Privacy Policy

What you give us • Your name, phone number, email address, country of residence and title when you create an account or send us a request. • Your answers in our tools. BuyAbility, the ROI calculator and the mortgage calculator receive the figures you enter, such as income, savings, down payment, monthly debts, budget, employment status, nationality, age and residency status. • What you write to our AI assistant, including any name, email or phone number you give it. • What you tell us when you book a call: the time, your budget and what interests you. What we collect automatically • Your IP address and the country it points to, browser and device type, operating system, language, the pages you view and when. • On the iPhone and Android apps: your device's advertising identifier when advertising tracking is allowed (see section 8), and a push notification address for your device if you allow notifications. What we receive from others • When you sign in with Google or Apple: your name, email address and, for Google, your profile picture. • When you reach us from a Meta advertisement form, the details you entered in that form. • Property information (listings, prices, layouts, developers) comes from our data providers Behomes and Reelly. It is not personal data. We do not ask for passport copies, ID documents, bank details or your contacts through the app.

• To create and secure your account and keep you signed in. • To answer your requests and connect you with a VILA advisor. • To remember your saved properties, comparisons, filters and language. • To give you calculator results, AI assistant answers and property suggestions. • To send you sign-in codes and confirmations. • To send you marketing about new launches and market updates, only if you opt in, and only on the channel you chose. • To understand how the app is used, fix problems and prevent abuse. • To measure whether our advertising works (see section 8). • To meet our legal duties as a licensed broker, including RERA rules and anti money laundering checks.

We process personal data under the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) and, for people in the European Union, the UK, the wider European Economic Area and Switzerland, the GDPR and the equivalent local laws. Our grounds are: • Contract and steps you ask for: running your account and answering your requests. • Consent: marketing messages, and advertising and analytics tracking for people in Europe. You can withdraw consent at any time. • Legitimate interest: keeping the app secure, preventing fraud, improving our service, and advertising measurement for people outside Europe. You can object at any time in Settings, Privacy. • Legal obligation: RERA, anti money laundering, tax and court requirements.

We do not sell your personal data. We share it only with the companies below, and only as far as needed. Service providers working on our instructions • Amazon Web Services (servers in Mumbai, India): hosts the app and its database. • Anthropic (USA): runs our AI assistant, and writes short summaries of new requests for our advisors. It receives what you write to the assistant, and the details of your request. • Meta (WhatsApp) and Twilio (USA): deliver your sign-in codes by WhatsApp, or by text message if WhatsApp fails. They receive your phone number and the code. • Google (USA) and Apple (USA): handle sign-in when you choose Google or Apple. In the iPhone and Android apps, Google Firebase Authentication also handles that sign-in. • Microsoft (USA and EU): sends our emails, and holds the calendar entries and Teams meetings for calls you book, with your name, email, time and booking details. • PostHog (European Union, Frankfurt): our product analytics. It records how the app is used. Once you sign in, it receives your VILA account number, so we can link your visits to your requests. It does not receive your name, email address or phone number. • OneSignal (USA): delivers push notifications. Your device's push address passes through our server to OneSignal; we do not store it. • Telegram (international): our team receives new requests as Telegram messages, including your name, contact details and your answers. • Zoho (USA): our customer records system. It holds leads that arrive from our advertisements and website. • Google Maps (USA): shows maps when you open a map view. Google then receives your IP address. • Behomes and Reelly (UAE): property pictures load directly from their servers, so they receive your IP address. We use a country database by DB-IP (db-ip.com) on our own server to tell which country your IP address is in. Your IP address is not sent to DB-IP. Advertising and measurement partners (see section 8 for when these run) • Meta Platforms Ireland Limited and Meta Platforms Inc.: the Meta Pixel on the web, the Meta software in our apps, and messages from our server about actions such as a request, a saved property, a sign-up or a booked call. These carry your email and phone number in scrambled (hashed) form, your VILA account number, your IP address and browser, Meta's own cookie or click identifier, and on the apps your advertising identifier. Meta uses them to measure our advertising and to show our ads to people likely to be interested. • TikTok Pte. Ltd. and TikTok Inc.: the TikTok software in our apps. It receives your advertising identifier and events such as installs, sign-ups and requests, to measure our TikTok advertising. • Google LLC and Google Ireland Limited: Firebase Analytics in our apps, and app install measurement for Google advertising. It receives your advertising identifier, your VILA account number and app events. • Apple: on iPhone, Apple reports app installs to advertising networks in an anonymous, combined form. • On invest.vila.ae only, after you tap Accept: Google Analytics (Google LLC) and Microsoft Clarity (Microsoft Corporation) record the pages you view, your device, your approximate location, and your clicks and scrolling. Developers. When you ask about a specific project or ask us to reserve a unit or arrange a viewing, we share your contact details and what you are looking for with that developer. We do not share your account history or calculator answers. Authorities. We share information when the law requires it, for example with the Dubai Land Department, RERA or a court. Business transfer. If VILA is sold or merged, your data may pass to the new owner, who must keep to this policy or tell you first.

Our servers are in Mumbai, India. Some of our providers are in the USA and the European Union. When data leaves the UAE, we rely on the safeguards UAE law allows, such as the provider's contract terms. For people in Europe, we rely on the European Commission's standard contractual clauses or an adequacy decision.

• Your account: until you delete it. Deletion removes it from our database at once. Copies in our backups are overwritten within 35 days. • Your requests and enquiries, including calculator answers sent with them, and their copies in our email and Telegram: up to 5 years after our last contact with you, because brokers must keep records. Deleting your account removes them from our database, unless a purchase means the law requires us to keep them. • AI assistant conversations: up to 12 months. • Records of pages viewed, kept on our server: up to 12 months. PostHog keeps its analytics for the period set in our PostHog account. • Sign-in codes: each code expires within minutes. The record that a code was sent is kept up to 12 months for security. • Server logs with IP addresses: about 35 days. • Push notification addresses: until you delete your account, or up to 12 months after the app was last used. • Your privacy and marketing choices: stored on your device until you change them or clear the app's data. • A record of each marketing choice you make (the date, your answer and the wording shown), kept on our server: while your account exists, otherwise up to 3 years. After these periods, data is deleted or made anonymous.

Under UAE law and, for people in Europe, the GDPR, you can: • Get a copy of the personal data we hold about you. • Have it corrected. • Have it deleted. You can delete your account yourself in the app under Account, Delete Account. • Ask us to limit how we use it. • Receive your data in a machine-readable file. • Withdraw consent and turn tracking off in Settings, Privacy. • Object to our use of your data, including for advertising. Deleting your account in the app does not remove data already passed to Meta, TikTok, Google, PostHog or OneSignal. Email us and we will ask them to delete it. To use any of these rights, email info@vila.ae. We reply within 30 days. You can also complain to the UAE Data Office or, in Europe, to your local data protection authority.

Who is asked. If you are in the European Union, the UK, the wider European Economic Area or Switzerland, we ask you first. No advertising or analytics tracking starts until you tap Accept. Everywhere else, tracking is on and you can turn it off at any time in Settings, Privacy. We decide where you are from your IP address. If we cannot tell, we treat you as outside Europe. Reject or turn off. If you tap Reject or turn tracking off, our server sends nothing more to Meta about you, PostHog stops, and the Meta, TikTok and Firebase software in the app is switched off. On Android, TikTok stops the next time you open the app. What we store on your device • Sign-in cookies: keep you signed in. Needed for the app to work. • Choice cookies (vila_consent and vila_gdpr): remember your choice and whether you are in Europe. • App storage: your saved properties, comparisons, language, progress, a visitor number, the name and contact details you give the AI assistant, and your marketing choice. • Analytics and advertising cookies, when tracking is allowed: PostHog (ph_ cookies), Meta (_fbp and _fbc, up to 12 months) and, on invest.vila.ae, Google Analytics (_ga) and Microsoft Clarity (_clck and _clsk). • Advertising identifier: on iPhone, only if you also allow tracking when Apple asks. Push notifications are sent only if you allow them, and you can turn them off in your phone's settings.

The match quiz ranks properties by your stated preferences. The calculators use fixed formulas. The AI assistant writes answers using Anthropic's Claude. None of these make decisions with legal or similar effect on you; they are for information. You can always speak to a person.

We use encrypted connections (HTTPS), limit access to the VILA staff who need it, protect our admin pages with passwords, and alert our team to failed admin sign-ins. No system is completely secure. If a breach puts your data at risk, we will tell you and the authorities without undue delay, and within any deadline the law sets, such as 72 hours under the GDPR.

The app is for adults aged 18 and over. We do not knowingly collect data from anyone younger. If you believe a child has given us data, email info@vila.ae and we will delete it.

We may update this policy. The date at the top shows the latest version.

Aram Vila Properties L.L.C Business Bay, Dubai, United Arab Emirates Email: info@vila.ae Phone and WhatsApp: +971 50 570 6356