Privacy Policy
This policy explains what personal data Eqarak collects, why we collect it, who we share it with, and the choices you have. It covers the Eqarak web application (app.eqarak.com), the Eqarak mobile app, the WhatsApp assistant, agency websites we host on *.eqarak.com, and this marketing website.
1. Who is responsible for your data
Eqarak (“Eqarak”, “we”, “us”) provides software to real-estate agencies. Our relationship to personal data depends on whose data it is:
- We are the controller of the data of the agencies who subscribe to Eqarak and their staff — account details, billing records, support correspondence — and of visitors to this marketing website.
- We are a processor for everything an agency records inside its own workspace — its clients, contacts, listings, viewings, documents and messages. The agency decides what to collect and why; we only process it to provide the service and on the agency’s instructions.
If you are a buyer, seller, tenant or landlord whose details were entered into Eqarak by an agency, that agency is the controller of your data. Please direct requests to access, correct or delete your information to the agency you dealt with. If you cannot reach them, contact us and we will help route your request.
2. What we collect
Account and workspace data
When an agency signs up and creates user accounts, we store the account holder’s name, email address, phone number, profile picture, role and permissions, organisation membership, the time of the last sign-in, and — if two-factor authentication is enabled — the 2FA secret and backup codes. Passwords are stored only as salted hashes; we never see or store them in readable form. We sign in users with an email and password only; we do not use social logins.
Content the agency enters
Eqarak stores whatever the agency records in the course of its business: client and lead records (names, phone numbers, email addresses, requirements, notes), property listings and their photos and documents, viewings and calendar events, contracts and deals, marketing content, and the activity history of who changed what and when.
Billing data
Subscriptions are settled manually. We record the plan, amount, billing period, payment method, a payment reference, and any receipt or transfer confirmation uploaded as proof. We do not process card payments and never receive or store card numbers.
Messages handled by the WhatsApp assistant
Where an agency enables the WhatsApp assistant, we receive and store the messages sent to it — text, voice notes and images — together with the sender’s WhatsApp phone number and the conversation state needed to answer follow-up questions. See section 5.
Website and technical data
When you visit this marketing website or use the app, we and our infrastructure providers collect standard technical data: IP address, browser and device type, pages viewed, and timestamps. This is used for security, abuse prevention, troubleshooting and aggregate traffic statistics. If you submit the “Book a demo” form, we collect the name, agency, work email, phone number, agency size and message you provide, and use them to contact you about Eqarak.
3. Why we use it
| Purpose | Legal basis |
|---|---|
| Providing the platform and its features to the agency | Performance of a contract |
| Authentication, session management and account security | Performance of a contract; legitimate interests |
| Sending transactional email (invitations, password resets, alerts) | Performance of a contract |
| Billing, subscription management and fraud prevention | Performance of a contract; legal obligation |
| Preventing abuse, rate-limiting and protecting the service | Legitimate interests |
| Product analytics and improving the service | Legitimate interests; consent where required |
| Responding to demo requests and support enquiries | Consent; legitimate interests |
We do not sell personal data. We do not share it with advertising networks, and we do not use the content of an agency’s workspace for our own marketing.
4. Artificial intelligence
Several Eqarak features use large language models provided by a specialist third-party AI provider — for example extracting structured listing details from a photo or a pasted description, drafting listing and marketing copy, and running the WhatsApp assistant. When you use one of these features, the relevant content (the text, image or voice note you supplied, plus the workspace context needed to answer) is transmitted to that provider for processing and the result is returned to Eqarak.
- AI processing happens only when a feature that needs it is used.
- We use business API tiers under which submitted content is not used to train the provider’s models.
- The provider acts as our processor: it is contractually bound to use the content solely to return the result to us.
- AI output can be wrong. It is a drafting aid, and the agency remains responsible for reviewing what it publishes or sends.
5. The WhatsApp assistant
The assistant runs on the WhatsApp Business platform operated by Meta. It is available only to phone numbers an agency has explicitly allow-listed — typically its own agents. Messages to and from the assistant pass through Meta’s systems and are subject to Meta’s own privacy terms in addition to this policy.
We store inbound and outbound messages so the assistant can hold a coherent conversation and so an agency can audit what was done on its behalf. Voice notes are transcribed and images are analysed in order to act on them. Message records are deleted automatically 90 days after they are received by a scheduled clean-up job; records the assistant wrote into the workspace (a new listing, a new client) persist as normal workspace data.
7. Where your data is stored
Eqarak’s application servers and file storage are located in the European Union. Some of the providers described above operate in the European Union or the United States. This means personal data collected in Lebanon and the GCC is processed outside your country. Where required, we rely on standard contractual clauses or equivalent safeguards offered by these providers.
8. How long we keep it
- Workspace content — for as long as the agency’s account is active. The agency can delete individual records at any time.
- WhatsApp messages — 90 days, then deleted automatically.
- Account and billing records — for the life of the account and afterwards where needed for tax, accounting or legal purposes.
- Marketing website analytics — as configured in Google Analytics, in aggregate form.
- Demo requests — until we have dealt with the enquiry and for a reasonable follow-up period afterwards.
When an agency closes its account, we delete or irreversibly anonymise its workspace data within 90 days, except where we are required to retain records by law.
9. How we protect it
- All traffic is encrypted in transit with TLS; data is encrypted at rest by our infrastructure providers.
- Passwords are stored as salted hashes. Two-factor authentication is available, and required for administrative accounts.
- Every workspace is isolated: each request is scoped to the signed-in user’s organisation, and access within an agency is limited by role-based permissions.
- Credentials for connected social accounts are encrypted before storage.
- Access to production systems is limited to the people who need it, and administrative actions are logged.
No system is perfectly secure. If a breach affects your personal data, we will notify affected agencies and, where required, the relevant authority without undue delay.
10. Your rights and choices
Depending on where you live, you may have the right to:
- access the personal data we hold about you and receive a copy of it;
- have inaccurate data corrected;
- have your data deleted;
- object to or restrict certain processing;
- receive your data in a portable format;
- withdraw consent at any time, where processing is based on consent.
Agency users can exercise most of these directly in the app, or by writing to us at the address in section 14. If your details were entered by an agency using Eqarak, please contact that agency first — they control the record, and we will act on their instructions.
12. Children
Eqarak is a business tool and is not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a child’s data has been provided to us, contact us and we will delete it.
13. Changes to this policy
We may update this policy as the product changes. The “last updated” date at the top always reflects the current version. If a change materially affects how we handle your data, we will notify account holders by email or through the app before it takes effect.
14. Contact us
For any question about this policy, or to exercise the rights described above, write to privacy@eqarak.com. We aim to respond within 30 days.