Keybox 3D Map
Privacy Policy
Last updated 4 November 2026
Who we are
This policy explains what personal information the Keybox 3D Map (the “Map”) at keybox.ae collects, why, where it's kept, who helps us handle it, and the rights you have over it.
The Map is run by Keybox.ae (“Keybox”, “we”, “us”) in the United Arab Emirates. We decide how and why your information is used, so we are the “controller” of it under the UAE's Personal Data Protection Law (Federal Decree-Law No. 45 of 2021, the “PDPL”).
What we collect
- Your account. Your email address and, if you sign up with one, your password, which we only ever store as a salted one-way hash: nobody, including us, can read it. If you continue with Google instead, we get the name, email address and Google account ID that Google shares with us (we don't get your Google password, contacts or anything else). We also record how you signed up, when your email was confirmed, and when the account was created.
- Your profile. After you first sign in, we ask for your first and last name, your phone number, and whether you're a real estate agent. See Your phone number and agent answer.
- Your sign-ins and devices. A session record for each device you're signed in on: when it started and was last used, the browser and device type, and the IP address it signed in from. This is how we keep you signed in and let you, or us, sign a device out.
- How you use the Map. We record simple events: pages you open, the areas and projects you view, what you search for, your device type, browser and screen size, and the country you're in. The country is worked out from your IP address when the event happens; we don't store the IP address with these events. We don't use advertising trackers or third-party analytics, and we don't follow you around other websites.
- Security signals. To stop bots and people copying the Map in bulk, we record technical details of how the Map's data is requested: your IP address and the type of network it belongs to (for example a data centre), how many map tiles your account loads and how fast, whether the map camera is moving, the results of our automatic bot check, and any request to addresses that normal use never reaches. See How we protect the Map.
- Messages you send us. If you email us, we keep the message and your reply address so we can answer.
- Settings on your device. Your start area, recent searches and map settings (such as metro lines and shadows) are kept in your browser's local storage so the Map opens the way you left it. They stay on your device and aren't sent to us.
We don't ask for, and please don't send us, sensitive information such as ID documents, financial details, health information or religious beliefs.
Why we use it
We only use your information for these purposes, and the PDPL allows each of them on the basis shown:
- To create your account, sign you in and keep you signed in. Needed to provide the Map you signed up for under our Terms of Use.
- To protect the Map from scraping, bots and misuse, and to enforce our Terms. Needed to provide the Map securely under the Terms, and to establish or defend our legal rights if the Map's designs or data are copied.
- To understand how the Map is used and improve it (which areas and features people use, what searches find nothing, which devices need to be faster). Based on your consent, which you give when you create your account; you can withdraw it at any time (see Your rights).
- To run your account and contact you about Keybox using your name, phone number and agent answer. Based on your consent, which you give when you fill them in, and needed to provide your account. See Your phone number and agent answer.
- To send you emails you need, such as sign-in links and notices about your account or changes to these terms. Needed to provide the Map.
- To send you news about the Map or new projects, only if you opt in. You can unsubscribe from any of these emails.
- To meet our legal obligations and answer lawful requests from authorities.
We don't sell your personal information, we don't use it for advertising, and we don't pass your details to developers or agents unless you ask us to.
Your phone number and agent answer
We ask for your first and last name, phone number and whether you're a real estate agent after your first sign-in. We use them to:
- run your account, for example to know who you are when you contact us, and to help confirm it's you if there's a problem with your account;
- contact you about Keybox, by phone, message or email, about your account, the Map and Keybox's services. Whether you're an agent helps us decide what is relevant to you. You can ask us to stop contacting you at any time;
- set up your account on the Keybox property portal when it launches, so you don't have to sign up again. We'll tell you before this happens.
We don't sell your phone number or any of these details, and we don't give them to developers, agents or anyone else to contact you. You can change or delete them at any time in your account settings or by emailing info@keybox.ae. Deleting your account deletes them too.
How we protect the Map
The Map's 3D designs take a lot of work, and some people try to copy them with bots. To stop that, we check automatically how each account uses the Map:
- Limits. Each account can load a certain amount of map data per hour and per day, and can be signed in on a limited number of devices at once.
- Automatic sign-out and suspension. If an account's activity looks like scraping (for example far more data than a person could view, at a steady machine pace, from a data centre, or a request to a trap address), it is signed out and suspended automatically. Our team then reviews it.
- Invisible markers. The map data each account receives carries small, invisible differences that are unique to that account, so that a copy found elsewhere can be traced back to the account that took it. They don't change what you see.
If your account is suspended and you think it's a mistake, write to us at info@keybox.ae. A person will review the decision, look at your side, and restore the account if it was wrong. You have the right to object to a decision made only by automatic means.
Where it's kept
The Map runs on Cloudflare. Your account, sessions, analytics events and security logs are stored in a Cloudflare database located in the European Union. Like any website on a global network, your requests are carried by Cloudflare's servers nearest to you, which may be in or outside the UAE.
This means your information is transferred outside the UAE. We only do this with the safeguards the PDPL requires: the European Union has strong data protection laws of its own, and each company that handles your information for us is bound by a written data processing agreement with standard data protection terms that require it to protect your information, use it only on our instructions and help us respect your rights. You can ask us for more detail about these safeguards.
How long we keep it
- Your account: while it's open. If you delete it, or it has not been used for 24 months (we'll email you first), we delete it within 30 days. Our database backups roll over after a further 30 days.
- Sessions: until you sign out, or [30] days after last use, whichever comes first.
- Sign-in links: work once and expire after 15 minutes. Our email provider keeps a record of each email sent for 30 days.
- Usage events: 13 months, then deleted or turned into totals that no longer identify anyone.
- Security logs (IP addresses, tile counts, bot check results): 90 days. If an account is flagged for misuse, the related records are kept until the case is closed, and for as long as needed for any legal claim.
- Suspended accounts: we keep the email address or Google account ID of a suspended account, so it can't simply sign up again, for as long as the suspension stands, up to [3] years.
- Emails you send us: 2 years after the conversation ends.
- Settings on your device: until you sign out or clear your browser's data.
Your rights
Under the PDPL you can ask us to:
- see the personal information we hold about you and get a copy, including in a format you can take elsewhere;
- correct anything that is wrong or incomplete;
- delete your information (see Delete my account);
- stop or limit how we use it, including withdrawing your consent to usage analytics, asking us to stop contacting you, or objecting to news emails;
- have a person review a decision made automatically, such as an automatic suspension.
To use any of these rights, email info@keybox.ae from the address on your account. We may ask you to confirm it's you. We'll answer within 30 days, free of charge. Some requests have limits the law allows, for example we may keep records we need to deal with misuse of the Map or a legal claim, and we'll tell you if that applies.
If you're not happy with how we've handled your information, please tell us first. You can also complain to the UAE Data Office.
Deleting your account
You can ask us to delete your account at any time on the Delete my account page or by emailing info@keybox.ae. We sign out all your devices straight away and delete your account and the information linked to it within 30 days, apart from anything we must keep by law or for an open misuse case, as explained above.
Children
The Map is for adults. You must be 18 or older to create an account. We don't knowingly collect information from anyone under 18; if you believe a child has signed up, tell us and we'll delete the account.
Keeping it safe
- If you use a password, we only store it as a salted one-way hash, never the password itself, so it can't be read even if our database were stolen. You can also sign in with Google or a single-use email link instead.
- Information travels encrypted (HTTPS), and our database is encrypted at rest and can only be reached by our own application, not from the internet.
- Only named members of our team can open the admin tools, behind two-factor sign-in, and every admin action is logged.
- Sessions can be ended from our side at once, and suspending or deleting an account signs out all its devices.
No system is perfectly secure. If a breach puts your personal information at risk, we'll act to contain it, tell the UAE Data Office as the law requires, and tell you without undue delay what happened, what it means for you and what we're doing about it.
Changes to this policy
We may update this policy, for example when the Map gains new features. The date at the top shows when it last changed. If we make a change that matters, we'll tell you by email or on the Map before it takes effect.
Contact
Questions about your information or this policy? Email info@keybox.ae. See also our contact page.