App Privacy Policy

Version app-v1.1 · Effective 30 October 2026

1. Who we are

The AirLead mobile and web apps (the “app”) are operated by Patrimonnaie LLC, Shams Free Zone, Sharjah Media City, Sharjah, United Arab Emirates, licence No. 2112427.01 (“AirLead”, “we”, “us”). We are responsible for the personal data described here.

AirLead provides real-estate professionals (agencies, agents, developers) with verified and consented property-buyer leads, a CRM to work them, and AI-assisted tools. Contact for any privacy question: privacy@airlead.app. Our website has its own Privacy Notice.

2. Data we collect

• Account data: name, work email, phone number, password (stored only as a hash), agency and role — from you, or from your agency when it invites you.
• Professional documents: broker card, RERA certificate, signed contracts — from you or your agency.
• Lead data: name, phone, email, nationality, budget bracket, project of interest and consent record of the property buyer — from our lead campaigns and partners, where the buyer agreed to be contacted.
• Work data: CRM notes, statuses, appointments, deals, and voice notes you dictate (your own voice, never the prospect or a call) with their summaries — created while you use the app.
• Communications: messages you exchange with us by email or WhatsApp, support requests.
• Device and usage data: app version, device model, operating system, crash logs, push-notification token, features used.
• Billing data: invoicing details, payment status, transaction references. We never store full card numbers.

Face ID / biometrics: if you unlock the app with Face ID or Touch ID, the check runs on your device through Apple’s system. We never receive or store biometric data.

The app asks only for access to your photos (to choose a profile picture) and for permission to send notifications. We do not collect your location, your phone contacts or health data, and we do not track you across other companies’ apps or websites.

3. How we use it

• Create and secure your account, verify your professional status — performance of our contract with you or your agency.
• Deliver leads, run the CRM, appointments and reminders — performance of contract.
• AI features: voice-note summaries, lead profiling, message suggestions — performance of contract; our legitimate interest in improving your results.
• Service notifications (push, email, WhatsApp) — performance of contract.
• Invoicing, payments, accounting — legal obligation and performance of contract.
• Fraud prevention, security, debugging — legitimate interest.
• Product news and offers — your consent, which you can withdraw at any time.

Voice notes are transcribed by Mistral AI (France), which does not use them to train its models; the audio and raw transcript are deleted within 30 days.

AI providers. When you ask Milo something, the lead details needed for the answer (first name, project, budget range, objectives, your notes) are sent to Anthropic to produce the reply; Anthropic does not use them to train its models. Milo Meetings is used only when you add Milo to a meeting yourself: Recall.ai joins it as a visible participant and records and transcribes it; when you ask for a debrief, the transcript (with speaker names) is sent to Anthropic to prepare it. You choose to use these features each time; you can work in the app without them.

We do not sell the personal data of app users. Buyer lead data is passed only to the agency or agent who ordered it, within the scope of the buyer’s consent to be contacted. We do not make decisions about you based only on automated processing.

4. Who we share it with

Your agency: if you use AirLead through an agency, its managers can see your account, leads and CRM activity for their campaigns. Agents never see another agency’s data.

Service providers acting on our instructions, under contract: Supabase (database, sign-in, file storage), Vercel (web hosting), Cloudflare (media delivery, anti-robot checks), Apple and Expo (app distribution, push notifications), Meta — WhatsApp Business Platform — and Twilio (WhatsApp service and support messages), Brevo (service emails), Google Workspace (our email and video meetings), Mistral AI (voice-note transcription), Anthropic (Milo, the AI copilot: answers, summaries and message suggestions), Recall.ai (Milo Meetings: joins a video meeting you add, records and transcribes it, EU region), Stripe (card payments), Xero (invoicing and accounting), SignWell (electronic signature of contracts). We update this list when we add or change a provider.

Authorities, when the law requires it. A successor, if the AirLead business is reorganised, merged or sold; we will tell you before your data is transferred.

5. Transfers, retention and security

Some providers process data outside the UAE, including in the European Union and the United States. Where required, transfers rely on contractual safeguards such as standard contractual clauses.

• Account and profile: until you delete your account; deleted immediately on request, backup copies erased within 30 days.
• Voice-note audio and raw transcript: 30 days, then deleted (the summary you validated stays in the lead’s file).
• Leads, notes, appointments, deals: as long as your agency’s contract runs; anonymised when your account is deleted.
• Messages and support requests: 12 months after our last exchange.
• Security logs: 30 days.
• Invoices and accounting records: as long as UAE law requires.
• Lead consent records: as long as the lead is used, plus the time needed to prove consent.

When a period ends, we delete the data or anonymise it so it can no longer identify you. Data is encrypted in transit and at rest; access is limited by role and checked on our servers; each agency’s data is kept separate; administrator accounts use two-factor authentication. If a breach affects your data, we will inform you and the authorities as the law requires.

6. Your rights and deleting your account

You can ask to access, correct, delete or export your data, to restrict or object to its use, and withdraw any consent. Write to privacy@airlead.app; we reply within 30 days. You can also complain to the UAE Data Office or, in the EU or UK, to your data protection authority.

Deleting your account: in the app, open Profile → Delete my account, type DELETE and confirm, or email us. Deletion takes effect immediately: your login, profile, photo and notification settings are erased; leads, calls and deals you handled stay with your agency under “Deleted user”; invoices are kept as the law requires. Backup copies are erased within 30 days.

Property buyers whose details we hold as leads can ask us to stop contact and delete their data at the same address.

Notifications: turn push notifications off in your phone settings; unsubscribe from marketing emails with one click; reply STOP to stop WhatsApp messages.

7. Children

The app is for professionals and is not intended for anyone under 18. We do not knowingly collect their data.

8. Changes

We will post any change on this page with a new version and date, and tell you in the app about significant changes.