How Bricks handles personal data

A customer agency decides why and how tenant, landlord, vendor, property, lease and related data is entered into its workspace. For that Customer Data, the agency is the controller and Bricks acts as its processor under our Data Processing Terms. Tenants, landlords and vendors should normally direct workspace-data requests to their agency first.

Bricks is a controller for data we decide to process for our own purposes, including enquiries, account administration, authentication, service security, audit records, support, legal compliance and subscription administration.

• Account and business data: name, work contact details, organisation, role, workspace membership and account preferences.
• Property-management data: property, ownership, tenancy, maintenance, inspection, cheque, statement, vendor and communication records entered by an agency.
• Identity and document data: identifiers and uploaded documents such as Emirates ID, passport, title deed and tenancy records where the agency chooses to store them.
• Security and device data: sign-in events, role changes, audit history, IP address, browser or device information and security diagnostics.
• Enquiry, support and billing data: messages, demo requests, support correspondence, plan and invoice details and payment-provider references. Bricks does not store full payment-card details.

We receive data directly from users and prospective customers, from the agency that manages a workspace, from other authorised workspace users, from connected service providers and automatically from use of the service. An agency may enter personal data about people who do not have a Bricks account.

• provide, secure, troubleshoot and improve the service;
• authenticate users, apply workspace roles and keep audit evidence;
• perform the Customer’s lawful instructions and support its workflows;
• respond to enquiries, demos, support and privacy requests;
• administer subscriptions and prevent fraud or abuse; and
• comply with legal obligations and establish or defend legal claims.

We process personal data on customer instructions, to perform agreements, with consent where required, and under other grounds or exceptions allowed by applicable UAE law. We do not sell personal data and do not use Customer Data to train general-purpose AI models.

Access is limited to authorised users of the relevant workspace, Bricks personnel who need it for their role, and service providers needed to operate the product. Depending on enabled features, those providers include:

• Amazon Web Services — database, authentication, storage and infrastructure;
• Supabase — an encrypted disaster-recovery copy pending completion of its documented decommissioning;
• Vercel — application hosting and content delivery;
• Resend — transactional email delivery;
• Twilio — WhatsApp delivery when that channel is enabled;
• Google Maps — property-address autocomplete;
• Sentry — error and performance monitoring; page content and media are masked, but technical data such as a page address and device details can be received; and
• Stripe — subscription billing when paid billing is activated.

We may also disclose data where required by law, to protect rights or security, or as part of a genuine business transfer subject to appropriate protections. We do not give personal data to third parties for their unrelated advertising.

The primary application infrastructure is currently hosted in Frankfurt, Germany, and providers may process data in other countries where they operate. Personal data can therefore be transferred outside the UAE. We use contractual, organisational and technical safeguards appropriate to the provider and transfer and assess applicable UAE transfer requirements.

We keep Customer Data while the workspace is open and as needed to provide the service. A record deleted inside the product is generally soft-deleted: it is hidden but may be recoverable. The software does not currently perform an automatic 30-day permanent purge, and workspace closure does not itself prove that every copy has been erased.

Permanent erasure and workspace exports are handled on verified request. We remove or anonymise data when it is no longer needed, subject to backups, dispute preservation, security records and any legal retention duty. Backup copies are isolated from ordinary use and expire through the applicable backup lifecycle.

We use role-based workspace isolation, encryption in transit and at rest, additional protection for selected sensitive fields, access logging, security monitoring and backup controls. No service can guarantee absolute security. Customers must manage user access, use strong credentials and promptly report suspected compromise.

Bricks uses essential browser storage and cookies for sign-in, security and product operation. Error monitoring may record technical events and masked session information when a fault occurs. We do not currently use Customer Data for third-party behavioural advertising. If non-essential analytics or advertising technology is introduced, this notice and any required consent controls must be updated before activation.

Subject to applicable conditions and exceptions, you may request information about processing, access to personal data, correction, deletion, restriction or cessation of certain processing, transfer of data, withdrawal of consent and review of certain automated decisions. You may also object where the law permits and complain to the UAE Data Office.

If the request concerns an agency workspace, contact that agency first where practical. You can also contact Bricks through our public contact form or email privacy@brickspropertymanager.com. Label the message as a privacy request and do not attach identity documents at the first contact. We may need to verify identity and authority before acting.

Bricks is a business service and is not directed to children. Customers must not create user accounts for children. Where a property record lawfully concerns a minor, the Customer is responsible for the legal basis, necessary notices and appropriate adult authority.

Report suspected security incidents or privacy questions through the public contact form. Identify the message as a privacy or security request without including passwords, identity documents or unnecessary sensitive data. We investigate and notify affected customers or authorities where applicable law requires it.

We may update this notice as the service or law changes. We will update the version and effective date and request renewed acknowledgement where a material change requires it.