Privacy Policy

Majlis CRM is a real-estate customer relationship management service provided by Thirty Days LLC in Dubai, United Arab Emirates ("Thirty Days", "Majlis CRM", "we", "us" or "our"). This policy applies to our website, accounts and the Majlis CRM service.

For account, website and service-administration data, Thirty Days decides why and how the data is used. For personal data that a brokerage or other customer adds to its workspace, that customer controls the data and Majlis CRM processes it to provide the service. If your data was entered by one of our customers, please contact that customer first about your privacy request.

We collect information you provide, information created through use of the service, and limited technical data:

• Account and organisation data: name, work email, phone number, company name, role, permissions and sign-in credentials.
• Workspace content: contacts, leads, property interests, notes, call outcomes, tasks, appointments, documents, deals, invoices, pipelines, activities and other records a customer chooses to enter.
• Communications: messages, templates, attachments and delivery details when communication features or integrations are used.
• Integration data: information received from services a customer connects, such as property portals, webhooks, calendars, email or messaging providers, together with the authorisations needed to maintain that connection.
• Usage and device data: IP address, browser and device information, timestamps, feature activity, error reports and security logs. We may use cookies or local storage for sign-in, preferences and service operation.
• Commercial data: subscription, billing and transaction status. Card payments are processed by Stripe; we never receive or store card numbers - Stripe holds them under its own terms and certifications.

We use personal data to:

• provide, operate and support Majlis CRM, including workflows, reporting, collaboration and connected services;
• create and administer accounts, authenticate users and apply workspace permissions;
• process customer instructions and send service, security and account communications;
• monitor reliability, troubleshoot errors, prevent abuse and protect users and the service;
• understand and improve product performance and develop relevant features; and
• comply with law, resolve disputes and enforce our agreements.

We process information only where there is a valid reason under applicable law, such as providing a requested service, complying with a legal obligation, protecting legitimate business and security interests, or acting with consent where consent is required.

We do not sell personal data. We may share it only as needed with:

• the customer and its authorised users, according to workspace roles and permissions;
• service providers, such as hosting, database, communications, analytics, support and security providers, and Stripe for payment processing, under appropriate contractual obligations;
• connected third-party services, when a customer enables an integration or asks us to send data to it;
• authorities or other parties, when reasonably necessary to comply with law, protect rights and safety, or investigate fraud or misuse; and
• a successor organisation, as part of a merger, financing, reorganisation or sale, subject to appropriate confidentiality and notice requirements.

Majlis CRM connects to the WhatsApp Business Platform provided by Meta. A customer chooses to connect their own WhatsApp Business account, and that connection is what allows the service to send and receive messages on their behalf.

When a customer connects WhatsApp, we receive and store:

• messages exchanged with that business, including the message text, timestamps and delivery status;
• the sender's WhatsApp phone number and profile name, which we use to create or match a contact record;
• account identifiers, such as the WhatsApp Business Account ID and phone number ID, together with the access token that authorises the connection.

We use this information only to deliver the messaging features of the CRM: showing conversations to the customer's own agents, matching messages to the right contact and lead, and sending replies the customer composes. We do not sell it, use it for advertising, or use it to build profiles unrelated to the customer's own relationship with that person. Access tokens are stored for the connected account only and are never shown in the interface.

Disconnecting WhatsApp in Settings stops all further message exchange immediately. Message history already stored in the customer's workspace remains until it is deleted as described below, and data held by Meta continues to be governed by Meta's own policies.

Majlis CRM offers an optional connection to Facebook and Instagram lead ads. A customer chooses to connect the Facebook Pages they manage through Facebook Login for Business, so that people who submit the lead forms on those Pages arrive as leads in the customer's own CRM workspace. The same Facebook Login is used when a customer connects their WhatsApp Business account.

Facebook Login is used only to identify the person making the connection (the public profile Meta provides). We do not store their Facebook profile, and we do not request their email address, friends or any other personal Facebook data.

When a customer connects their Pages, we receive and store:

• the Pages they choose to connect, with each Page's name, ID and the Page access token that authorises the connection;
• the lead forms on those Pages, including each form's name, status and questions, so the customer can choose which forms to use and map each question to a CRM field;
• lead form submissions, meaning the answers a person gives on a connected form (such as their name, phone number, email address and any other questions the customer asks), the time of submission, and the form and ad it came from.

We use this information only to create and update leads in that customer's workspace, assign them to the customer's own agents, and let the customer follow up. We do not access ad accounts, campaigns or advertising spend, and we do not sell lead data, use it for advertising, or share it with other workspaces. Page access tokens are stored encrypted and are never shown in the interface.

Disconnecting a Page in Settings unsubscribes it immediately, so no further leads are received. Leads already created remain in the customer's workspace until they are deleted as described below, and data held by Meta continues to be governed by Meta's own policies.

Majlis CRM offers an optional Google Calendar connection. An agent chooses to connect their own Google account through Google's sign-in and consent screen; nothing is accessed until they do. The connection requests only the calendar events permission (https://www.googleapis.com/auth/calendar.events) together with basic sign-in (openid, email).

When an agent connects Google Calendar, we receive and store:

• the connected Google account's email address, shown in Settings so the agent can see which account is linked;
• OAuth tokens that authorise the connection. The refresh token is encrypted at rest (AES-256-GCM) and is never shown in the interface or written to logs;
• calendar event data - titles, descriptions, locations, start and end times, attendee email addresses and meeting links - for events the CRM creates on the agent's calendar, and for events read back to display on the CRM calendar.

We use this information solely to provide the calendar features the agent sees: creating, updating and cancelling appointments booked in the CRM on their Google Calendar (including generating Google Meet links and sending invitations to attendees they choose), and displaying their Google Calendar events alongside CRM appointments. We do not use Google user data for advertising, do not sell it, do not transfer it to third parties except as needed to provide these features or comply with law, and do not allow humans to read it except with the agent's affirmative consent, for security purposes, or where required by law. Google user data is not used to develop, improve or train generalised artificial-intelligence or machine-learning models.

Majlis CRM's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Disconnecting Google Calendar in the CRM revokes the connection with Google and deletes the stored tokens immediately. Events already recorded in the customer's workspace remain part of that workspace until deleted as described below; the copies on the agent's Google Calendar remain under Google's own policies. Agents can also remove the connection at any time from their Google account permissions page.

The iPhone and Android app is a companion to the same workspace and is covered by this policy. It signs in against the same account and reads and writes the same records, so nothing separate is collected about you as a person.

• Sign-in tokens are held in the device keychain or keystore rather than ordinary app storage, and are removed when you sign out.
• Push tokens: if you allow notifications, the device gives us an identifier we store against your agent record so alerts about your own leads and tasks can reach you. Turning notifications off in your phone settings stops it being used.
• Calls and messages: tapping call, WhatsApp or email hands the number or address to your phone's own apps. The conversation happens there and we receive none of its content.
• No advertising or tracking. The app carries no advertising identifiers, builds no marketing profile, and does not track you across other companies' apps or websites.

You can ask for your account to be deleted from Settings inside the app, or by writing to support@majliscrm.com.

Majlis CRM and its providers may process information in the UAE and in other countries where they operate. Those countries may have different data-protection rules. Where applicable law requires it, we use recognised safeguards for cross-border transfers and limit providers to processing data for agreed purposes.

We retain personal data for as long as needed to provide the service, meet contractual and legal obligations, maintain security and audit records, and resolve disputes. Retention depends on the type of record and the customer's instructions. When an account ends, we may keep data for a limited period for recovery, legal or security purposes before deletion or anonymisation. Backup copies may remain until they cycle out under our normal backup schedule.

We use administrative, technical and organisational measures designed to protect information against unauthorised access, loss, misuse or alteration. Customers are responsible for choosing trusted users, assigning appropriate permissions, protecting credentials and securing the devices and integrations they use. No internet service can guarantee absolute security.

Our processing of personal data is governed primarily by UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the PDPL). Under it, and depending on your location and the circumstances, you may have rights to request information about processing, access or obtain a copy of personal data, correct it, ask for deletion, restrict or object to processing, request transfer to another provider, or withdraw consent you previously gave (withdrawal does not affect processing that happened before it).

For records inside a customer's workspace (contacts, leads, conversations), the brokerage that operates the workspace decides why and how that data is used - in PDPL terms it acts as controller, and we process the data on its documented instructions. For your own account and billing details, we are the controller. Complaints may be raised with us first, and with the UAE Data Office, the federal data protection authority, if you are not satisfied with our response.

Workspace administrators can update many account details directly. If a brokerage entered your information, direct your request to that brokerage because it controls the record. We may need to verify identity and may retain information where law permits or requires it.

To have your data deleted, email support@majliscrm.com from the address associated with your account, or include the phone number or email the record is held under. Write "Data deletion request" in the subject line. We respond within 30 days.

If you are a customer of a brokerage that uses Majlis CRM rather than a direct customer of ours, that brokerage controls your record and we will pass the request to them, or you can contact them directly.

A deletion request covers the personal data we hold about you, including any WhatsApp messages, lead form submissions, contact details and activity history stored in the workspace. Data may persist briefly in encrypted backups until they cycle out on our normal schedule, and we may retain the minimum required by law, for example transaction records kept for tax purposes.

Workspace administrators can also delete contacts, leads and conversations directly in the application at any time. Disconnecting WhatsApp or a Facebook Page in Settings stops all further message or lead collection immediately.

Occasionally a government body, regulator, court or law enforcement agency may ask us for information about a customer or the people they communicate with. We treat every such request the same way:

• We review it first. Before disclosing anything we check that the request is valid, comes from a body with the authority to make it, and is legally binding on us in the jurisdiction concerned. Informal or unsupported requests are declined.
• We disclose the minimum. Where a request is valid we provide only the specific information it lawfully requires, and nothing beyond it. We do not hand over whole accounts or workspaces in response to a request for a single record.
• We challenge unlawful or overbroad requests. If a request appears to lack a proper legal basis, exceeds what the law permits, or is unreasonably broad, we push back and, where appropriate, contest it before disclosing.
• We keep a record. Every request, our assessment of it, what (if anything) was disclosed, and the legal basis relied on is documented and retained.
• We tell the customer where we can. Unless we are legally prohibited from doing so, or doing so would create a clear risk of harm, we notify the affected customer so they have the opportunity to respond themselves.

Where information originates from Meta platforms, such as WhatsApp messages, we additionally comply with the terms Meta imposes on developers regarding requests for that data.

Links and integrations are governed by the third party's own terms and privacy practices. A customer decides which integrations to connect and what information to exchange. We recommend reviewing those policies before enabling a connection. Disabling an integration stops future exchanges but does not automatically delete data already received by that provider.

Majlis CRM is a business service and is not directed to children under 18. Do not create an account for a child or intentionally add children's personal data unless it is lawful, necessary for a legitimate business purpose, and supported by all required permissions.

We may update this policy as our service or legal obligations change. We will post the revised version here, change the "Last updated" date and provide additional notice when a change is material.

For privacy questions or requests, including access and deletion, email support@majliscrm.com. You can also reach us through the support channel in your Majlis CRM account. Please include enough detail for us to identify the relevant workspace and request.

Majlis CRM is operated by Thirty Days LLC, Dubai, United Arab Emirates.