Privacy Policy
What personal data MyBedSpace collects, why, who receives it, how long it is kept, and how to make a request.
Draft — not yet in effect. This document is being reviewed and will be finalised before public launch. Highlighted items are still to be confirmed.
Version draft-2026-10-20
Who is responsible for your data
[LEGAL ENTITY NAME], [REGISTERED ADDRESS]. Privacy requests: [PRIVACY CONTACT EMAIL].
What we collect
- Account details: name, email address, phone number if you add one, and your role (finder, host or admin). Passwords are handled by our sign-in provider and never stored by MyBedSpace.
- Listing content hosts publish: title, description, area, price, facilities, rules and photos.
- Host verification details: Emirates ID and Ejari contract numbers, stored encrypted and used only to verify a host's identity and authority to list. They are never shown to finders.
- Enquiries: the message you send to a host and its status.
- Saved listings.
- Reports: the listing, the reason and any details you add. For anyone reporting without an account, we keep a one-way hash of the IP address to limit abuse, not the IP address itself.
- Technical data: error reports from the website (browser type, page and the error itself) to fix problems. IP addresses are not stored with error reports.
Why we use it
- To create and run accounts, publish listings and deliver enquiries to hosts.
- To review listings and reports, prevent fraud and abuse, and keep the service secure.
- To provide support and meet legal obligations.
- To find and fix errors so the service keeps working.
Who receives it
- Vercel — hosts the website.
- Supabase — database, sign-in (including account emails such as password resets) and file storage for listing photos.
- Sentry — error reports from the website.
- Google Analytics — only if you switch on analytics cookies: pages viewed and how the site is used, to improve it. Off by default.
- OpenFreeMap — serves the OpenStreetMap map tiles for a listing's area (never its exact address) on listing pages, and for the map a host uses to place their listing's pin. Your browser requests the tiles directly, so OpenFreeMap sees your IP address and which map area is shown; it sets no cookies and has no user accounts. The pin itself is never sent to it.
- Authorised MyBedSpace staff, only as their role requires.
- Hosts receive the enquiries you send them. Hosts never see who reported a listing.
- Anyone who views a published listing sees the contact phone number the host entered for that listing. Hosts choose to show it; it is not the phone number on their account.
- We do not sell personal data and do not use advertising or marketing trackers.
Where it is processed
Our service providers may process data outside the UAE. [LIST OF PROCESSING LOCATIONS PER PROVIDER — TO BE CONFIRMED]. [TRANSFER SAFEGUARDS — TO BE CONFIRMED BY UAE COUNSEL].
How long we keep it
- Account data: [ACCOUNT DATA RETENTION PERIOD].
- Listings and photos after they are removed: [LISTING AND PHOTO RETENTION PERIOD AFTER REMOVAL].
- Enquiries: [ENQUIRY RETENTION PERIOD].
- Reports: [REPORT RETENTION PERIOD].
- Host identity and Ejari records: [IDENTITY / EJARI RECORD RETENTION PERIOD].
- Error reports: [ERROR-LOG RETENTION PERIOD].
Your requests
You can ask to access or correct your data, ask for it to be deleted where that applies, or object to how it is used. Contact [PRIVACY CONTACT EMAIL]. We may need to confirm your identity first, and some records may need to be kept where the law requires it.
Security
Sensitive identifiers are encrypted before storage, compliance documents are kept in private storage, access is limited by role, and sensitive actions are logged. No system is completely secure; if something goes wrong we will act on it.