Privacy Policy

1. Information we collect

Account and profile data: your name, work email, phone number, organisation, role and authentication identifiers when you register, sign in or are invited to a workspace. We support sign-in through connected identity providers, in which case we receive the basic profile details those providers share.

Content and customer data: the records you create or import into the Service, including client and lead details, listings, deals, documents, calendar events, call metadata and messages sent through connected channels such as email and messaging providers.

Usage and device data: log data, IP address, browser and device type, pages viewed, actions taken and timestamps, collected to operate, secure and improve the Service.

Billing data: the plan you select, seat counts and payment status. Card details are handled by our payment processor and are never stored on our servers.

2. How we use your information

We use personal data to provide, maintain and secure the Service; to authenticate users and enforce workspace permissions; to deliver features you request, such as AI-drafted messages, lead scoring, sequences and reporting; to process subscriptions and payments; and to provide support.

We also use aggregated and de-identified usage data to understand how the Service is used, diagnose problems and improve performance. We do not sell personal data.

3. AI features and processing

Some features use artificial intelligence to draft communications, summarise conversations, classify inbound messages and suggest next actions. When you invoke these features, the relevant content is processed to generate the output you asked for. AI outputs are suggestions and should be reviewed by a person before they are sent or relied upon.

To generate these outputs we transmit the relevant content to third-party AI providers acting as our processors under contract. They may use it only to return the requested output, must not retain it beyond what is needed to do so, and must not use it to train their own or any generalised models. Content from connected Google accounts is included only when you invoke a feature that acts on that content.

AI processing is subject to per-organisation usage limits and internal guardrails. We do not use your customer data to train third-party foundation models.

4. Connected channels and integrations

The Service can connect to third-party providers you authorise, including email (such as Gmail or Outlook) and messaging (such as WhatsApp), so you can send and receive communications from within COM8. When you connect an account, we access only the data needed to provide the feature, in line with the permissions you grant, and you can disconnect at any time.

Each integration is governed by the third party’s own terms and privacy policy. We recommend you review them before connecting.

5. Google user data and Limited Use

When you connect a Google account, COM8's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Scopes we request and why: Gmail (gmail.modify) — to display your inbox inside COM8 so you can triage client and buyer inquiries and link a message to the relevant lead or deal, and to apply the mailbox actions you explicitly click: mark as read, star and archive. We never delete your messages and never alter message content. Gmail (gmail.send) — to send emails you compose and send in COM8, from your own address; every send follows an explicit action by you. Google Calendar (calendar.events) — to create, view and update the property-viewing appointments you schedule with clients, and to show your existing calendar events so you can avoid double-booking. Basic profile (userinfo.email, userinfo.profile) — to identify your account.

How we handle Google user data: we use it solely to provide the features above; we do not sell it, and we do not use it for advertising; we do not use it to train generalised AI/ML models; no human at COM8 reads your Google data, except with your explicit consent, for security or abuse investigations, or where required by law.

We store only what is needed to operate the features, and you can disconnect a Google account at any time from Settings > Integrations, or revoke access from your Google Account permissions page. Disconnecting stops all further access.

6. How we share information

We share personal data with service providers who help us run the Service, such as cloud hosting, payment processing, communications infrastructure and analytics, under contracts that require them to protect the data and use it only on our instructions.

We may disclose data where required by law or valid legal process, to protect the rights, safety and security of COM8, our users or the public, or in connection with a merger, acquisition or sale of assets, in which case we will continue to protect the data under this policy.

7. Data retention

We retain personal data for as long as your account is active and as needed to provide the Service, comply with legal obligations, resolve disputes and enforce our agreements. Customer data is retained on behalf of the controlling brokerage and is deleted or returned on request in line with our agreement with that brokerage.

When data is no longer required, we delete or anonymise it.

8. Data security

We apply administrative, technical and organisational measures designed to protect personal data, including encryption in transit, access controls, tenant isolation, audit logging and least-privilege practices. No method of transmission or storage is completely secure, but we work to protect your data and to notify you of material incidents where required by law.

9. International transfers

We primarily host data in the region that serves our UAE customers. Where data is transferred to or accessed from other countries, we take steps to ensure an appropriate level of protection consistent with applicable data-protection law.

10. Your rights and choices

Depending on your location and role, you may have the right to access, correct, export or delete your personal data, to object to or restrict certain processing, and to withdraw consent. Users can update much of their profile data directly in the Service.

If you are a customer contact managed by a brokerage using COM8, please direct requests to that brokerage as the controller of your data; we will assist them in responding.

11. Cookies and analytics

We use cookies and similar technologies to keep you signed in, remember preferences, secure the Service and measure usage. You can control cookies through your browser settings, though disabling some cookies may affect functionality.

12. Children’s privacy

The Service is intended for business use by professionals and is not directed to children. We do not knowingly collect personal data from anyone under the age of 18.

13. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the date above and, where appropriate, notify you through the Service. Your continued use of the Service after an update constitutes acceptance of the revised policy.

14. Contact us

For questions about this policy or to exercise your data-protection rights, contact us at info@com8.io or by post at COM8 Realty, Building 1, Jebel Ali Industrial 1, 47th Street, Dubai, UAE.