Privacy Policy

RSD, by Aquity · Effective 23 September 2026

This policy explains what data we collect when RSD is used, why, who can see it, how it is kept, and what rights you have over it. “We” means Aquity, the operator of RSD. “The office” means a real estate office subscribed to RSD. “The customer” means a person dealing with an office to sell, buy or rent a property.

1. What RSD is

RSD is a management system for real estate offices in the State of Kuwait. An office uses it to record offers and requests, match them, schedule viewings, communicate with its customers through the office's own WhatsApp number, and keep the documents of closed deals. We provide the system; the office enters and controls the data, and we process it on the office's behalf.

2. Data we process

• Customer data: name, phone number, and what the customer says about the property they want or offer (type, area, budget or price, size, the official address number).
• Messages: messages exchanged between a customer and the office's WhatsApp number, delivered to us through the WhatsApp Business Platform provided by Meta. We never see conversations on a customer's personal phone or on any number other than the office's.
• Office team data: name, email address, phone number, role, and what each member does inside the system.
• Deal documents: contracts, title deeds, civil ID copies and receipts that the office uploads to its archive after a deal closes.
• Technical data: sign-in logs, browser type and network address, used for security and troubleshooting only. We do not use advertising trackers.

3. Why we process it

• To let the office serve its customers: matching offers to requests, replying to messages, booking viewings, closing deals.
• To alert the office's team to what needs attention, such as an unanswered request or an upcoming viewing.
• To protect the system against unauthorised use.
• To meet obligations under the laws in force in the State of Kuwait.

When recording a new listing, an office may use the “analyse” feature, which reads the text of an advertisement and suggests how to fill the form. The text is then sent to Anthropic for analysis; it is not stored there or used to train its models, and no record is created in RSD until an office member reviews and confirms it.

We do not sell or rent data, use it for advertising, or build customer profiles from it.

4. Who can see the data

Each office's data is isolated from every other office's. The isolation is enforced by the database itself: no office, and no member of one, can reach another office's data by any means. Within an office, the owner decides each member's permissions, including who sees WhatsApp conversations and who opens the document archive.

We rely on the following service providers, each bound by contract to protect the data and use it for no other purpose:

• Supabase: database hosting and file storage.
• Vercel: application hosting.
• Meta Platforms: delivery of WhatsApp messages, and publishing to the office's own Instagram account when the office chooses to connect it.
• Anthropic: analysis of advertisement text, only when the “analyse” feature is used.

We disclose data to no one else, except on the order of a competent court or authority in the State of Kuwait, and only to the extent the order requires.

5. Information security

We apply the following controls to protect data, and review them regularly:

• Encryption in transit: all traffic between users and the system, and between the system and its service providers, is encrypted with TLS 1.2 or later.
• Encryption at rest: the database and stored files are encrypted at rest by the hosting provider using AES-256. Each office's WhatsApp and Instagram connection keys are additionally encrypted with a key held only on the application server, so they never appear in clear text in the database and no user can read them.
• Data isolation: every record belongs to exactly one office, and the database itself enforces that boundary on every read and write; no query runs outside the user's own office.
• Access control: every member has a personal account with a defined role (owner, manager, agent, external agent). Only the office owner grants sensitive permissions such as reading WhatsApp conversations or opening the archive, and no member can change their own role or permissions; the attempt is refused at the database level.
• Archive documents: kept in private storage with no public links; a document is opened through a temporary link that expires within sixty seconds, and only by members the office owner has allowed.
• Message authenticity: the system accepts an incoming WhatsApp message only after verifying Meta's digital signature on it, so no third party can inject fabricated messages.
• Administrative access: access to the production environment is limited to named Aquity personnel, using personal accounts protected by two-factor authentication, and is used to view office data only to resolve a fault or at the office's request.
• Backups: the database is backed up daily and the backups are stored encrypted, so service can be restored after a failure.
• Maintenance and review: we update system components regularly, review security controls on every material change, and test the isolation and permission rules automatically before any update is released.

Incident notification: if a security incident affects an office's data or its customers', we notify the office within 72 hours of confirming it, stating what happened, what was affected and what we did, and we cooperate with the competent authorities in the State of Kuwait as the law requires. Any vulnerability reported to info@aquity.io is addressed as a priority.

6. Retention

We keep an office's data for as long as its subscription is active. When it ends, the office may request a copy of its data; we then delete everything within thirty days, including messages and archive documents. WhatsApp messages an office deletes from the system are deleted immediately. Connection keys are deleted the moment WhatsApp or Instagram is disconnected in the office settings.

7. Your rights

Every customer may ask what data an office holds about them, have it corrected or deleted, and object to being contacted. The quickest route is the office you deal with, which can act immediately from within the system. You may also write to us at info@aquity.io; we reply within five working days and act within thirty days at most. See our data deletion instructions.

A customer may stop WhatsApp messages from an office at any time by replying “stop” or blocking the number, and the office must then no longer message them.

8. Minors

RSD is intended for real estate offices and their adult customers. We do not knowingly collect data from anyone under twenty-one.

9. Governing law

This policy is governed by the laws of the State of Kuwait, including Law No. 20 of 2014 on Electronic Transactions, Law No. 63 of 2015 on Combating Information Technology Crimes, and the Data Privacy Protection Regulation issued by the Communication and Information Technology Regulatory Authority (CITRA).

10. Changes

If we make a material change to this policy, we notify subscribed offices by email at least fourteen days before it takes effect, and we update the date at the top of this page.

11. Contact

Aquity, State of Kuwait
Email: info@aquity.io