shared them. This includes commercial materials (brochures, price lists, floor plans, project details) that developers' representatives distribute to real estate professionals through industry communication channels (such as messaging apps and email) in which MAPSTI participates. We use them only to keep project data current; we do not collect private conversations, and an agent can ask us at any time to stop using their contact details (privacy@mapsti.com).

MAPSTI lets users talk to each other (broker ↔ agency ↔ developer) in a built-in chat similar to WhatsApp, and lets MAPSTI talk to users by WhatsApp and email.

• Messages are visible to the participants of the conversation and to authorised MAPSTI staff when needed for support, safety or legal reasons. We do not read chats for advertising.
• A developer sees only conversations it takes part in. Agencies and developers never see each other's private chats.
• WhatsApp messages are delivered through Meta's WhatsApp Business Platform and are also subject to WhatsApp's terms. 24-hour and template rules of WhatsApp apply.
• Do not send card numbers, passwords or ID documents in chat. Use the dedicated upload in a deal instead.
• Automated replies are always labelled as automated. Support staff may use a team name instead of their personal name.

We use AI (currently Google Gemini) to read developer brochures and price lists and turn them into structured unit data, and may use it to draft support replies. AI output can contain errors; prices and availability must be confirmed with the developer before a deal. We do not make decisions with legal effect about you using AI alone, and you may ask for a human review.

• Other users: your profile and messages, with the people you contact or who contact you. Contact details of a developer's agent are shown to brokers only when you choose to reveal them.
• Partner broker McCone Properties (RERA-licensed brokerage, Dubai): only when an agency chooses a deal with faster commission (Terms of Use, section 7). We share the deal, client KYC and agency data needed to close the deal and pay the commission.
• Developers: client and deal data needed to book a unit and sign the SPA.
• Service providers acting on our instructions: Supabase and Cloudflare (hosting, files), Lovable (application platform), Stripe (payments), Postmark and Google Workspace (email), Meta/WhatsApp (messaging), Google (Analytics, Gemini AI), Mailgun (receiving price lists).
• Authorities: when the law requires it.
• Buyer of our business, if MAPSTI is sold or merged, under the same protections.

We do not sell personal data.

Some providers store data outside the UAE (e.g. EU, USA). We use providers with contractual data-protection commitments and transfer only what they need, as allowed by the PDPL.

You can ask to access, correct, delete or receive a copy of your data, restrict or object to processing, withdraw consent and object to marketing. Write to privacy@mapsti.com. We answer within 30 days and may ask you to confirm your identity. You may also complain to the UAE Data Office.

We use necessary cookies and browser storage for login, security and to remember your cookie choice. Google Analytics 4 runs in basic Consent Mode: before you accept, it does not load and sends no data or measurement signals to Google. After you accept, analytics cookies measure visits; GA4 does not store IP addresses and event data is kept for 14 months. We do not use advertising or ad personalisation. You can change your choice at any time under "Cookie settings" in the website footer.

Encrypted connections (HTTPS), encrypted passwords, role-based access, separation of data between agencies and developers and logging of automated messages.

MAPSTI is a professional platform for adults (18+). We do not knowingly collect children's data.

We will announce material changes by email or in the app at least 14 days before they apply. The date at the top shows the latest version.