Skip to content
The app for real estate agents in the UAE · Create your account

Privacy Policy

Draft template · not yet reviewed

What data Maklor processes, why, where it is hosted, which providers it is entrusted to and how long it is kept — UAE market.

Template — not reviewed legal text. This page is a draft template for the UAE Personal Data Protection Law (PDPL, Federal Decree-Law No. 45 of 2021). It must be reviewed by UAE counsel before this site accepts real sign-ups.

01. Data Controller

Maklor is a product of Mulklick GmbH [UAE ENTITY AND REGISTERED ADDRESS — TO BE COMPLETED]. For users in the United Arab Emirates, Mulklick GmbH processes personal data subject to the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021, "PDPL").

[TO BE LEGALLY REVIEWED — À VALIDER JURIDIQUEMENT] Whether a local UAE-registered entity or a data protection representative is required to offer this service commercially in the UAE has not been determined.

For any question about your data: support@maklor.ae.

02. Scope

This policy covers the maklor.ae website, the agents' web cockpit and the agencies' management area, as well as the Maklor Field mobile app.

An agency using Maklor also enters data about its own clients (owners, buyers, tenants, applicants). For that data, the agency decides on the processing; Mulklick GmbH processes it on the agency's behalf. If you are a client of an agency, please contact the agency first; we will help it respond.

03. Data We Process

  • Website visits: the hosting provider's technical logs (IP address, requested page, browser). No audience measurement tool is installed.
  • Contact and walkthrough request forms: the information you enter (name, email, agency, role, message…), sent by email to our mailbox.
  • Account: email address and password, name, phone, job title, profile photo; for the agency, name, emirate, contact details, logo, subscription, staff roles and invitations.
  • Work content: listings (address, property type, price or rent, deadlines, owner's name), client contacts (name, phone, email), viewings (photos, notes, answers, voice memos and their transcription), documents, offers, appointments and PDF reports.
  • Buyers' and tenants' search criteria: property preferences, budget, down payment, financing, household income, household composition, as entered by the agent.
  • Closing files: the documents the agent uploads (for example passport/Emirates ID, trade licence, salary statement) and the information read from them (name, date of birth, nationality, residence).
  • Email, if the agency connects a mailbox: the mailbox credentials (encrypted), correspondents' addresses and names, message dates and technical identifiers, and their classification. Message bodies are not stored.
  • Calendars, if the agent connects one: access tokens (encrypted); events read (title, times, location) and events written by Maklor.
  • Maklor mobile app: see section 11.

Maklor also uses public transaction data (Dubai Land Department, "DLD") for market benchmarks. This data does not come from your clients.

04. Purposes and Legal Bases

  • Providing the subscribed service (account, listings, viewings, reports, closings, calendars, email): performance of the contract.
  • Answering your requests and providing support: performance of the contract or legitimate interest.
  • Service security and abuse prevention: legitimate interest.
  • Automated features applied to emails (sorting, summaries, reply suggestions): only when the agency has enabled them.
  • Legal obligations, in particular keeping accounting records.

[TO BE LEGALLY REVIEWED — À VALIDER JURIDIQUEMENT] Mapping each purpose above onto the specific PDPL legal basis (Article 4 — consent, contract necessity, legitimate interest, legal obligation) has not been reviewed by counsel.

05. Technical Providers

Some features (analysis of photos, documents and texts, transcription, email reply suggestions) rely on technical providers, some of them in the United States, with standard contractual clauses. Data is sent to them only for the requested feature — the providers and safeguards are the same across all Maklor markets. [FULL PROVIDER DETAIL — TO BE COMPLETED.]

06. Where Data Is Hosted

  • Database, files and authentication: Supabase, AWS data centre in Stockholm (Sweden).
  • Application server (API): Railway, West Europe region (Netherlands).
  • Website and cockpit relay: Vercel, Frankfurt (Germany) and Vercel's global network.

None of Maklor's infrastructure is currently located inside the United Arab Emirates — data for UAE users is processed and stored in the European Union / EEA (see section 08).

07. Processors

We do not sell your data. We only entrust it to the following providers, for the purposes stated.

Supabase
Database, file storage, authentication · Sweden (US company)
Railway
Application server hosting · Netherlands (US company)
Vercel
Website hosting and relay of cockpit requests · Germany (US company)
Technical provider (United States)
Analysis of photos, documents and texts, transcription
Apple, Google
Mobile notifications: device token and notification text · United States
Google, Microsoft, Apple
Calendar synchronisation, only if the agent connects a calendar · United States
Agency's email provider
Reading and sending emails from the mailbox the agency connects
Dubai Land Department (DLD)
Source of public transaction data used for market benchmarks · United Arab Emirates (open data, no personal data received)
Google Fonts
Fonts on the management area and public pages: IP address and browser · United States

08. Cross-Border Transfers

Personal data of UAE users is transferred outside the United Arab Emirates to the providers and locations listed above (European Union / EEA and, for some technical providers, the United States).

[TO BE LEGALLY REVIEWED — À VALIDER JURIDIQUEMENT] PDPL Article 22 requires that a cross-border transfer rely on an adequate-protection decision, appropriate safeguards (such as standard contractual clauses), or another lawful PDPL derogation. Which mechanism applies to each provider above has not yet been confirmed by counsel.

09. Data Retention

  • Account and work content: for the whole term of the contract. There is not yet any automatic deletion or self-service account deletion: deletion can be requested at support@maklor.ae.
  • Email bodies: not stored; a daily check erases any body that may have been written to the database.
  • Reply suggestions: deleted after 7 days if dismissed, after 30 days if never sent.
  • Sign-in session: 7 days. Staff invitation: valid for 14 days.
  • Removed items: a deleted viewing photo is erased from storage; other deletion behaviour follows the retention rules above.
  • Legal obligations: accounting records are kept in accordance with applicable law.

10. Security

Connections are encrypted (HTTPS). Mailbox passwords, calendar tokens and closing-file documents are encrypted by Maklor before being stored. Other files (photos, viewing documents, PDF reports) are kept in private storage and are only accessible through short-lived signed links.

11. Maklor mobile app

  • Camera and photo library: photos of the property, rooms and documents, profile photo, agency logo.
  • Precise location: read on demand, when you tap "Use my location" during a viewing or open the signals screen; never in the background.
  • Notifications: device token, time zone and language, linked to your account.
  • Face ID, Touch ID or fingerprint: checked by the device's operating system. No biometric data leaves the device.
  • On-device storage: the viewing in progress and downloaded PDFs are kept locally and may be included in device backups.

The app does not read the address book, does not use the microphone, contains no audience measurement, advertising or crash reporting tool, and does not track you across other apps or websites.

12. Cookies and Local Storage

The website only uses cookies that are necessary for it to work, with no audience measurement or advertising:

  • maklor_session: cockpit sign-in session, 7 days;
  • mk_setup: indicates that account setup is complete, 10 minutes;
  • mk_access: access to the website while it is password-protected, 7 days.

13. Your Rights Under the PDPL

Under the UAE Personal Data Protection Law, you may:

  • request confirmation of whether your data is being processed, and access to it;
  • have inaccurate or incomplete data corrected;
  • request erasure of your data, subject to legal retention obligations;
  • receive your data in a structured, commonly used format (data portability);
  • restrict or object to processing;
  • withdraw a consent at any time, without affecting processing already carried out.

Write to support@maklor.ae; we aim to respond within 30 days.

[TO BE LEGALLY REVIEWED — À VALIDER JURIDIQUEMENT] The identity of the supervisory authority to contact (UAE Data Office) and the exact complaint procedure have not yet been confirmed.

14. Changes

We update this policy when our processing changes. The date at the top of the page shows the current version.