Privacy Policy

For the account, billing and usage data of Customers and their staff, Custrox is the data controller. For the leads, clients, property owners and listings a Customer uploads or generates through the Service, the Customer is the controller and Custrox is a data processor acting on the Customer’s documented instructions, as set out in the Terms. We process personal data under UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the “PDPL”).

Account & workspace data — name, work email, phone number, role, password (stored only as a salted hash), two-factor secrets and recovery codes (encrypted), agency name, workspace ID, timezone, the products you signed up for, and your acceptance of the Terms.

Lead & client data (entered by the Customer) — names, phone numbers, email addresses, nationality, language, budget and property preferences, notes, stage in the pipeline, meetings and viewings, documents, and the full history of calls, WhatsApp/SMS messages and emails exchanged through the Service, including AI-generated messages and call recordings and transcripts.

Listing & property data — property details, photos, videos, 3D tours, owner contact details and permit numbers for secondary-market listings.

Usage & device data — IP address, browser and device type, sign-in times and outcomes, pages used, feature usage counters (AI minutes, messages, seats, storage), audit-log entries of who changed what, and error logs.

Billing data — plan, invoices, receipts and the last four digits of a payment method. Full card details are held by our payment provider and never touch Custrox servers.

Connected accounts — when you connect WhatsApp, Google Calendar, Zoom or a listing portal we store the access tokens (encrypted) needed to act on your behalf, and only the data those integrations return.

• To provide the Service — running your CRM, sending and receiving messages and calls, scheduling, publishing listings and generating AI replies, scripts and summaries.
• To keep accounts secure — authentication, two-factor verification, rate limiting, bot protection, fraud and abuse detection, and the audit trail your administrators can review.
• To operate and improve the product — diagnosing errors, measuring which features are used, and supporting you when you contact us.
• To bill you — metering usage against your package, issuing invoices and receipts, and collecting payment.
• To comply with law — responding to lawful requests from UAE authorities and meeting record-keeping obligations.

AI features send the text or audio needed for a given task to the AI provider listed in section 6. We do not use Customer data to train models of our own, and our AI providers are contractually bound not to train on it either. We never sell personal data.

The Customer is responsible for having a lawful basis — normally documented, prior consent — before contacting any person through the Service, including by AI voice call, WhatsApp or SMS, and for honouring opt-outs. Custrox records the source of every lead and every message and call so that consent and opt-out requests can be evidenced. See section 4 of the Terms for the rules on outbound calling.

• Workspace data (leads, listings, conversations, recordings, documents) — for as long as the Customer’s subscription is active. When a workspace is cancelled or deleted it is retained for 30 days so it can be restored, then permanently erased.
• Account data — for the life of the account and up to 30 days after deletion.
• Call recordings and transcripts — as workspace data, unless the Customer deletes them earlier from the lead’s record.
• Security and audit logs — 12 months.
• Billing records — 5 years, as required by UAE tax and commercial law.
• Backups — encrypted backups roll over within 35 days.

We use the following providers to run the Service. Each receives only the data needed for its purpose, under a written agreement that requires PDPL-equivalent safeguards. We will give Customers at least 14 days’ notice before adding a sub-processor that handles Customer data.

We also disclose data where the law requires it, to professional advisers under confidentiality, and — with notice — to a successor if Custrox is acquired. Within a workspace, data is visible to the Customer’s own staff according to the roles its administrators assign.

Our servers are located in the UAE and the European Union. Some sub-processors (notably AI and telephony providers) process data in the United States or the EU. Transfers outside the UAE are made only to countries with adequate protection or under contractual safeguards recognised by the PDPL and the UAE Data Office.

Data is encrypted in transit (TLS) and at rest. Passwords are hashed with bcrypt; API keys, tokens and 2FA secrets are encrypted with keys held separately from the database. Access to production is restricted to named staff with two-factor authentication, and every administrative action inside a workspace is written to an audit log. We will notify affected Customers and, where required, the UAE Data Office without undue delay after becoming aware of a personal-data breach.

Under the PDPL you may ask for access to, correction or erasure of your personal data, object to or restrict its processing, and receive a copy in a portable format. Agents and staff can update most of their own details under Account; Customers can export or delete leads and workspaces from inside the Service. If your data was entered by a real-estate agency using Custrox, that agency is the controller and we will pass your request to it, or you can contact it directly. Requests we handle ourselves are answered within 30 days.

Custrox uses only strictly-necessary storage: a session token so you stay signed in, your interface preferences (collapsed menus, chosen filters) and the bot-protection token. We do not use advertising or cross-site tracking cookies.

The Service is for businesses and is not directed at anyone under 18. We do not knowingly collect data from children.

We may update this policy from time to time. Material changes are announced inside the Service or by email at least 14 days before they take effect; the effective date at the top is always the current version.

Questions, requests or complaints about personal data: email our data-protection contact at privacy@custrox.com or write to Custrox, Dubai, United Arab Emirates. You also have the right to lodge a complaint with the UAE Data Office.