PropVault and the nibalkhattar.com client portal (together, the "Services") are operated by Nibal Khattar, a licensed property consultant at Property Shop Investment, Dubai, United Arab Emirates (RERA BRN 45374) (the "Consultant", "we", "us"). For anything in this policy, contact n.khattar@psidubai.com.
PropVault is invite only. Accounts are created by the Consultant for existing clients. There is no public sign-up, and the app does not collect personal data from people who do not already have a client relationship, other than the enquiry details described below.
We process personal data in accordance with UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL) and, where applicable to users abroad, other applicable data-protection laws.
Account data. Your name, email address and, optionally, a mobile number. Used to create and secure your account and to sign you in. Sign-in is by email and password; if phone sign-in is enabled on your account, a one-time code is sent by SMS. Legal basis: performance of our client relationship and your consent.
Portfolio and financial data. Details of properties you own or are purchasing: values, equity, mortgage figures, rental income, payment plans and document status. This data is entered and maintained by the Consultant with your knowledge, at your request, as part of the advisory relationship. It is not scraped, bought or gathered from third-party sources. Legal basis: performance of the client relationship.
Documents. Files the Consultant uploads to your client record, such as title deeds and contracts. Documents you save in the app's own vault are held on your own phone and are never sent to us. See section 3 for how each is handled. Legal basis: performance of the client relationship.
Enquiries ("Register interest"). If someone who is not yet a client enquires about a project, we collect the name, contact number and message they choose to send, so the Consultant can respond. Legal basis: consent and pre-contractual steps.
Push notification token. If you opt in to notifications, your device's push token is stored so we can send you launch alerts and portfolio reminders. Optional, and revocable at any time in your device's system settings. Push notifications are currently available on iOS only. Legal basis: consent.
Documents you save in the app stay on your phone. Files you add to the in-app vault, such as title deeds and contracts, are written to the app's protected storage on your device. They are not uploaded to us, to Supabase, or to any other server. On iOS this is protected by iOS file-level encryption; on Android it is app-private storage encrypted by the operating system, which no other app can read. On both you can put the vault behind your device's biometric lock. Because they never leave your phone, removing the app removes them.
Scanning happens on your device. On iOS, when you use the in-app scanner to capture a document, the scan and any text recognition run entirely on your iPhone using Apple's on-device frameworks. Camera frames are not sent to us or to any third party, and the finished file is saved locally. The Android app does not currently include a document scanner.
Documents the Consultant shares with you. Separately from the in-app vault, the Consultant may upload documents to your client record so they are available to you through the web dashboard. Those files are held in private storage in our Supabase project. They are not public, not indexed by search engines, and access is restricted so that only you and the Consultant can retrieve them. They are encrypted in transit and at rest.
Removing documents. You can delete a document from the in-app vault at any time. Deleting your account removes the documents held in your client record.
Biometric unlock. Face ID and Touch ID on iOS, and fingerprint or face unlock on Android, are performed entirely by the operating system. The app never sees, stores or transmits your biometric data. It only receives a yes or no answer from the system, which it uses to unlock the app locally.
Sign-in tokens. Your session tokens are held in the iOS Keychain on iPhone, and in hardware-backed encrypted storage on Android. They are never written in plain text.
Vault documents and scans. Anything you save to the in-app vault stays in the app's protected storage on your own phone. See section 3.
Location. The app does not request or collect your device location. The map shows property locations, not yours.
Account, portfolio, document, enquiry and notification data are hosted on Supabase (managed Postgres database, file storage and authentication). Our Supabase project is hosted in the European Union. Data is encrypted in transit (TLS) and at rest, and row-level security is applied so that each client can only ever read their own records.
Limited data is shared with service providers strictly to operate the Services:
These providers act as processors under our instructions and do not use your data for their own purposes. Because hosting is in the European Union, data is transferred outside the UAE. Where data is transferred internationally, we rely on providers offering appropriate technical and contractual safeguards.
Subject to the PDPL and applicable law, you may request access to, correction of, or deletion of your personal data; object to or restrict processing; and withdraw consent at any time. Two of these are built into the app:
You can also request deletion by email, whether or not you still have the app installed. For this and anything else, email n.khattar@psidubai.com. We respond within 30 days. You may also lodge a complaint with the UAE Data Office if you believe your rights have been infringed.
We use industry-standard measures: TLS for all network traffic, encryption at rest, private storage buckets for documents, row-level security so each client can only ever read their own records, and sign-in tokens held in the iOS Keychain on iPhone or in hardware-backed encrypted storage on Android. The app adds two further protections you control: an optional biometric lock, and a privacy veil that hides monetary figures on screen until you choose to reveal them. On iOS, the home-screen widget redacts values so that figures are not readable from the Lock Screen. No system is perfectly secure; if we become aware of a breach affecting your data we will notify you and the relevant authorities as required by law.
If this policy changes materially, the effective date above will be updated and the app will link to the current version. Continued use of the Services after changes means acceptance of the updated policy.