Privacy policy

Account and profile. When you create an account we collect your email address and a password (stored only as a cryptographic hash — we cannot read it). You can optionally add your phone number, title and name, preferred language (English or Arabic), preferred contact method, and property preferences such as purpose, property type, budget, locations, bedrooms, move timeline and financing status. You control your saved-search alert and newsletter opt-ins.

Sign in with Google or Apple. If you sign in with Google or Apple, we receive your account identifier, email address and name from that provider. We use this only to verify your email and create or link your account — nothing more.

Enquiries. When you contact an agency about a listing we collect the name, email address, phone number and message you provide, your preferred contact method, and the listing and page you enquired from. To prevent abuse we also store one-way hashes (irreversible fingerprints, not the raw values) of your IP address, browser and device signature with the enquiry.

Saved listings and saved searches. We store the listings you save, the searches you save (including their filters), and — if you switch alerts on — the email address alerts are sent to and a log of what was sent.

Technical and security data. Sign-in sessions are recorded with one-way hashes of your IP address and browser information (we do not store them raw), and we keep rate-limiting counters to protect against abuse.

Cookies. We use a small set of first-party cookies and no advertising or analytics cookies:

Your language choice is part of the web address (for example /ar), not a cookie.

We use your information to operate and secure the platform; to create and manage your account; to deliver your enquiries to the right agency and broker; to send the saved-search alerts and emails you switch on; to send necessary service emails such as verification codes and security notices; to prevent fraud and abuse; and to meet our legal obligations.

When you submit an enquiry on a listing, the licensed agency and the responsible broker for that listing receive your enquiry and the contact details you provided so they can respond to you. Once delivered, that copy is held by the agency as its own business record. We do not sell your personal data, and we do not share it with anyone except as described in this policy.

We use a small number of specialist providers to run the platform. They process data only to provide their service to us:

• Postmark — delivers our transactional email (verification codes, alerts, service notices). Our emails come from help@3nwan.ae (emails to buyers), support@3nwan.ae (emails to agencies and brokers), verification@3nwan.ae (professional verification) and billing@3nwan.ae (invoices). When you send us a message with one of our contact forms, what you write, the details needed to reply and, for signed-in agencies and brokers, your account and licence identifiers (such as agency, ORN or BRN) are emailed to help@3nwan.ae (buyers), or to support@3nwan.ae or billing@3nwan.ae (agencies and brokers); the platform itself does not keep a copy.
• Cloudflare Turnstile — checks that registrations, enquiry submissions and public contact-form messages come from a human, not a bot. Your browser exchanges a challenge token with Cloudflare, which sees your IP address as part of that check.
• MapTiler (with OpenStreetMap-based fallbacks) — serves the map tiles on listing pages. Loading a map sends your IP address and browser details to the map provider, as with any image loaded from the web.
• Google and Apple — only if you choose to sign in with them (section 1).
• Stripe — processes subscription and top-up payments for professional accounts (agencies) only. Buyers are never asked to pay and no buyer data goes to Stripe. Card details are handled by Stripe and never stored on our servers.
• Sentry — error monitoring (section 5).
• Dubai Land Department open data — we verify agency trade licences and broker registration numbers against official Dubai Land Department records. This involves professional licensing data only, never buyer data.
• Hosting — the platform and its data are hosted on our own servers in the United Arab Emirates.

Some of these providers process data outside the UAE. Where they do, we rely on safeguards appropriate under the PDPL.

When something breaks, our website, apps and servers send an automatic error report to Sentry, an error-monitoring service, so we can find and fix the problem. These reports are hosted in the European Union (Frankfurt). We have set this up to protect your privacy:

• Reports describe the technical error only. We do not use session replay or screen recording, and we do not send performance-tracking data.
• Before a report leaves our systems it is automatically scrubbed: names, email addresses, phone numbers, identity documents, property-ownership details, passwords and security tokens are all removed. If a report cannot be fully scrubbed, it is discarded rather than sent.
• A signed-in user appears in a report only as an internal account number, never by name or email.
• We have configured Sentry not to store IP addresses, and location data derived from IP addresses is removed.

• Your account — until you delete it. You can delete your account yourself at any time (section 7).
• Enquiries— kept for up to 24 months from when they were sent, then deleted. Enquiries whose identifying details have been removed (for example after an account deletion) are kept as the receiving agency’s business record.
• Sign-in sessions — a session lasts up to 60 days without use and never more than 12 months in total; expired sessions cannot be used.
• Professional applications — agency and broker applications that are never email-confirmed are deleted after 30 days, including any uploaded documents.
• Security audit logs — we keep records of security-relevant events (such as an account deletion). These contain counts and one-way hashes, not your readable personal details.

Where a different legal, accounting or reporting requirement applies, we keep data for that period and then delete or anonymise it.

Under the PDPL you have rights over your personal data, including access, correction and deletion.

• Update your detailsany time in Profile & settings.
• Turn alerts on or off per saved search, and manage your newsletter opt-in, in your account.
• Delete your account yourself — see How account deletion works, which explains exactly what is removed and what is retained. Deletion is immediate and cannot be undone.
• Ask us anything else — to exercise any other right, or to ask a privacy question or raise a complaint, contact us (section 9). We respond in line with applicable law.

We protect your data with encrypted connections, hashed credentials, access controls and abuse-prevention measures. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

Privacy questions and requests: help@3nwan.ae
ENWAN FOR ADVERTISING SERVICES VIA WEBSITES L.L.C, Dubai, trade licence no. 1657554

We may update this policy from time to time. Material changes will be reflected here with a new “last updated” date.