Privacy Policy

Information we collect

• Enquiries and leads: your name, email address or telephone number, message, consent, language, landing page, referrer, and campaign attribution you provide when contacting us or requesting an advisor.
• Partner accounts: sign-in and profile details, company information, requested developer or agent roles, licence details, contact information, identity or authorization evidence, and supporting documents. Licence and identity documents are private and are not published through catalogue APIs.
• Developer submissions: project details, contacts, revisions, review history, media, floor plans, brochures, and other files submitted for staff review.
• Agent quotations: agent identity and branding, the selected verified project or unit, the project data snapshot, quotation number, issue and validity dates, and the generated PDF. Issued quotation snapshots and PDFs are kept immutable.
• Assistant and issue reports: chat and AI conversation content, current project or filter identifiers supplied as context, advisor handoff choices, feedback, issue descriptions, and evidence you choose to attach.
• Use of the service: privacy-conscious events such as searches, verification controls, marketplace opt-in, project views, applications, submissions, quotations, AI conversations, handoffs, and leads, together with necessary technical, security, cookie, and session information.

Why we use information

We use personal data to provide requested services; respond to enquiries; review and administer partner roles and licences; moderate and publish approved project submissions; generate and preserve quotations; operate grounded search, map, and AI features; investigate incorrect-data or answer reports; measure and improve the service; prevent abuse; maintain security; and meet applicable legal, accounting, and dispute-handling obligations.

Where we ask for consent—such as the contact form or an advisor handoff—we use the information for that stated request. Other processing may be necessary to provide an account or requested service, operate and secure MDSearch, maintain business records, or comply with law. You can withdraw consent for future consent-based processing, although that does not undo processing already carried out.

Sharing and service providers

Authorized MDSearch staff can access information needed for their work. We may use contracted technology providers for hosting, storage, security, communications, document and PDF generation, analytics, customer management, and AI functionality. They should process data only to provide those services and under appropriate safeguards. We share details with an advisor or other partner only where you request or consent to the handoff, and may disclose information where required to protect rights, investigate abuse, or comply with lawful authority. We do not treat public marketplace listing data as a verified MDSearch project.

UAE and international processing

MDSearch operates for users and partners in the UAE. Some service providers may process or store information in other countries. Where that occurs, we seek contractual, organizational, and technical safeguards appropriate to the information and applicable cross-border requirements. The UAE Government’s summary of Federal Decree-Law No. 45 of 2021 and UAE data protection laws describes consent, correction and restriction rights, and cross-border controls. This policy is a service notice, not legal advice or an exhaustive statement of every law that may apply.

Retention and security

We retain information only for as long as reasonably needed for the purposes above and for applicable legal, contractual, accounting, security, and dispute requirements. The period depends on the record and relationship: for example, partner evidence is tied to application, approval, licence, and compliance needs, while issued quotation snapshots and PDFs are designed to remain immutable business records. When information is no longer required, we delete, anonymize, or securely restrict it where practicable. We use access controls and other administrative and technical measures intended to protect personal data, but no online service can promise absolute security.

Cookies and sessions

MDSearch and its Odoo platform use cookies or similar browser storage that are necessary for sign-in, security, language, session continuity, and core site operation. Limited measurement may be used to understand the privacy-safe events described above. Browser controls can block or remove cookies, but disabling necessary cookies may prevent account, form, chat, or workspace features from working correctly.

Your choices and rights

You may ask about the personal data we hold, request access or correction, ask us to restrict or stop certain processing, request deletion where applicable, object to particular uses, or withdraw consent for future consent-based processing. Some requests may be limited where retention or processing is required for security, legal claims, compliance, or an active service relationship. We may need to verify your identity before acting on a request.