Draft for legal review. Not yet in effect. Items in [brackets] must be completed and the whole policy checked by a UAE-qualified lawyer before launch.

Legal

Privacy Policy

Last updated [date]

The short version

Verified, never forwarded. Landlords and agencies see that you are verified, not your documents, unless you approve a specific request.
Your OK for every share. Each share is a separate consent for one purpose and one recipient. You can withdraw any of them.
You see every view. Every time someone outside Miftah views your file, it is logged and shown to you.
Kept in the UAE. Your data is stored in a UAE cloud region.
Deleted when done. Raw documents are deleted once the step that needed them is complete.
Never sold. We do not sell your personal data.

Who we are

Miftah is operated by [company legal name], licensed in [Abu Dhabi / ADGM] under licence number [number], with its registered address at [address]. In this policy, “Miftah”, “we” and “us” mean that company.

We handle your personal data in line with the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data [and/or the ADGM Data Protection Regulations 2021, depending on where Miftah is registered].

Questions about this policy: miftah.co/contact. Data protection contact: [name or role, email].

What we collect

We collect only what a step of your move-in needs. If a step can be done without a piece of information, we do not ask for it.

From UAE PASS or your Emirates ID

Your name, Emirates ID number, nationality, date of birth, mobile number and email, when you sign in with UAE PASS or scan your Emirates ID.
A face scan, used only to confirm that you are the person on the ID. It is processed by our identity verification provider; we keep the result, not [the face image / biometric data] [confirm with provider].

For your move-in

Your new address, unit, move-in date, tenancy details and the agency or landlord involved.
Documents a step requires, such as your passport, proof of funds or bank details. We ask for them only when needed and delete them when that step is done.
The services you choose, your visit preferences, and anyone you name to let technicians in.
Your signatures on the documents you approve through UAE PASS or our e-signature provider.

Payments

Payment amounts and status. Card details are handled by our payment partner, [payment partner name]. We never store your card number.

When you use Miftah

Basic technical information such as device type, browser and sign-in times, used to keep your account secure.
Messages you send us and our replies.

How we use it

To verify your identity and keep your account secure.
To set up the services you choose: tenancy registration, water and electricity, cooling, gas, internet, and the move-in permit where needed.
To book visits and tell you what is happening at each step.
To take payments and pass deposits to the right providers.
To meet our legal obligations and prevent fraud.
To improve Miftah, using combined information that does not identify you.
To send you offers from local businesses near your home, only if you agree, and only until you say stop.

There is no single “I agree” that covers everything. Each time we share your information, it is a separate consent for one purpose and one recipient. For example, sharing your Emirates ID with your landlord for approval is a different consent from sharing it with a utility to open your account.

For each consent we record what you agreed to, the wording you saw, when, and how. You can see every consent you have given in your account and withdraw any of them. If withdrawing stops a step that is under way, we tell you plainly what that means for your move-in.

We keep the record of a consent even after you withdraw it, so we can show that we had your permission at the time we acted.

Only with the parties your move-in needs, and only with your consent:

Your landlord and agency. By default they see a verification result (“identity verified”, “funds verified”), not your documents. If they need a document and you approve that request, it is shown with their name and the time on it, and the view is logged.
Government services and utilities. To register your tenancy and set up water and electricity.
Service providers you choose. Cooling, gas and internet providers, to set up your services and book visits.
Our own suppliers. Our identity verification provider, e-signature provider, payment partner, and the cloud and messaging services that run Miftah, including WhatsApp Business, text message and email providers for the move-in updates you choose to receive. We never send your documents over WhatsApp. They may use your data only to provide their service to us.
Local businesses. Only if you book or ask for an offer, and only what that booking needs. Partner listings are always marked.
Authorities. Where the law requires it.

Search inside Miftah is limited: a landlord or agency can only find tenants and units they already manage. Searching by Emirates ID number is limited to Miftah staff, needs a recorded reason, and is logged.

Where it is stored

Your data is hosted in a UAE cloud region and is not transferred outside the UAE [confirm with hosting provider and lawyer, including any supplier that processes data abroad].

How long we keep it

Raw documents (such as ID images, passport copies, proof of funds) are deleted once the step they were collected for is complete.
Your move-in record (what was done, when and by whom) is kept for [number] years after your move-in, to meet legal and accounting requirements.
Consent records are kept for as long as we might need to show that we had your permission.
Your account is kept while you use Miftah. You can ask us to close it at any time.

How we protect it

Identity information is kept in a separate, encrypted store under its own key.
Our staff can open a document only with a recorded reason, and every access is logged.
Identity numbers are removed from our monitoring and error tools.
Our test systems use made-up data, never yours.
Our systems are checked by independent security testers [at launch and every year].

No system is perfectly secure. If a breach affects your data, we will tell you and the authorities as the law requires.

Your rights

You can ask us to:

Show you the personal data we hold about you, and give you a copy.
Correct anything that is wrong.
Delete your data, where we are not required to keep it.
Stop or limit how we use it, or object to a particular use.
Withdraw any consent you have given.

You can do most of this in your account, or by writing to miftah.co/contact. We reply within [number] days. If you are not satisfied, you can complain to [the UAE Data Office / the ADGM Commissioner of Data Protection].

Miftah is for adults. We do not knowingly collect data from anyone under 18.

Cookies

We use cookies that Miftah needs to work, such as keeping you signed in. We use analytics cookies only if you agree [confirm before launch].

Changes and contact

If we make an important change to this policy, we will tell you in your account or by email before it takes effect.