Privacy Policy

1. Introduction

Mehlia ("we," "our," or "us") operates a suite of digital products designed to simplify property and tenancy management. This Privacy Policy applies across all three of our platforms:

• Mehlia – The landlord and property manager mobile application, enabling users to manage rental income, expenses, tenant information, documents, and maintenance records.
• Mehlia Resident – The tenant-facing mobile application, enabling residents to view tenancy details, submit maintenance requests, communicate with their landlord, and manage their tenancy information.
• Mehlia Website – Our public-facing landing page and website, used for product information, marketing, and general enquiries.

This Privacy Policy explains how we collect, use, process, store, and protect personal data across all three platforms. Where provisions apply specifically to one platform, this is clearly indicated. Please read this policy carefully before using any of our platforms.

By creating an account or using any of our platforms, you acknowledge that you have read and agree to this Privacy Policy. If you do not agree, please discontinue use immediately.

2. Who We Are and Our Role

Depending on the context in which we process personal data, Mehlia acts in one of the following capacities:

• Data Controller – Mehlia App: For personal data relating to landlord and property manager account holders, Mehlia determines the purposes and means of processing.
• Data Controller – Mehlia Resident App: For personal data relating to tenant users who actively register and use the Mehlia Resident app, Mehlia is the Data Controller for that data.
• Data Controller – Website: For personal data collected through the Mehlia website (e.g. enquiry forms, cookies, analytics), Mehlia is the Data Controller.
• Data Processor: For personal data relating to tenants and third parties that is uploaded into the platform by landlord account holders (e.g. lease documents, payment records), Mehlia processes that data on behalf of, and under the instructions of, the account holder, who acts as the Data Controller for that data.

Landlord account holders are solely responsible for ensuring they have a valid and lawful basis to upload, store, and process personal data relating to their tenants or other third parties. Mehlia does not independently verify the accuracy, legality, or appropriateness of data uploaded by account holders.

3. Scope of This Policy

This Privacy Policy applies to:

• Landlords and property managers who register and use the Mehlia app
• Tenants and residents who register and use the Mehlia Resident app
• Tenants and third parties whose data is uploaded into the platform by landlord account holders
• Visitors to the Mehlia website, including individuals who submit enquiries or sign up for communications

4. Information We Collect

4.1 Mehlia App – Landlord and Property Manager Data Collection

Profile & Account

When you register and use the Mehlia app, we collect the following profile and account data:

• Full name, email address, and phone number
• Profile image
• Device ID (Android ID or iOS identifierForVendor) for push notification delivery
• Apple or Google OAuth authentication data (where sign-in via these providers is used)
• Platform identifier (iOS or Android)
• Subscription status and in-app purchase records

Property & Tenancy Data

To enable property management functionality, we collect:

• Property addresses and associated images
• Lease details and lease documents
• Tenant details uploaded by landlords: name, phone number, email address, taxpayer ID, and identity proof documents

Financial Records

To support payment and expense tracking, we collect:

• Payment and expense records including amounts, dates, unit and tenant references, and categories

Maintenance

To manage maintenance requests, we collect:

• Maintenance ticket data: associated unit, property, priority level, notes, and photos

Communications & Notifications

• In-app messages transmitted via real-time socket connections
• Push notification tokens and delivery data via Firebase Cloud Messaging

Files & Documents

• Uploaded files (images and documents) and associated metadata; all uploads are transmitted to our backend and stored securely on AWS S3

Device Permissions

The Mehlia app requests the following device permissions to enable core features:

• Camera and photo library access (for uploading property images and documents)
• Network access
• Remote notifications

Local Storage

• Basic logged-in user information is stored locally on-device to support session management and app functionality

4.2 Tenant and Third Party Data Uploaded by Landlord Users

Landlord account holders may upload personal data relating to their tenants and third parties as part of managing their properties. This includes but is not limited to: full names and contact details; lease and tenancy agreements; identification and taxpayer documents; payment and financial records; maintenance history and correspondence; uploaded documents and attachments.

Mehlia processes this data solely on the instructions of the landlord account holder. As the Data Controller for tenant data they upload, the landlord is responsible for compliance with applicable data protection laws, including obtaining any required consents from their tenants.

4.3 Mehlia Resident App – Tenant User Data Collection

Profile & Account

When tenants register and use the Mehlia Resident app, we collect:

• Full name, email address, and phone number
• Profile image
• Device ID (Android ID or iOS identifierForVendor) for push notification delivery
• Apple or Google OAuth authentication data (where sign-in via these providers is used)
• Platform identifier (iOS or Android)

Maintenance

• Maintenance ticket data: associated unit, property, priority level, notes, and photos

Communications & Notifications

• In-app messages transmitted via real-time socket connections
• Push notification tokens and delivery data via Firebase Cloud Messaging

Files & Documents

• Uploaded files (images and documents) and associated metadata; all uploads are transmitted to our backend and stored securely on AWS S3

Device Permissions

The Mehlia Resident app requests: Camera and photo library access; Network access; Remote notifications.

Local Storage

Basic logged-in user information is stored locally on-device to support session management and app functionality.

Mehlia acts as Data Controller for all data that tenant users actively submit through the Mehlia Resident app. Tenants have full rights over this data as described in Section 13.

4.4 Mehlia Website – Visitors and Enquiries

When you visit the Mehlia website, we may collect:

• Contact and enquiry form submissions (name, email address, message content)
• Newsletter or waitlist sign-up information (name, email address)
• Technical data collected automatically via cookies and analytics tools (see Section 4.6)

Website visitors who do not submit any form or sign up to any communication will only have automatically collected technical data processed, as described in Section 4.5 and 4.6.

4.5 Automatically Collected Data (All Platforms)

Across all platforms, we automatically collect certain technical and usage data, including:

• Device information (model, operating system, app version)
• IP address and approximate location
• Usage analytics and in-app or on-page behavior data
• Crash logs and diagnostic information

This data is used to maintain security, improve performance, diagnose technical issues, and enhance user experience across all platforms.

4.6 Cookies and Tracking Technologies

The Mehlia apps and website use cookies and similar tracking technologies (such as SDKs on mobile and cookies on web) for: session management and authentication; understanding how users interact with our platforms; performance monitoring and error tracking; analytics and usage reporting.

Website visitors can manage cookie preferences through our cookie consent banner or their browser settings. Disabling certain cookies may affect functionality. We do not use cookies for targeted advertising or sell data to advertising networks.

5. Legal Basis for Processing

Where applicable under data protection laws such as the UAE Federal PDPL, UK GDPR, EU GDPR, or equivalent legislation, we rely on the following lawful bases:

• Performance of a contract: To provide the services you have signed up for across any of our platforms and to manage your account.
• Legitimate interests: To improve our services, ensure platform security, prevent fraud, and communicate with you about service updates. We only rely on this basis where our interests are not overridden by your rights.
• Compliance with legal obligations: Where we are required to process data to comply with applicable law.
• Consent: For marketing communications, non-essential cookies on the website, and certain processing activities. Where we rely on consent, you may withdraw it at any time by contacting privacy@mehlia.co or using the relevant in-app or on-site controls.

Landlord account holders uploading tenant data are independently responsible for establishing and documenting their own lawful basis for that processing under applicable data protection law.

6. How We Use Your Information

6.1 Across All Platforms

We use personal data to:

• Create and manage user accounts
• Provide, maintain, and improve our platforms and features
• Respond to support requests and communicate with users
• Send service-related notifications (e.g. security alerts, policy updates)
• Monitor for fraudulent activity and ensure platform security
• Comply with legal and regulatory obligations
• Conduct analytics and improve platform performance

6.2 Mehlia App (Landlords)

In addition to the above, we use landlord account holder data to:

• Process subscription payments and manage billing via Apple
• Enable landlords to manage properties, tenancies, documents, and finances
• Facilitate communication between landlords and their tenants via Mehlia Resident

6.3 Mehlia Resident App (Tenants)

In addition to the above, we use Mehlia Resident user data to:

• Display tenancy information relevant to the tenant's active lease
• Enable tenants to submit and track maintenance requests
• Facilitate communication between tenants and their landlord
• Send notifications relevant to the tenant's tenancy

6.4 Mehlia Website

For website visitors, we use collected data to:

• Respond to enquiries and contact form submissions
• Send requested marketing or product update communications (with consent)
• Analyze website traffic and improve the user experience

We will not use personal data for purposes incompatible with those described above without notifying you and, where required, obtaining your consent.

7. Storage and Security of Data

All data collected across our platforms is stored on reputable cloud infrastructure providers. We implement commercially reasonable technical and organizational security measures, including:

• Encrypted data transmission using SSL/TLS
• Encrypted storage at rest using industry-standard encryption
• Restricted internal access based on the principle of least privilege
• Role-based access controls (RBAC)
• Ongoing security monitoring and logging
• Regular review of security practices

While we implement robust safeguards, no digital platform or internet transmission can be guaranteed to be 100% secure. In the event of a data breach likely to result in a risk to your rights and freedoms, we will notify affected individuals and relevant supervisory authorities as required by applicable law.

8. Data Retention

We retain personal data only for as long as is necessary for the purposes set out in this Privacy Policy, or as required by applicable law:

• Landlord account holder data is retained for the duration the account remains active, and for a reasonable period thereafter to manage post-cancellation queries or legal obligations.
• Mehlia Resident account data is retained for the duration the tenant's account remains active. Where a tenancy ends, we retain data only for as long as reasonably necessary for legal or dispute resolution purposes, after which it is deleted or anonymized.
• Tenant documents and records uploaded by landlord account holders will be permanently deleted within 90 days of the landlord account being deleted, except where we are legally required to retain certain data.
• Website enquiry and contact form data is retained for up to 12 months, or for as long as necessary to respond to and resolve the enquiry.
• Automatically collected technical data (analytics, crash logs) is retained for limited periods as required for operational purposes.
• Encrypted backup copies may be retained for a limited period as part of our standard backup procedures, after which they are permanently deleted.

Users of both the Mehlia app and Mehlia Resident app may initiate deletion of their account and all associated personal data directly from within the respective app. Upon submitting a deletion request in-app, account data will be permanently removed within 30 days, and any associated documents or records will be permanently deleted within 90 days, except where we are legally required to retain certain data. Backup copies will be purged within a reasonable period following completion of the deletion process.

9. Data Sharing and Disclosure

We do not sell, rent, or trade personal data from any of our platforms to any third party. We may share data with carefully selected third-party service providers who assist us in operating our platforms, subject to appropriate contractual safeguards. These include: cloud hosting and infrastructure providers; analytics providers; customer support tools; payment processors (for subscription management, see Section 11).

All third-party service providers are contractually required to maintain appropriate confidentiality and data security obligations, and are not permitted to use data for any purpose other than providing services to Mehlia.

9.1 Data Shared Between Mehlia and Mehlia Resident

To enable the core functionality of the platform, certain data is shared between the Mehlia landlord app and the Mehlia Resident tenant app. Landlords may share tenancy information, property details, and communications with their tenants via Mehlia Resident. Tenants may submit maintenance requests, messages, and updates that are visible to their landlord via the Mehlia app. This sharing is integral to the service. Landlords are responsible for ensuring they have a lawful basis to share tenant data within the platform.

9.2 Third-Party SDKs and Integrations

Our apps and backend infrastructure integrate third-party SDKs and services (e.g. Node.js, Express.js, MongoDB, AWS S3, Brevo, Redis, Firebase, Google APIs, Socket.io, Freshchat, Google Sign-In, Sign in with Apple, In-App Purchases). Each third-party processes data only as necessary to provide their respective service and is subject to their own privacy policy. For full details and links to each provider's privacy policy, please contact privacy@mehlia.co.

We may also disclose personal data where required or permitted by law, including: in response to a valid court order, subpoena, or legal process; to protect the rights, property, or safety of Mehlia, our users, or others; in connection with a merger, acquisition, or sale of assets (in which case affected users will be notified).

10. Landlord Responsibilities as Data Controllers

Where landlords upload, manage, or share personal data relating to their tenants through the Mehlia platform, they act as independent Data Controllers for that data. As such, landlords are responsible for: ensuring they have a valid lawful basis for processing tenant personal data; informing their tenants that their data may be stored and managed via Mehlia; responding to data subject requests from their tenants regarding data the landlord has uploaded; ensuring that data uploaded is accurate, up to date, and limited to what is necessary; complying with all applicable data protection laws in their jurisdiction.

Mehlia provides the platform infrastructure but does not verify or take responsibility for the lawfulness of data uploaded by landlord users. If a tenant believes their data has been mishandled by their landlord via the platform, they should contact their landlord in the first instance. Mehlia will cooperate with valid legal requests where appropriate.

11. Payment and Subscriptions

Mehlia offers optional in-app subscriptions processed exclusively through Apple Inc. via the Apple App Store. This applies to the Mehlia landlord app only. Payment information is handled entirely by Apple. Mehlia does not collect, store, or process any credit card or payment details. Subscriptions automatically renew unless cancelled through your Apple App Store account settings at least 24 hours before the end of the current subscription period. Refunds, billing disputes, and subscription management are handled by Apple in accordance with their applicable policies and terms. For queries about billing, please refer to Apple's support resources or your App Store account settings.

12. International Data Transfers

As Mehlia uses cloud-based infrastructure, personal data collected across all platforms may be transferred to and processed in countries outside your country of residence, including countries that may not provide the same level of data protection as your home jurisdiction. Where such transfers occur, we ensure appropriate safeguards are in place, including: Standard Contractual Clauses (SCCs) approved by the relevant data protection authority; encrypted transmission and secure cloud hosting; binding contractual obligations on all recipients of personal data.

By using any of our platforms, you acknowledge that your data may be transferred internationally in accordance with this section.

13. Your Data Protection Rights

Depending on your country of residence and applicable data protection law, you may have the following rights in relation to your personal data:

• Right of Access: To request a copy of the personal data we hold about you.
• Right to Rectification: To request correction of inaccurate or incomplete data.
• Right to Erasure: To request deletion of your personal data, subject to legal obligations.
• Right to Restriction: To request that we limit the processing of your data in certain circumstances.
• Right to Object: To object to processing based on legitimate interests.
• Right to Data Portability: To receive your data in a structured, machine-readable format.
• Right to Withdraw Consent: Where processing is based on consent, to withdraw it at any time without affecting the lawfulness of prior processing.

13.1 How to Exercise Your Rights

Users of the Mehlia app and Mehlia Resident app may initiate account deletion directly from within their respective app. All other rights requests may be submitted to privacy@mehlia.co. We may require you to verify your identity before processing your request and will respond within the timeframe required by applicable law (generally within 30 days).

13.2 Rights Specific to Tenants

Tenants whose personal data has been uploaded into the platform by a landlord account holder should, in the first instance, direct requests to their landlord (as the Data Controller for that uploaded data). However, where Mehlia acts as Data Controller, such as for data submitted directly through the Mehlia Resident app, tenants may direct requests to us at privacy@mehlia.co.

13.3 California Residents (CCPA)

California residents may have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information is collected and how it is used, the right to know whether personal information is sold or disclosed, the right to opt out of the sale of personal information, and the right to non-discrimination for exercising CCPA rights. Mehlia does not sell personal information as defined under the CCPA.

14. Children's Privacy

None of our platforms (the Mehlia app, Mehlia Resident app, and Mehlia website) are intended for individuals under the age of 18. We do not knowingly collect personal data from minors. If you believe that we have inadvertently collected data from a minor, please contact us at privacy@mehlia.co and we will take prompt steps to delete that information.

15. Account Security

All users across the Mehlia app and Mehlia Resident app are responsible for maintaining the confidentiality of their login credentials and for all activity that occurs under their account. In particular, you agree to: keep your password and access credentials confidential; not share your account with any unauthorized person; notify us immediately at privacy@mehlia.co if you suspect any unauthorized access to or use of your account.

Mehlia will not be responsible for any losses or damages arising from compromised user credentials where such compromise was not caused by our own negligence.

16. Third-Party Links and Services

Our platforms may contain links to third-party websites or integrate with third-party services. This Privacy Policy does not apply to those third-party services, and we are not responsible for their data practices. We encourage you to review the privacy policies of any third-party services you interact with.

17. Changes to This Privacy Policy

We reserve the right to update or modify this Privacy Policy at any time. Where changes are material, we will provide notice through: in-app notifications within the Mehlia and Mehlia Resident apps; email communication to registered account holders; a notice on the Mehlia website.

We will update the "Effective Date" at the top of this policy whenever changes are made. Your continued use of any of our platforms following notification of changes constitutes your acceptance of the updated policy. If you do not agree to any changes, you should discontinue use of the relevant platform.

18. Governing Law and Dispute Resolution

Mehlia is owned and operated by a company incorporated in the United Arab Emirates, registered under the International Free Zone Authority (IFZA), Dubai, UAE.

This Privacy Policy and any disputes arising in connection with it are governed by the laws of the United Arab Emirates, including the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL). Any dispute that cannot be resolved informally shall be subject to the exclusive jurisdiction of the competent courts of Dubai, UAE, unless otherwise required by mandatory consumer protection or data protection law in your country of residence.

We recognize that users of our platforms may be located in jurisdictions with their own applicable data protection laws. Where such laws apply, including but not limited to the EU General Data Protection Regulation (GDPR), UK GDPR, or the California Consumer Privacy Act (CCPA), we are committed to meeting the obligations imposed by those frameworks in addition to UAE federal law.

If you have an unresolved concern about our data practices, you have the right to lodge a complaint with the relevant data protection supervisory authority in your jurisdiction, including: the UAE data protection authority for UAE-based matters; the Information Commissioner's Office (ICO) for UK residents; your national data protection authority for EU residents (e.g. CNIL in France, BfDI in Germany).

19. Contact Information

If you have any questions, concerns, or requests relating to this Privacy Policy or our data practices across any of our platforms, please contact us at: